Scribd
Upload
43 views2 pages

Website Security Solutions Checklist Ensighten 3

The document discusses common website security threats like JavaScript injections, cross-site scripting, formjacking, and third-party vulnerabilities. It provides a checklist for securing websites which includes monitoring for threats, auditing privacy, blocking unauthorized access, and enforcing compliance with data privacy laws.

Uploaded by

Eqbal Gubran
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
43 views2 pages

Website Security Solutions Checklist Ensighten 3

The document discusses common website security threats like JavaScript injections, cross-site scripting, formjacking, and third-party vulnerabilities. It provides a checklist for securing websites which includes monitoring for threats, auditing privacy, blocking unauthorized access, and enforcing compliance with data privacy laws.

Uploaded by

Eqbal Gubran
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Ensighten MarSec TM

Website Security:
Threats and
Solution Checklist

There are several ways in which cybercriminals commonly Third-party vulnerabilities


target company websites to steal customers’ sensitive A website’s ecosystem can include dozens of
and financial data. There is still a huge blind spot among third-party technologies that improve the user
organizations when it comes to website security, with experience, increase functionality on the website
many businesses directing their cybersecurity spending or help marketers collect meaningful customer
towards protecting internal networks, systems and insights; the average retail website now uses
servers – leaving their website unsecured and vulnerable between 40-60 third parties. Unfortunately,
to attack. This is incredibly risky as no organization can these third-party vendors also provide a ‘back
afford the huge cost and long-term damage of a data door’ to your website, which cybercriminals are
breach. Here are a few examples of how a breach of your increasingly utilizing to gain access to your
website can cause long-term damage to your organization: customers’ sensitive payment data.

JavaScript (JS) injections Formjacking


Around 95 percent of websites are built using Digital Payment Card Skimming (DPCS) or
JavaScript (JS), which makes them vulnerable formjacking attacks now account for most web
to attack. Cybercriminals will take advantage of breaches (71 percent of all web-related data
vulnerabilities in a website’s JavaScript code breaches in 2018). These attacks involve
to gain access to confidential customer data injecting malicious JavaScript code to steal
or interrupt the user’s browsing session. JS credit card details and other information
injection attacks occur when an attacker adds from the payment forms on checkout pages of
or injects their own malicious code into an ecommerce websites. Because PCI compliance
existing authorized application. It is estimated prevents customers from storing their
that half of web applications have access three-digit credit card security number on
control issues and a third are susceptible a website’s servers, hackers are turning their
to code injection. attention to the client-facing side of the website
to steal the information as it is entered.

Cross-site scripting (XSS) Magecart


Cross-site scripting (XSS) is a method of One group of cybercriminals is responsible for
JavaScript injection, which can add to or change the spike in formjacking attacks: Magecart.
the appearance of website content, steal session Magecart is behind over 350,000 website data
cookies or redirect users to another website. breaches in 2018 alone, including attacks on
An iframe phishing technique was recently high-profile victims Ticketmaster, Newegg,
discovered whereby malicious code was injected Kitronik and VisionDirect. The threat to
into every page of a website and asked customers ecommerce sites is so prevalent today that the
to enter their payment data. This method differs FBI has issued a warning, urging organizations
from traditional JS injection attacks because it to “take note of this new breed of cyberattack
displays a credit card phishing form page and and put security measures in place to protect
redirects users to a payment service provider. end-users.”
Tag piggybacking Ad injections and adware
Tag piggybacking can occur when one marketing Almost seven out of ten shoppers will abandon
tag triggers another, leading to dozens or even their shopping cart before completing a
hundreds of additional tags being launched purchase. One of the main reasons for this is
without your knowledge – from here, these tags unauthorized ad injections, where shoppers
can access sensitive customer data, causing data are targeted by competitive and/or malicious
security and privacy issues, as well as impacting ads. These ads can impact online customer
website performance. experience and cost you valuable sales.

“Executives are on alert and “deeply concerned” over recent


headlines about high-profile breaches and the security of the
customer data on their website – with 83 percent anticipating
a potential data breach. Still, 65 percent of organizations do
not yet have proper data security policies in place.”
2019 website security research for Ensighten,
conducted by EMI Research Solutions

Website security checklist


One of the biggest challenges when it comes to securing Allow and block third-party technologies: Define or
your website is a lack of visibility into the types of threats remove permissions for approved third-party vendors,
your organization is facing today. You need a universal to block unauthorized data collection and advertising
solution that can protect your website against malicious
JavaScript injection, unauthorized data collection, Privacy gateways: Block unknown and unwanted
third-party vulnerabilities and prevent ad injection. website trackers, technologies and tags from firing
This should include: on site and collecting sensitive customer data

Real-time website monitoring: Monitoring of all Blocking of unauthorized network calls: Block
network requests coming into or out of the website Magecart style attacks and CSS hacks to protect end
to detect potential malicious threats users and stop data leakage

Automated website privacy audit and alerts: Detect CCPA and GDPR compliance enforcement: Define
risks to your data privacy rules – website scanning parameters based on global data privacy laws to
will check for unapproved technologies that may enforce website compliance in real time
have access to your customer data
Get in contact to learn more about how you can prevent
Masking of sensitive data: Determine unique data data leakage and protect your website from being
patterns to prevent sensitive data being exposed compromised.
within the URL and passed to unauthorized
third-party technologies

About Ensighten

Ensighten is a global cybersecurity leader, offering next generation client-side protection against data loss, ad injection and intrusion. Through the Ensighten solution, organizations can access privacy risk and stop
unauthorized leakage or theft of data, as well as comply with the CCPA, GDPR and other data privacy regulations. Ensighten’s MarSec™ platform protects some of the largest brands in the world from data leakage
whilst ensuring maximum web page performance.

Phone: 1-650-249-4712 | www.ensighten.com | Email: info@ensighten.com | Twitter: @ensighten | LinkedIn: @ensighten

© 2019 Ensighten. All rights reserved. All product and company names are trademarks or registered trademarks of their respective holders.

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy