Client-side web security

mood · Apr 25, 2020

Client-side web security
April 24, 2020
https://www.helpnetsecurity.com/2020/04/24/client-side-web-security/

To address attacks such as XSS, Magecart and other card skimming exploits found in modern eCommerce environments, the use of client-side web security methods is beginning to emerge as a particularly useful practice.

The best client-side security platforms automate implementation of these standards-based controls with emphasis on simplicity of administration. A typical, representative platform is used to demonstrate necessary client-side security controls.
Click to expand...

Content security policy
To understand client-side security platforms, it helps to first explore the specifics of a standard approach known as a content security policy (CSP). This is a standard that is designed to address several types of web breaches such as cross-site scripting, click-jacking and form-jacking (all described earlier in this article series). CSP is also designed to reduce the risk of client-side malware injected from an infected advertising ecosystem.
Subresource integrity
An additional applicable cyber security standard from the World Wide Web Consortium (W3C) is known as subresource integrity (SRI).
SRI is implemented through cryptographic hash functions which finger-print JavaScript being offered by third parties. Browsers can then fetch a resource, check the cryptographic hash value – which include the location of the resource, and then make a policy decision about whether to accept the resource.
Click to expand...

Client-side security platform
Client-side security platforms will make use of both CSP and SRI to provide effective client-side protections. The goal of these platform is to provide policy-based mitigation of fine-grained behavior for third-party sources where content is being served.
Information model
Client-side security platforms should implement some type of information model that can be used to analyze the different behaviors on pages from the customer’s website to be protected.

The resultant behavioral information model will thus provide a functional baseline on which to perform the necessary client-side risk management. The goal obviously should be to determine in real-time whether the site is vulnerable to attacks, third-party insertion, or other advanced breaches.
Click to expand...

Log in or Sign up

Client-side web security

mood Updates Team

LadderLeak: Side-channel security flaws exploited to break ECDSA cryptography

Data leak, phishing security flaws disclosed in Oracle iPlanet Web Server

Brazilian security firm leaks more than 25 GB of client and staff data

SSRF 101: How Server-Side Request Forgery Sneaks Past Your Web Apps

Nedbank warns clients after data breach – 1.7 million clients potentially affected

Log in or Sign up

Client-side web security

mood Updates Team

LadderLeak: Side-channel security flaws exploited to break ECDSA cryptography

Data leak, phishing security flaws disclosed in Oracle iPlanet Web Server

Brazilian security firm leaks more than 25 GB of client and staff data

SSRF 101: How Server-Side Request Forgery Sneaks Past Your Web Apps

Nedbank warns clients after data breach – 1.7 million clients potentially affected

Useful Searches