In today’s evolving threat environment, safeguarding your attack surface extends well beyond your own web apps and APIs. Comprehensive web app and API protection now needs to encompass every environment you and your users interact with.
Gone are the days of only protecting the server-side of your environment. Now, it’s critical to implement client-side protection controls that eliminate reflected and inline cross-site scripting (XSS) attacks.
With Fortra Managed WAF, you’re protected where you’re interacting with your customers, practically eliminating XSS.
Client-side Protection Controls
- Eliminates both reflected and inline (stored) cross-site scripting (XSS) attacks. Since inline attacks are where most XSS attacks occur, Fortra Managed WAF drastically reduces this risk.
- Identifies all inline, first- and third-party scripts, giving app owners a clear understanding of their attack surface scope, including authorization and enforcement controls.
- Leverages modern browser security features to either alert or automatically block unauthorized or modified scripts from executing. This feature gives organizations comprehensive control of their web supply chain attack surface.
- Addresses a critical gap found in other industry WAFs by comprehensively enforcing inline script integrity, a vital delivery mechanism utilized by most websites.
- Runs only approved and untampered scripts; unapproved, modified or malicious scripts will not run.
- Meets WAF requirements in compliance standards, including PCI DSS 4.0, to protect users’ payment information from data-stealing, in-browser attacks.
- Utilizes page script protection to support both inline and external scripts. Unlike many other solutions on the market, there is no need to rewrite an application to convert all inline scripts to external scripts.
- Includes client-side protection as an integrated feature. Most other solutions charge extra and provide client-side protection as an external module.
- Fully managed service to assist with tuning of Content Security Policies and JavaScript inventories. Client-side webpage content management is now mandatory. Without fully managed service, a PCI merchant is one staff turnover away from non-compliance.
- Provides managed services from Fortra itself (not a third-party partner). Our managed services team works hand-in-hand with the development team to deliver best-in-class solutions to our customers.
Meeting New WAF Requirements in PCI DSS 4.0
With the new PCI requirements, the intent is to reduce the attack surface as much as possible. There are two aspects to the client-side protection:
- For page scripts (JavaScript), PCI Requirement 6.4.3 requires the PCI merchant to explicitly authorize scripts to execute on a client browser, as well as assure the integrity of all scripts and maintain an inventory of scripts. With Fortra Managed WAF, you’ll have a web application firewall that meets all of the aforementioned PCI requirements, effectively eliminating both reflected and inline cross-site scripting attacks.
- PCI Requirement 11.6.1 mandates that PCI merchants maintain a temper-detection mechanism for the content of payment pages. Fortra Managed WAF not only monitors content for changes and tempering, but it can also actively stops tampered, unknown, or unauthorized scripts from running. This goes beyond the new PCI Requirement 11.6.1 and outperforms other WAF solutions that just alert you to content changes.
By blocking malicious scripts and content aimed at stealing payment card data and web skimming attacks like Magecart, Fortra Managed WAF provides stronger security and automatic compliance.
How Fortra Managed WAF Meets & Exceeds PCI DSS 4.0 Requirements
PCI Requirement |
Minimum Requirement |
Fortra Managed WAF |
6.4.1, 6.4.2 |
|
|
6.4.3 |
|
|
11.6.1 |
A change and tamper detection mechanism is deployed to:
|
|
What is a Magecart attack?
In simplest terms, it is a class of web skimmer attacks that led to historic breaches at British Airways (BA), Ticketmaster, Newegg, and many other merchants. Threat actors compromised online merchants’ websites and installed software skimmers. When users accessed these platforms via their browsers and mobile apps, they unwittingly execute the software skimmer code and forward their credit card information to threat actors’ drop servers. In BA’s case, more than 500,000 customers users ’ credit and debit card details were stolen. BA was fined $229 million for security weakness as identified under GDPR.
A WAF with client-side protection would have detected the script changes and prevented the browser from executing the compromised script, effectively stopping the attack before it happens.
Ready to advance your web app and API security with Fortra Managed WAF?
Additional Resources
Blog
Client-Side Risks Under PCI DSS 4.0: What You Need to Know
Blog
PCI DSS 4.0: Understanding the Expanded Role of Web Application Firewalls
Press Release