Name: The PCI DSS 4 Compliance Journey Simplified with AWS and HUMAN
Uploaded: 2025-03-13T18:00:06.728Z
Duration: 1 h
Description: The PCI DSS 4 Compliance Journey Simplified with AWS and HUMAN

Transcript for "The PCI DSS 4 Compliance Journey Simplified with AWS and HUMAN": Hello everyone. Thank you for joining us today for the PCI DSS four compliance journey simplified with AWS and human. We're thrilled to have you here today as we dive into the session packed with valuable insights that will empower you to buy smarter and defend better. Today, you'll hear from our speakers, Mark McKeown from Amazon and Cameron Nagdi from human, who provide you with guidance and answer your questions about simplifying compliance with PCI DSS four. Before we get started, a couple of quick housekeeping notes. The webinar is being recorded. You can share it afterwards. You can see it live on LinkedIn or here. Feel free to type in your questions in the q a panel. We'll address them during the sessions or take dedicate at the end with our q and a. And there are some docs for you to take a look at. If you click on the docs tab in your upper right, you can see some information we'd like to share with you. Now let's see how we can make your compliance journey easier, starting with our speaker from Heumann, Cameron Nagdi. Thanks, Robert. So my name is Cameron Nagdi. I'm a senior director of solutions engineering here at Heumann. And I figured first, it would be best to start with a short review of the new PCI DSS four dot o dot one requirements. Within PCI, there are two new technical requirements, section six dot four dot three and eleven dot six dot one. Section six dot four dot three focuses around script management. The requirement is really trying to ensure that organizations can confirm scripts are authorized. They can ensure the integrity of those scripts, and they can also maintain an inventory with written justification of all scripts and changes to those scripts that are running on payment pages. Likewise, 11 dot six dot one is a change in tamper detection rule focused around HTTP headers. Again, you must show an audit of any and all changes that are occurring on payment pages for security headers. How did we get to these new requirements, though? PCI has been around for a while as a standard. But back in, March 31, 2024, PCI DSS three dot two dot one was retired. And in June twelfth of twenty twenty four, the four dot o dot one standard of PCI's DSS was released. The important thing to note is that, the new requirements for, six dot four dot three and eleven dot six dot one are gonna be going into effect 03/31/2025. So a little over two weeks away, and those, new requirements will now be, effective. Now that's gonna be, great for folks that fall under, you know, level one, level two PCI audits. But what about, folks who fall under, what's known as a SAQ or self assessment questionnaire? Well, PCI has released updated guidance around this, and they have actually said that, hey. While, the 11 dot six dot one and six dot four dot three requirements are great for the the higher level vendors, folks that are under scope of an SAQ, maybe don't have to adhere to that, but they still have to show that their website's payment pages are, in some ways, tamper proofed and audited on a regular basis. So, effectively, what they've gone and said is that the audit requirement is relaxed. However, the control is still in place for, all merchants out there and and all folks taking credit cards. Now with that little bit of history, I'm gonna turn it over to Mark to discuss, some of the benefits here of pairing this technology with AWS. Mark? Thanks, Cameron. Hi, everybody. My name is Mark McKeown. I'm a senior GTM specialist at at AWS. My focus area is around our edge services, which include, content acceleration service, which is Amazon CloudFront, and our application security services, which include AWS WAF and AWS Shield. AWS has a global edge network that is a redundant 400 gigabit, Ethernet network that has a private capacity between AWS regions and availability zones globally as you can see on the map. That includes 600 plus pops in 50 countries that spans over a hundred cities around the world. We have, direct peering with major ISPs, tier one, tier two, and tier three ISPs globally as well. And in 2024, we had a 33% year over year increase in infrastructure development on this network. Next slide, please. With those services, they're primarily that we're focused on today. This is a high level architecture diagram for web applications that you may be building yourself with AWS. Primarily, we have a few services that are of importance for this discussion that are very closely related to the eleven six one and, six four three, PCI requirements that are coming up. That includes, as I said before, our content delivery network, which is Amazon CloudFront, and our perimeter protection services are for application security, which is AWS WAF and Shield. Going from the left to the right, we have AWS WAF, which is a layer seven application security service protecting the application. And then we have Amazon CloudFront with Shield Advanced, which is protecting layer three through seven at the edge of our network for those applications, and workloads that with, compute and also storage that are included in your region and availability zone. Next slide, please. With AWS from a security lens, security is a job zero, And we have two kind of views for our AWS shared responsibility model. First, we have security of the cloud, which is AWS's responsibility. That is putting the compute storage database and networking software, and then also the hardware into the regions and availability zones. From a security in the cloud, that's managed by the customers, and that includes client side data enforcement and encryption for integrity and authentication. But at the same time, we're not looking to leave our customers without, available options and and then solutions. And that's where partners like Human Security come into play, and we've done some deep integration with them to validate their solution and make sure it works for us. Next slide. With AWS, we have our compliance programs. As you can see