Stop Hidden Scripts from Exposing User Data

We use open source self hosted large language models hosted on our own cloud infrastructure. Many solutions use APIs of large AI vendors but the problem with that approach is that the data may be used for training. You don't have control over it. With the architecture cside has adopted, the is no opportunity for data to leak. We maintain control over the entire dataflow.

Client-side attacks happen when malicious code hidden in client-side fetched scripts. These scripts can steals sensitive user information directly from their browsers as they enter it. Completely bypassing security controls on data storage. Often these attack target easily resold data like payment card information or login credentials and session tokens. In the context of privacy compliance the focus is more on accident access to personal data. Many marketing tools collect more data than you may know about. A recent example of this was the incident of Kaiser Permanente (https://cside.com/blog/kaiser-permanente-data-leak-a-case-of-miscommunication-and-inadequate-disclosure).

Scripts from external sources can become malicious in several ways. Sometimes legitimate scripts are updated with malicious code because of a supplychain incident on the side of the script host. Sometimes the infrastructure is compromised. Sometimes a bad actor manages to take over ownership of a script. However the most common injection method is a compromised account either at a 3rd party script vendor or a google tag manager container. The hardest part to detect these malicious script is that they are often dynamically served and only inject the malicious content under certain circumstances. Avoiding detection by security teams and periodic scanners.

Cside offers a clean privacy dashboard experience that covers privacy controls as a whole. But per framework, GDPR, CCPA and other US state level laws we provide specific dashboards that address the explicit requirements one by one.

When a script turns bad, attemtping to prevent the bad action is a dangerous thing to do. So with cside we opted for an alternative approach. You can roll back to a previous safe hash of that script to buy time to address the security concern without causing critical downtime.

This is hard to say but the average cost of a data breach is $4.44 million according to IBM's 2023 Security Report. Historically client-side attacks have been more expensive due to regulatory fines and lost customer trust. A good example of this was the British Airways incident and the Kaiser Permanent incident. Both caused significant legal costs, fines and settlements.

Cside uses an in house built detection engine using a range of layers to detect malicious behaviours and changes in scripts. We do not believe static threat feed intel is the way to go when addressing a dynamic security threat. We do reuse the data of detections to improve future detection systems and for our own scanner service. So that we detect more malicious behaviors than tools built on publicly exposed or commonly used threat feeds.