Compliance

If your organization stores, processes or transmits cardholder data, your organization must comply with the Payment Card Industry Data Security Standard (PCI-DSS). Non-compliance may result in fines and having your merchant account blocked. There are varying levels of compliance, depending on what type of provider you are and how you interact with cardholder data. If you’re reading this, you’re probably looking for SAQ A-EP or SAQ D compliance (Merchant or Service Provider).

The PCI-DSS stipulates that vendors of public-facing web applications regularly address new threats and vulnerabilities to protect them from known attacks. Two methods are suggested: using manual or automated web application vulnerability scanning tools or methods at least annually and after any changes in the application, or installing an automated solution that assesses all targets. The goal is to detect security gaps and prevent web-based attacks against all public-facing web applications. Please note that Requirement 6.6 is not achieved using an Approved Scanning Vendor (ASV) as defined in Requirement 11.2. This is a different type of scanner with a different purpose (and so are requirements 6.6 and 11.2).

Probely provides an easy and effective way to comply with PCI-DSS, by automating and integrating scanning into your development processes and CI/CD pipelines. Scan reports include a PCI section with all requirements listed below and whether the target has failed or succeeded. Alternatively, you can produce a PCI-DSS Compliance Report.

If you collect, process, store, analyze or share personal data of European Union (EU) citizens or clients, your organization must comply with the Generation Data Protection Regulation (GDPR). What needs to be done depends on how the data is processed and your existing security measures. For web application and API vendors, it entails deploying safer code, frequent security audits and regular security testing. Non-compliance can result in heavy fines and other penalties.

Specifically, GDPR Article 32 calls for:

a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

Probely helps you deploy safer web applications and APIs and run continuous, automated security tests. Testing is accompanied by vulnerability scanning reports, which showcase your security to auditors, help you mitigate vulnerabilities, and encourage an ongoing security dialog in your company.

If your organization is planning to comply with ISO27001, you must write an Information Security Management System (ISMS). ISO27001 provides the standard for the specification for an ISMS. It should be concerned with the risk management of people, processes and technology. In terms of information security, it should demonstrate how you defend against external attacks, as well as internal threats such as human error that can lead to accidental breaches. There are three key aspects to an ISMS: confidentiality, integrity, availability. ISO27001 also helps you work toward compliance with GDPR and the Network and Information Systems Regulations (NIS).

Annex A 12.6.1 encourages organizations to ensure they develop a “robust system capable of preventing breaches”.

Probely enables you to perform web application and API vulnerability assessments, to identify vulnerabilities and get guidance on how to fix them. Probely also includes a vulnerability management capability, meaning you can assign, re-test, accept risks and check the history of each vulnerability. You can either schedule a periodic scan or integrate Probely with your CI/CD tools using our API, in order to include it into your SDLC.

Once you find the vulnerabilities, you can minimize the risk and prevent their potential exploitation by an attacker (control A 12.6.1 Annex 1) using Probely’s tailored guidance on how to fix them.

HIPAA security standards help organizations that deal with patient healthcare records ensure the protection and security of such records. Healthcare organizations can use Probely’s web application vulnerability scanner to execute HIPAA vulnerability scanning. By doing this, you will increase your efforts toward HIPAA compliance.

Using Probely, organizations can automate their security vulnerability scanning (a HIPAA security rule) and fix the vulnerabilities using the guidelines given by Probely, providing their clients with a more secure web app.

In short, Probely can help you, as a technical safeguard (Technical Safeguards § 164.312), with the requirements stated in the Security Rule of Title II.