The PCI DSS rules have evolved, and now they're targeting the scripts on your checkout pages. This is a critical issue, as these scripts can be compromised to steal sensitive payment data. The problem is exacerbated by the fact that a single compromised script can affect the entire checkout process, as seen in the Magecart attacks that have affected over 100,000 websites. The British Airways breach, for instance, exposed 380,000 transactions and resulted in a hefty fine. The new requirements, 6.4.3 and 11.6.1, mandate that every payment-page script is inventoried, authorized, and its integrity proven. This is a challenging task, given that payment-page scripts are constantly changing, with Reflectiz data showing that around 30% of scripts change within a two-week period. This is where Reflectiz comes in. It's a PCI DSS platform that has been assessed by Integrity360 Europe, a PCI Qualified Security Assessor. Reflectiz's unique approach focuses on behavior monitoring, not just file hashes, which means it can detect silent vendor-side swaps that might otherwise go unnoticed. It also deploys agentlessly, requiring no code changes or snippets, and can be implemented in just a few days. This makes it adaptable to various refactoring and CMS migrations. One of the most significant advantages of Reflectiz is its ability to produce QSA-ready evidence in a single click, providing a full audit trail per page, which is essential for compliance assessments. However, it's important to note that these new requirements can still be challenging to meet. Merchants can only drop 6.4.3 and 11.6.1 from SAQ A if they can confirm that their site is not susceptible to script attacks. This means that even with full redirects to the processor or embedded payment iframes, merchants must still prove that their checkout process is secure. The PCI SSC FAQ #1588 highlights the importance of these controls, emphasizing the need for comprehensive monitoring and protection against script-based attacks. In conclusion, the evolution of PCI DSS requirements to address script-based attacks on checkout pages is a significant development in payment security. Reflectiz's innovative approach provides a viable solution, but merchants must remain vigilant and ensure that their checkout processes are robustly protected against potential vulnerabilities.