on the top mid area, we have, PCI DSS level one. And while those services that I spoke to in the prior slides are PCI compliant and we've done those requirements, the in the cloud component that I talked about from our shared responsibilities where this comes into play, and it's very important that partner like human is available to provide you that end to end solution that they'll be talking about shortly. Next slide. And going a little quickly, but how do we actually buy this solution? That solution is available in the AWS WAF console. So some of the integration work we've done is from a security perspective to make sure the solution works and is validated, which Human will be talking about shortly. But from a purchase perspective, we made it very easy for you to buy. You can go into AWS WAF console, click add on protection, and Humion will show right up. From there, you can click and purchase through the marketplace, and it'll show up on your AWS bill. Cameron, I think, the slides now next are yours. Yep. Perfect. Thanks, Mark. So now that Mark's talking to everyone and taking you guys through exactly how to get our technology, Let's take you guys through a little bit of what human's gonna do to help ensure that your sites are meeting the requirements of PCI DSS six dot four dot three and eleven dot six dot one. First and foremost on streamlining your payment page script and header management, you know, humans going to auto discover your script inventory with, our technology. We're gonna automate the authorizations, and we're gonna enable a justification workflow so that you have that required audit trail, should you need it for an audit or a compliance workflow. We're also gonna give you tools to secure the site beyond the the requirements that PCI DSS explicitly requires. We're gonna give you, the capability to actually enforce script behavior in some cases, and I'll get more into that in a little bit and why that's, you know, a nice competitive advantage with human. And then lastly, we're gonna, be able to proactively set policies that will allow you to surgically block unwanted script activities, for example, data access of, say, credit card values without interrupting the script or the website's core functionality. So once our technology is in place, we will be able to provide dashboards and overviews of your compliance status as it relates to PCI. So we'll show you how many scripts and headers are unreviewed, how many are in progress, what is your overall compliance, status. So in this case, we're 93%. We'll then give you a script inventory as well as a header inventory, and we'll break those out by requirement name because we understand that, most companies are running a little lean on their staff. So we want to make this console as easy to understand and as easy to use as possible should you need to come in here. Now, beyond showing you a a basic inventory, we'll also show you some some information around the current authorization status of that script. What is the script's current justification, if it has any? And then we try to populate some vendor details just so that, again, when you're trying to make this decision of should I authorize this script, should I allow this script, you'll have a little bit more situational awareness to help you make that determination. Now within each individual script that we have listed, we'll also show you a full audit history as required by PCI. So we'll show you when a script is first detected, when that script is then authorized, and then as well as any, notes that you wanna put in for that authorization. We'll show you who made that, authorize authorization and who made the change. And then we'll also show you if there are any subsequent modifications to that script after it's been authorized. In this example on screen here, we show that there was a modification to the script, and now it's actually accessing data related to passwords and credit card information. So these are high risk issues that you should probably look at very quickly if you don't have automated, remediations or blocking setup. Now beyond that, as we talk about automating, script authorization or blocking, that's something that human provides, built into our solution. This is gonna allow you to keep your cost of ownership low. Now, what do I mean by that? Well, a great example would be internal only scripts that your dev teams run to to really keep your website running. So for example, we could do a rule that's as simple as if this script is a first party script, meaning we developed it internally, it's maintained internally, then we're gonna go ahead and pre authorize that script and provide a pre authorization code or note. That way, you can drive workflows through, you know, other outside systems as well as really automate the workflows, inside of our own console. On the flip side of that, we can also do proactive protection of websites, And this is something that is a a real differentiator for human when compared to other, you know, client side management solutions. What we can do is we can block a script's access to a field without turning the script off. So, what we would do there is say, if a script's action is trying to access the credit card or the card number fields, then we're going to block the access to that field. Now why is this so important? First and foremost, it stops any credit card data from leaking out to an unknown third party or an attacker. Secondly, it reduces your impact window if this is stemming from an unauthorized change. And lastly, this allows you to allow scripts that are semi risky but third party to run while still protecting the integrity of your customers and your clients' payment, solutions and their payment interfaces. Now, how does this all work? Right? I'm sure it sounds great to everyone, but, at Human, we do, provide all of this coverage with a single line of JavaScript code. It's what we refer to as a low code solution for deployment. Our script is embedded onto the web page or your payment pages that you wish to protect. When a device, like a cell phone, a laptop, a PC connects to your web page, that script is going to collect activity and signaling from that device and send that back to