Meet PCI Requirements Consistently and Efficiently

Situated in front of public-facing web applications to detect and prevent web-based attacks

The seemingly simple requirement to sit in front of applications has gotten considerably more complicated in recent years. Applications may be hosted in public, private, or hybrid cloud environments. Application functionality may be accessed via APIs and/or deployed as microservices within pods. This has made it increasingly difficult for organizations to protect all of their applications and the many paths to them.

ThreatX provides a cloud and API native approach to application security that easily covers all of an organization’s applications. Protection can be extended to both traditional and cloud applications and sensors can be built into Kubernetes pods to ensure that protection can be extended anywhere that contains cardholder data. Unlike traditional WAFs, native API support means that ThreatX decodes JSON and WebSockets to provide the same level of protection for APIs that are delivered to the web front end. This ensures that PCI compliance is extended uniformly across all applications and their many components.

Actively running and up to date as applicable

The need to constantly update and tune signatures and rules has long been one of the most time-consuming challenges of maintaining a WAF.

ThreatX provides a behavioral approach to threat detection that learns both application and attacker behaviors automatically, vastly reducing the need to customize and tune rules. Additionally, ThreatX includes access to ThreatX SOC services as part of the solution, allowing organizations to offload any additional technical work to highly trained experts. This combination of functionality and services means that organizations can easily ensure that their protections are up to date as required by PCI.

Generating audit logs is a relatively straightforward requirement, and ThreatX naturally generates logs of all important events. This information can be integrated into SIEM tools or used to generate reports to assist with the documentation of compliance efforts. 

ThreatX’s risk-based approach to security automatically aggregates many individual events and logs into an up-to-the-minute view of risk to the organization. This allows the system to generate events and logs that are pre-correlated and include important security context of an event.

ThreatX offers PCI compliance reporting out-of-the-box. Customers get a reporting solution that clearly highlights the key requirements for PCI, eliminating the need to augment the data from a log emitter or integration point.

Configured to either block web-based attacks or generate an alert that is immediately investigated

Traditional WAFs have often struggled with the problem of false positives, which has made organizations less likely to use automated blocking rules. As a result, many alerts often required manual investigation, which in turn could overwhelm SOC and IR staff.

ThreatX makes blocking decisions significantly more accurate and reliable by bringing together multiple detection strategies into a single risk-based context. This includes application and attacker behavior profiling, active interrogation and deception techniques, and shared intelligence gained across all ThreatX customers. All of these aspects are integrated into an overall risk score that can be used to make highly reliable automated blocking (and unblocking) decisions. Likewise, alerts include all the relevant context for an event, and integration with SOAR tools can automate a wide variety of responses based on policy. This ensures that organizations can ensure the CDE remains protected instead of simply documenting attacks.