Find the hidden scripts stealing customer info while fulfilling PCI DSS requirements 6.4.3 and 11.6.1
With digital credit card skimming (e.g. Magecart) becoming the fastest-growing cyber attack against ecommerce websites, Shopping Cart Monitor helps you monitor for and detect malicious javascript to keep your customer data safe.
It works by monitoring every website script that appears during the checkout process and flagging any that are suspicious or malicious. Hackers can’t see it or tamper with it, and there is no download, software, or dev work required to get started.
Best of all, Shopping Cart Monitor meets key PCI requirements 6.4.3 and 11.6.1.
Shopping Cart Monitor features
No downloads, no installation, no configuration–it just works
Purpose-built by security professionals
Your ecommerce site is the heart of your business. We offer patented protection designed by professional penetration testers and forensic investigators with ecommerce business owners in mind.
Shopping Cart Monitor works by:
- Creating a snapshot of what your checkout process looks like
- Flagging any abnormal or suspicious scripts that appear during checkout
- Reporting them directly to you for review
- Minimizing false positives
- Causing zero disruptions to your business
Major PCI requirements completed in an instant
PCI requirements 6.4.3 and 11.6.1 require detailed management and monitoring. Shopping Cart Monitor achieves them both.
By inventorying all javascript on your ecommerce site, our tool meets requirement 6.4.3, and by acting as a tamper-detection mechanism that finds bad scripts, it also meets 11.6.1.
When you use Shopping Cart Monitor, you’re not just safeguarding your site, you’re getting one step closer to completing your PCI compliance.
No dev team required, just your URL
Shopping Cart Monitor is a cloud-based, code-free tool, meaning:
- No downloads
- No software installation
- No software integration
- No website configurations
Our agentless solution doesn’t involve your web development team, which a code-based solution would. And since you're not installing an agent, it can't be tampered with or subverted, greatly improving your security.
How does Shopping Cart Monitor protect your payment pages?
01
Run a simulation of the checkout process
Shopping Cart Monitor simulates the checkout process and the behaviors involved on the page.
02
Inventory Javascript (PCI Req. 6.4.3)
Any javascript on the page is inventoried and documented in order to meet PCI requirement 6.4.3. Both static and dynamically generated javascripts are analyzed and inventoried. Users have the ability to justify any and all scripts on their site to fully comply with requirement 6.4.3.
03
Look for modifications (PCI Req. 11.6.1)
Shopping Cart Monitor runs at regular intervals looking for payment page modifications, meeting PCI 11.6.1 which requires having a change and tamper-detection mechanism in place.
Need to fulfill PCI Req. 6.4.3 and 11.6.1?
Request A QuotePackages
Basic
- Portal access
- 1 payment path supported
- User-initiated scanning process
- Fulfills req’s. 6.4.3 & 11.6.1
- Add-on consultation credits available
- Partner discounts available
Plus
- Portal access
- 1 payment path supported (option to add on)
- Automated scanning process
- Fulfills req's. 6.4.3 & 11.6.1
- Add-on consultation credits available
- Partner discounts available
Pro
- Portal access
- 3 payment paths supported (option to add on)
- Automated scanning process
- Fulfills req's. 6.4.3 & 11.6.1
- Forensic annual baseline assessment
- 12 annual consultation credits included
- Partner discounts available
See how we've helped our clients succeed
When you succeed, we succeed. That's why we pay such close attention to detail and provide award-winning support. Let's work together!
Ecommerce Security FAQs
What is a payment page?
A web-based user interface containing one or more form elements intended to capture account data from a consumer or submit captured account data.
Payment pages take many forms:
- A web page contained within an application that collects and processes card data
- A web page that redirects to a 3rd party payment page hosted on their domain
- A web page that displays a 3rd party payment page within an inline element(s) like an iFrame
What is PCI DSS Requirement 6.4.3?
To reduce the possibility of malicious scripts making it onto payment pages, organizations need an inventory of all the known good scripts used on payment pages.
This inventory must be documented and tracked to ensure that all the scripts used are authorized, and that the integrity has been validated.
What is PCI DSS Requirement 11.6.1?
This requirement includes implementing a change and tamper-detection mechanism for any payment or referring pages (a referring page is one that uses an iFrame to display a 3rd party payment page). This requirement is a direct result of the increase in ecommerce skimming compromises seen on payment/referring pages in recent years.
A change and tamper-detection mechanism is deployed as follows:
- To alert personnel to unauthorized modification (including indicators of compromise, changes, additions, and deletions) to the HTTP headers and the contents of payment pages as received by the consumer browser.
- The mechanism is configured to evaluate the received HTTP header and payment page.
- The mechanism functions are performed as follows:
- At least once every seven days
OR - Periodically (at the frequency defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1).
- At least once every seven days
Resources
The following are related resources that we have prepared for you. Find more answers to your questions in our Learning Center.
.svg)