New capabilities simplify PCI DSS v4.0 compliance and help achieve the latest JavaScript security requirements: 6.4.3 and 11.6.1.
CAMBRIDGE, Mass., Oct. 3, 2023 /PRNewswire/ — Akamai Technologies, Inc. (NASDAQ: AKAM), the cloud company that powers and protects life online, today announced the general availability of new capabilities to its Client-Side Protection & Compliance product that are designed to help organizations ensure compliance with PCI DSS v4.0 JavaScript security requirements 6.4.3 and 11.6.1.
The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance payment card data security as well as facilitate the broad adoption of consistent data security measures globally. The latest update of PCI DSS (version 4.0) was released in 2022. The standard becomes effective in March 2024, with full enforcement of requirements in March 2025. It includes several new security requirements and updated guidance to address current threats and technologies. Any organization processing, storing, or transmitting payment card information online must comply.
New PCI DSS v4.0 requirements 6.4.3 and 11.6.1 outline the need for businesses to protect against harmful client-side web skimming attacks that steal sensitive end-user data from within the browser by exploiting JavaScript supply chain vulnerabilities. These attacks, such as Magecart, continue to grow in sophistication and impact digital commerce. To comply with the new standard, organizations must now know what scripts are loading and executing on the payment pages of their website, what actions those scripts are taking, and when those scripts change.
Akamai Client-Side Protection & Compliance (formerly Page Integrity Manager) provides extensive visibility into the client-side attack surface to protect against end-user data exfiltration and shields websites from JavaScript threats. It detects malicious script behavior in real time and delivers actionable alerts so security teams can quickly mitigate harmful activity. With new purpose-built PCI DSS v4.0 compliance capabilities, Client-Side Protection & Compliance helps security teams streamline compliance workflows and meet the latest JavaScript security requirements.
The new PCI DSS v4.0 compliance capabilities include:
- Script inventory management (satisfies PCI DSS v4.0 requirement 6.4.3) — Provides an inventory of all JavaScript that is loaded and executed on protected payment pages. Users can easily record written justifications for each observed script. The solution automates as much of the justification setting as possible via predefined justifications and rules, substantially reducing compliance efforts.
- PCI DSS v4.0 dashboard (satisfies PCI DSS v4.0 requirements 6.4.3 and 11.6.1) — Gain compliance insights with one click. A comprehensive dashboard addresses each component of requirements 6.4.3 and 11.6.1 directly within the product. Security teams can ensure script authorization and behavioral integrity, protect against payment page tampering, and keep up-to-date with script inventory management with a single view to ease the auditing process.
- Dedicated PCI alerts (satisfies PCI DSS v4.0 requirements 6.4.3 and 11.6.1) — Receive immediate and actionable alerts on PCI-related events for real-time mitigation. This includes notification of any data exfiltration, unauthorized scripts, tampering of protection for configured payment pages, and unauthorized HTTP header modifications. Alerts are summarized in the PCI DSS v4.0 dashboard and logged for auditing evidence.
Client-Side Protection & Compliance is a CDN-agnostic product with flexible deployment options. The solution is a part of Akamai’s industry-leading web application security portfolio and works well with Akamai App & API Protector. Businesses can bundle these products to gain comprehensive protection against both server-side and client-side threats, as well as to meet additional PCI DSS v4.0 requirements.
“With the deadline for PCI DSS v4.0 compliance fast approaching, Akamai Client-Side Protection & Compliance helps simplify the complex compliance process, and grants businesses the peace of mind that end-user payment card data is protected,” said Rupesh Chokshi, Senior Vice President and General Manager of Akamai’s Application Security Group. “These new capabilities are designed to streamline compliance workflows and help our customers easily manage JavaScript executing on their website’s payment pages. It safeguards end-user payment card data within the browser and provides security teams with control over the entire client-side attack surface.”
Businesses across all industries that accept payments online have to prepare to meet the upcoming PCI DSS V4.0 deadline. Forrester’s The State Of Application Security, 2023 report (available to Forrester subscribers or for purchase) highlighted client-side protection as a key technology that financial services and insurance organizations plan to adopt this year. The report states, “The PCI Security Standards Council added requirements for client-side security — so it’s not surprising to see financial services firms rushing to adopt client-side code protections to comply with PCI DSS and protect against the likes of Magecart, formjacking, and cryptojacking attacks.”
To learn more about Akamai Client-Side Protection & Compliance, and other products and capabilities that empower customers to provide consistent online experiences, please visit akamai.com/products.
About Akamai
Akamai powers and protects life online. Leading companies worldwide choose Akamai to build, deliver, and secure their digital experiences — helping billions of people live, work, and play every day. Akamai Connected Cloud, a massively distributed edge and cloud platform, puts apps and experiences closer to users and keeps threats farther away. Learn more about Akamai’s security, compute, and delivery solutions at akamai.com and akamai.com/blog, or follow Akamai Technologies on Twitter and LinkedIn.
Contacts
Jim Lubinskas
Akamai Media Relations
703.907.9103
[email protected]
SOURCE Akamai Technologies, Inc.
