Managing Shadow Code & the Blind Side in 3rd Party Risk – Stephen Ward – PSW #733
With all of your focus and investment on 3rd party risk management, there is likely still a blind-side that remains unaddressed. It is an area that should be moved to the top of your priority list - both for its potential to cause material losses in the form of response costs and fines and judgements, and for the ease in which it can be mitigated. It is a risk introduced by the 3rd party vendors you rely upon (and the nth parties they work with) to power and enhance your website. The threat of JavaScript based attacks - click-jacking, digital skimming, formjacking, defacement, "Magecart" - exists for any organization collecting sensitive data or conducting transactions through their web properties. Attacks of this type have done damage to some of the biggest brands in the world - costing household names like British Airways tens of millions - and they happen by the hundreds per month. Already in 2022, we've seen headlines of major client-side attacks like the one that hit Segway - potentially impacting nearly a million consumers.
This is an area of exposure introduced through your own code, and by your partners, that can only be addressed at the client-side. It remains widely unaddressed, as focus in website security to this point has been on securing the server side.
Join us for an exploration of the threat of these attacks, real-world examples of the material impact they have caused, and dialogue on the approaches to mitigating this risk with pros and cons of each.
Segment Resources:
Our core whitepaper https://info.sourcedefense.com/event/client-side-white-paper-2022?leadsource=White%20Paper
Blog on the blind side topic https://sourcedefense.com/resources/blog/wheres-the-blind-side-in-your-3rd-party-risk-its-on-the-client-side/
Free risk report on attendee's web properties https://sourcedefense.com/check-your-exposure/
This segment is sponsored by Source Defense. Visit https://securityweekly.com/sourcedefense to learn more about them
Announcements
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
Guest
Stephen Ward is CMO at Source Defense – the pioneer in client-side security. He has been with the firm since late 2021 and is responsible for all aspects of go to market. Stephen is a serial cyber security entrepreneur with a 25-year long career in Marketing. In his career, he has been fortunate enough to work for some of the most innovative, category creating companies in our space. He helped bring forensics to the forefront in his time at NetWitness, helped drive change in endpoint security while at Invincea, brought threat intelligence to the mainstream while at iSight Partners, drove real change in OT/ICS security while at Claroty, helped create the cyber risk quantification market while at RiskLens and through his work with the FAIR Institute. Don’t hold his title against him – he’s more than a Marketing person – he’s been dedicated to driving better outcomes for the good guys in cyber security for the majority of his career.
Hosts
