Client-side web security

mood · Apr 25, 2020

Client-side web security
April 24, 2020
https://www.helpnetsecurity.com/2020/04/24/client-side-web-security/

To address attacks such as XSS, Magecart and other card skimming exploits found in modern eCommerce environments, the use of client-side web security methods is beginning to emerge as a particularly useful practice.

The best client-side security platforms automate implementation of these standards-based controls with emphasis on simplicity of administration. A typical, representative platform is used to demonstrate necessary client-side security controls.
Click to expand...

Content security policy
To understand client-side security platforms, it helps to first explore the specifics of a standard approach known as a content security policy (CSP). This is a standard that is designed to address several types of web breaches such as cross-site scripting, click-jacking and form-jacking (all described earlier in this article series). CSP is also designed to reduce the risk of client-side malware injected from an infected advertising ecosystem.
Subresource integrity
An additional applicable cyber security standard from the World Wide Web Consortium (W3C) is known as subresource integrity (SRI).
SRI is implemented through cryptographic hash functions which finger-print JavaScript being offered by third parties. Browsers can then fetch a resource, check the cryptographic hash value – which include the location of the resource, and then make a policy decision about whether to accept the resource.
Click to expand...

Client-side security platform
Client-side security platforms will make use of both CSP and SRI to provide effective client-side protections. The goal of these platform is to provide policy-based mitigation of fine-grained behavior for third-party sources where content is being served.
Information model
Client-side security platforms should implement some type of information model that can be used to analyze the different behaviors on pages from the customer’s website to be protected.

The resultant behavioral information model will thus provide a functional baseline on which to perform the necessary client-side risk management. The goal obviously should be to determine in real-time whether the site is vulnerable to attacks, third-party insertion, or other advanced breaches.
Click to expand...

mood · Aug 25, 2021

6 Client-Side Security Concerns Enterprises Should Care About
August 23, 2021
https://www.darkreading.com/edge-ar...h-if-and-how-to-consider-client-side-security

To client-side or not to client-side? That is the question. As enterprises combat fraud, they have to consider whether they should concern themselves with the state of their end-customers' devices. Should the security state of an end-customer’s device affect their experience with an online application? Should the application allow or deny access to specific resources and transactions based on the security of that device?

Client-side attacks have been around for a number of years. Magecart, which made big news in 2018 and 2019 with several high-profile breaches, is perhaps the most notable in recent years. How to handle client-side security is a question each enterprise needs to answer for itself.
Click to expand...

The debate around whether enterprises should take into account the environment on their end-customer devices is not new, but there's a shift in recent years suggesting that defenders should incorporate data from the client side into risk-based decision-making. By educating themselves and developing a client-side strategy, enterprises can better plan for and make decisions around client-side defense.
Click to expand...

Log in or Sign up

Client-side web security

mood Updates Team

mood Updates Team