Source Defense Expands Client-Side Security and Data Privacy Solutions with Release of Platform Version 3.0
Solution provides millions of merchants with the ability to easily go above and beyond complex new requirements for website security and monitoring designed to combat data theft and leakage. PCI Qualified Security Assessors (PCI QSAs) and security assessors also now have a free solution for proactively assessing gaps in compliance for their clientele.
Connecticut, U.S. / Rosh-Ha’ayin, Israel / Grapevine, Texas – June 6th, 2023 – Source Defense, the pioneer and market leader in web application client-side protection and data privacy compliance, today announced the immediate availability of a free solution to address strict new requirements for website security and monitoring found in version 4.0 of the Payment Card Industry Data Security Standard (PCI DSS 4.0). Unveiled during the National Retail Federation (NRF) Protect event, this new platform gives merchants of all sizes, and across industries, the ability to assess, continually monitor and demonstrate compliance with sections 6.4.3 and 11.6.1 within PCI DSS 4.0. As well as direct requirement coverage, the platform offers assessors additional intelligence 3 and support for their PCI DSS assessment lifecycle, including enrichment to vulnerability and gap analysis, integrity analysis, penetration testing, and security risk assessment. Registration for the platform is available here.
Specifically, merchants and assessors using this free Source Defense platform will be able to:
- Inventory – provide an inventory of every script running on their payment pages, including a method for monitoring for and tracking any additions (required under PCI DSS 4.0 – 6.4.3)
- Justification – provide a mechanism for seeking, documenting and managing justification of any scripts on payment pages (required under PCI DSS 4.0 – 6.4.3)
- Integrity monitoring – address the stringent requirement for weekly integrity monitoring of HTTPS
headers and scripts found on payment pages (required under PCI DSS 4.0 – 6.4.3)
- Alerting and blocking – alert to suspicious and malicious activity found within scripts on payment pages, feed alerts to security teams for blocking. (required under PCI DSS 4.0 – 11.6.1) Automatic blocking of malicious behavior is also possible in broader Source Defense deployments.
- Reporting and Enrichment – feed findings with one-click reporting to other elements of the PCI
assessment lifecycle such as vulnerability analysis, integrity analysis, penetration testing and security risk assessments
In a “best-case” scenario, this shadow code introduces the potential for data privacy compliance violations due to unauthorized capture and sharing of data. In the worst-case scenario, it effectively acts as the soft-belly for adversaries on any modern web site. Source Defense prevents more than 9 billion policy and security violations per year for its clients alone. Extrapolating that data to the millions of websites that remain unprotected around the world, the risk is both ubiquitous and staggering in nature.
“We exist to put an end to the theft and leakage of sensitive data from modern websites,” said Ross Hogan, Chief Executive Officer at Source Defense. “Our mission could not be more important at current, as this problem is ubiquitous across the world. We have a commercial solution to the problem which is simple, effective and places virtually no additional burden on already burdened Security teams. It only seems right that we make a free version of this solution available to help organizations not only comply with PCI DSS 4.0 – but get on a path to stopping data theft and leakage outright.”
This free PCI DSS 4.0 compliance solution can be found at the Source Defense website by following this hyperlink