Requirement 11

What is Requirement 11?

Requirement 11 is “Test Security of Systems and Networks Regularly”. This is divided into 6 sub-requirements:

11.1 Processes and mechanisms for regularly testing the security of systems and networks are defined and understood.
11.2 Wireless access points are identified and monitored, and unauthorized wireless access points are addressed.
11.3 External and internal vulnerabilities are regularly identified, prioritized, and addressed.
11.4 External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected.
11.5 Network intrusions and unexpected file changes are detected and responded to.
11.6 Unauthorized changes on payment pages are detected and responded to.

What has changed?

Part of the changes to these requirements in PCI DSS 4.0 involves e-commerce skimming attacks. The new standard has adapted in reaction to the rise of form-skimming ‘magecart’ attacks.

This is covered in the new requirement 11.6, which asks that “unauthorized changes on payment pages are detected and responded to”. Much like requirement 6.4, this involves another way of identifying malicious scripts on your webpage.

Official Guidance

The guidance for this requirement is as follows:

11.6.1 A change- and tamper-detection mechanism is deployed as follows:

To alert personnel to unauthorized modification (including indicators of compromise, changes, additions, and deletions) to the HTTP headers and the contents of payment pages as received by the consumer browser.
The mechanism is configured to evaluate the received HTTP header and payment page.
The mechanism functions are performed as follows: – At least once every seven days OR – Periodically (at the frequency defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1).

“Many web pages now rely on assembling objects, including active content (primarily JavaScript), from multiple internet locations. Additionally, the content of many web pages is defined using content management and tag management systems that may not be possible to monitor using traditional change detection mechanisms. Therefore, the only place to detect changes or indicators of malicious activity is in the consumer browser as the page is constructed and all JavaScript interpreted.”

To summarise this in more simple terms:

Many web pages assemble resources (such as third-party JavaScript) from multiple locations on the internet.
Content management (CMS such as WordPress) and tag management systems (such as Google Tag Manager) mean it is hard to detect changes in content using traditional methods.
The best place to detect changes is in a user’s browser. You can spot malicious activity as the web page is constructed and JavaScript is interpreted in the browser.

Essentially, in response to a rise in e-commerce form-skimming attacks, the updated PCI DSS aims to introduce security measures that protect payment pages from malicious activity.

The standard also provides guidance on how to fulfil this requirement. For example, The PCI Council suggests that “External monitoring by systems that request and analyze the received web pages (also known as synthetic user monitoring) can detect changes to JavaScript in payment pages and alert personnel”.

As RapidSpike is a synthetic user monitoring tool, you can use this to protect your payment pages. The best way is through setting up Attack Detection within your account.

Key Takeaways

Requirement 11 is concerned with the security of your systems: including payment pages
You are required to monitor any unauthorised changes to your web pages; these might indicate customer data being stolen
The best way to monitor payment pages is in a user browser, using tools such as RapidSpike

Read on to learn about how to use RapidSpike to fulfil this requirement.

PCI DSS Basics

Requirement 11

What is Requirement 11?

What has changed?

Official Guidance

Key Takeaways

Leave a Reply Cancel reply