our cloud back end for analysis. That cloud back end is then going to surface any incidents to the human dashboard that I was showing earlier, as well as then go into any script based attacks, that would need to be mitigated based on policy. So, again, it's it's a real lightweight deployment here, low code. And even beyond our own, install, we make it very easy to integrate into your existing workflow. This is something that a lot of larger vendors out there maybe, have already developed. Maybe your larger customers have purchased solutions like PagerDuty, like Datadog, like a Splunk or a Jira. You know, with human, we don't expect you or your customers to fall completely within our workflow. We actually wanna map and adapt to the existing workflows that have been developed and invested in. So real quick recap, human works with a single line of code. It allows you to protect, detect, and ultimately comply with PCI. And don't take my word for it because I actually have a human shirt on. But trust the, the third party vendors and assessors out there that that are singing our praises. So from coal fire, you know, we've we've actually received high praise, where they've said that we flat out exceed, the intent and spirit of PCI when it relates to 6.4.3 and 11 6 One. So, what can you do now? Well, we can assess your readiness. We can get a complimentary PCI DSS compliance assessment to understand your gaps and how human and AWS can help you streamline your journey. We can also help you secure those payment pages today as that deadline is right around the corner. We can implement humans client side protection, and AWS security solutions to proactively safeguard your payment environment and maintain compliance with PCI DSS. And we can also schedule a personalized consultation. So if this sounds good, but maybe there's something just a little bit custom about your environment or, you know, a very, particular customer that you might have, feel free to connect with our experts so that we can show a live demo and really discuss compliance needs in-depth as they relate to your needs. Thank you, Mark. Jump back in here and just take a few questions from our audience. So I guess the first one for you, Mark, why doesn't AWS do this themselves? Why are you depending on third party vendors for this? Yeah. As you can see from what Cameron has shown, I mean, this is a pretty, developed solution that makes it very easy for customers to maintain PCI compliance with these new requirements that are coming up at the end of the month. We generally do not build end to end solutions like this, especially something where, we also believe that, you know, this is gonna be something that customers will need to maintain. And somebody like Human, you guys have done a really good job with this. So we're we have no plans on doing this ourselves and and are working with you, to do this here. I mean and, you know, like, I think as Cameron showed as well, what coal fired said is what, you know, our opinion has been to date as well. This meets and and exceeds, what the intent of the requirements are. Great. Thanks, Mark. Cameron, for you, a lot of our customers are security teams. How would they share this with our compliance teams? I mean, GRC teams are a totally different team inside most companies. Yeah. No. That's a great question. I I honestly think that solutions like this ultimately bring compliance and security to the same table. They help break down those silos or those barriers that tend to exist in a lot of organizations. And ultimately, what both teams end up discovering is that good compliance and hygiene is really just, on the journey or on the path to true security and being in a known, good, secure, compliant state. Okay. And I know this was mentioned earlier, but I think we already enforced it. What level do I, as a customer have to comply to these requirements? Because I it's a lot of customers outsource payment or the full site. Yeah. Great question. So if you are a level one or level two PCI, assessment, target, then that means that you are processing north of 1,000,000 transactions per year. If you are under that 1,000,000 threshold, then traditionally, you will fall under what's called an SAQ or that self assessment questionnaire. Depending on how your payment technology is set up will determine if you fall under SAQ a, d, a e. It's all gonna depend on on what you've got running under the hood. Great. That's all the questions I have. Cameron or Mark, any final thoughts? Just wanna thank AWS for taking the time to do this with us today. Yeah. And thanks for having me. I think right here you have the contact information for human. I think Amanda is the contact to reach out to. Like I said as well, if you are interested in purchasing already, you can either go to the AWS WAF console and log in and do that or to the AWS marketplace and just type in human security. The solution is there as well. I think there's a lot of content on that as to learn, on your own as to. Yeah. Like Mark said, the AWS marketplace, great place to find more about human, humansecurity.com. We do work with many vendors like AWS to make sure that we have a solution that works for you. So final thoughts, thank you so much for joining us, Mark. Really appreciate the support AWS has provided us for this journey as we're getting close to the deadline. But I know a lot of our customers will go through their audit and discover they have more things to do, and that's why we're here to support you. We hope you found the insights useful. We hope what you had, what Cameron and Mark provided helped you on your journey for full compliance. Before you go, don't forget, we'll send you a follow-up email after this and you can share this video, this session with your partners in your GRC team, in your security team to help, compliance, unfortunately, it's an ongoing journey. It's not a one and done. It's always moving forward. Check out our website for more information. Go to the AWS Marketplace for information about human and our PCI DSS solution. And thank you for again for your time. We really appreciate joining us today, and we look forward to seeing you at a future human event. Thank you, and make it a great day.