Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Privacy

8/4/2017
10:00 AM
Hadar Blutrich
Hadar Blutrich
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Are Third-Party Services Ready for the GDPR?

Third-party scripts are likely to be a major stumbling block for companies seeking to be in compliance with the EU's new privacy rules. Here's a possible work-around.

Like a maelstrom on the horizon, GDPR — the European Union's General Data Protection Regulation — is coming, and companies both inside and outside the EU are scrambling to comply with its many rules. Among those rules is a requirement for companies that have access to user data to protect it by any means necessary. If they don't or can't, they pay — in cash, with hefty fines imposed on companies that fail to fulfill their obligations. And the EU means business; it imposed a $2.7 billion fine on Google in June over what officials said was Google's misuse of its data power.

Companies, of course, are doing everything they can to comply with the EU's cybersecurity rules, including the implementation of collaboration and information-sharing between relevant institutions (government, banks, regulators) regarding attacks and defense systems, education efforts to ensure that employees don't admit malware into the network, and appointing an officer who will be in charge of ensuring that user data remains safe. And the rules apply to all companies and organizations, anywhere, if an EU citizen can connect to their site.

Every company that does business on the Web is now busy ensuring that its security systems are up to the EU's standards. But there are data issues beyond the control of any organization in the form of the data collected by third-party scripts, which are processed and stored in databases belonging to the third-party script provider. And organizations can't do without these scripts; they provide the services that users have gotten used to and demand — such as social media, ecommerce, comment services, advertising, content distribution, site analytics, and much more — as part of their Web experience. Without these scripts, there basically is no World Wide Web as we know it, and without those services, the level of engagement on sites is likely to fall considerably.

The Security Factor
There's no way of knowing how secure the scripts are. We know that there have been numerous examples of third-party scripts being taken over by cybercrooks to pull off some spectacular hacks. There was, for example, the Stegano exploit, which compromised the computers of millions of users around the world. Stegano, which has been around since at least 2014, came into new prominence last fall when it was used to cleverly hijack readers of "popular news sites," according to ESET Research, which first published details of the exploit. Hackers used ad networks to distribute malicious scripts to run an exploit via an image's invisible alpha channel (a layer of an image meant to store data but that has no visual representation in the image).

The exploit — which didn't change the banner ad at all, making it almost impossible for a user to detect that anything was wrong — checked to see if any security software, sandboxes, etc., were present; if they were not, the exploit would redirect to a page that downloaded a payload and used regsvr32.exe or rundll32.exe to install it. The point of the exploit was to install malware that would steal user data from the webpage itself — login and password combinations or credit card numbers if they were entered into a box on the webpage — or to divert their clicks to other servers that served the needs of hackers or their clients.

In either case, the data of users was compromised — a sad story for them, and certainly a black mark on the news sites that were victimized — but under the new rules, sadness and loss of reputation are the least of the problems of the organizations whose sites were compromised. Had GDPR been in effect when the exploit was going full blast, the news sites would likely have been fined, if not prosecuted. That's how tough the EU rules are, and nearly all sites that use third-party scripts are potential victims.

What can they do to protect themselves? First of all, sites have to even out the equation and find a way to take back control of their websites. In that sense, their experience is similar to administrators who run mail servers — and whose users are plagued with endless amounts of phishing emails that seek to tempt recipients to click on a rogue link or contaminated attachment. Despite the best efforts of administrators, who have tried lecturing, hectoring, threatening, and begging users not to click on suspicious-looking links and attachments, the problem gets worse every year, with more attacks and more opened messages leading to more successes for hackers.

If lecturing, hectoring, threatening, and begging don't work, what will? One idea is separation — setting up a sort of sandbox between the mail server and the user's inbox that can examine the contents of a message. If something appears suspicious, either in the attachment or the message itself, the message can be "cleansed" of bad elements, or dumped altogether. If it works for email — and, indeed, for any Web connection — why not for third-party scripts? With sandbox-type solutions, companies can regain control of their websites while retaining the third-party services their users demand. Sites would be able to protect themselves from the unknown threats presented by third-party scripts, ensuring that not only is user data protected but that organizations are protected from the threat of big EU fines and penalties if something goes wrong.

Related Content:

Hadar brings more than 15 years of varied executive experience, leading teams and developing multiple out of the box solutions. Formerly Chief Solution Architect at LivePerson global sales and alliances team, Hadar's can-do approach helped to close contracts worth millions of ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15820
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
CVE-2020-15821
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
CVE-2020-15823
PUBLISHED: 2020-08-08
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
CVE-2020-15824
PUBLISHED: 2020-08-08
In JetBrains Kotlin before 1.4.0, there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.
CVE-2020-15825
PUBLISHED: 2020-08-08
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.