Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Privacy

8/4/2017
10:00 AM
Hadar Blutrich
Hadar Blutrich
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Are Third-Party Services Ready for the GDPR?

Third-party scripts are likely to be a major stumbling block for companies seeking to be in compliance with the EU's new privacy rules. Here's a possible work-around.

Like a maelstrom on the horizon, GDPR — the European Union's General Data Protection Regulation — is coming, and companies both inside and outside the EU are scrambling to comply with its many rules. Among those rules is a requirement for companies that have access to user data to protect it by any means necessary. If they don't or can't, they pay — in cash, with hefty fines imposed on companies that fail to fulfill their obligations. And the EU means business; it imposed a $2.7 billion fine on Google in June over what officials said was Google's misuse of its data power.

Companies, of course, are doing everything they can to comply with the EU's cybersecurity rules, including the implementation of collaboration and information-sharing between relevant institutions (government, banks, regulators) regarding attacks and defense systems, education efforts to ensure that employees don't admit malware into the network, and appointing an officer who will be in charge of ensuring that user data remains safe. And the rules apply to all companies and organizations, anywhere, if an EU citizen can connect to their site.

Every company that does business on the Web is now busy ensuring that its security systems are up to the EU's standards. But there are data issues beyond the control of any organization in the form of the data collected by third-party scripts, which are processed and stored in databases belonging to the third-party script provider. And organizations can't do without these scripts; they provide the services that users have gotten used to and demand — such as social media, ecommerce, comment services, advertising, content distribution, site analytics, and much more — as part of their Web experience. Without these scripts, there basically is no World Wide Web as we know it, and without those services, the level of engagement on sites is likely to fall considerably.

The Security Factor
There's no way of knowing how secure the scripts are. We know that there have been numerous examples of third-party scripts being taken over by cybercrooks to pull off some spectacular hacks. There was, for example, the Stegano exploit, which compromised the computers of millions of users around the world. Stegano, which has been around since at least 2014, came into new prominence last fall when it was used to cleverly hijack readers of "popular news sites," according to ESET Research, which first published details of the exploit. Hackers used ad networks to distribute malicious scripts to run an exploit via an image's invisible alpha channel (a layer of an image meant to store data but that has no visual representation in the image).

The exploit — which didn't change the banner ad at all, making it almost impossible for a user to detect that anything was wrong — checked to see if any security software, sandboxes, etc., were present; if they were not, the exploit would redirect to a page that downloaded a payload and used regsvr32.exe or rundll32.exe to install it. The point of the exploit was to install malware that would steal user data from the webpage itself — login and password combinations or credit card numbers if they were entered into a box on the webpage — or to divert their clicks to other servers that served the needs of hackers or their clients.

In either case, the data of users was compromised — a sad story for them, and certainly a black mark on the news sites that were victimized — but under the new rules, sadness and loss of reputation are the least of the problems of the organizations whose sites were compromised. Had GDPR been in effect when the exploit was going full blast, the news sites would likely have been fined, if not prosecuted. That's how tough the EU rules are, and nearly all sites that use third-party scripts are potential victims.

What can they do to protect themselves? First of all, sites have to even out the equation and find a way to take back control of their websites. In that sense, their experience is similar to administrators who run mail servers — and whose users are plagued with endless amounts of phishing emails that seek to tempt recipients to click on a rogue link or contaminated attachment. Despite the best efforts of administrators, who have tried lecturing, hectoring, threatening, and begging users not to click on suspicious-looking links and attachments, the problem gets worse every year, with more attacks and more opened messages leading to more successes for hackers.

If lecturing, hectoring, threatening, and begging don't work, what will? One idea is separation — setting up a sort of sandbox between the mail server and the user's inbox that can examine the contents of a message. If something appears suspicious, either in the attachment or the message itself, the message can be "cleansed" of bad elements, or dumped altogether. If it works for email — and, indeed, for any Web connection — why not for third-party scripts? With sandbox-type solutions, companies can regain control of their websites while retaining the third-party services their users demand. Sites would be able to protect themselves from the unknown threats presented by third-party scripts, ensuring that not only is user data protected but that organizations are protected from the threat of big EU fines and penalties if something goes wrong.

Related Content:

Hadar brings more than 15 years of varied executive experience, leading teams and developing multiple out of the box solutions. Formerly Chief Solution Architect at LivePerson global sales and alliances team, Hadar's can-do approach helped to close contracts worth millions of ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15703
PUBLISHED: 2020-10-31
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivile...
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
CVE-2020-15277
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.