Website Protection From Client-Side Supply Chain Attacks

Modern websites heavily rely on scripts for a wide range of benefits. Both legitimate and malicious scripts can compromise sensitive user data, damaging your reputation, compliance, and bottom line. Yet webpage scripts are invisible to most security controls.

Deployed with a single line of code running in each of your real consumers' browsers, Code Defender automatically inventories your webpage scripts, alerts on risky & anomalous script behavior, enables granular protection of your customers’ sensitive data, and simplifies your privacy and PCI DSS 4.0 compliance.

Code Defender's granular client-side mitigation lets security teams block specific risky script actions (e.g. accessing passwords or credit card numbers) without blocking the script's desired business outcome.

Gain Total Visibility

Continuously Monitor Scripts

With a single line of code, auto-discover your browser attack surface, including all scripts and sensitive data

Protect Customer Data

Granular Control Over Scripts

Manage scripts granularly to mitigate risk without interrupting their desired function

Simplify Continuous Compliance

Quickly Find and Manage PII Leakage

Inventory your web scripts, manage authorizations, assure integrity, and generate reports

Find Browser Scripts

Websites use scripts for a number of actions, from login to checkout. Many groups inside a company deploy scripts to enable business without understanding their impact to risk.

Code Defender provides real-time visibility into all scripts, all downstream dependencies, and every action taken in real users' browsers. Deployed as a single line of code on your site, Code Defender will automatically discover and monitor all scripts, simplifying management.

Understand
Script Activity

Modern website scripts load dynamically at run-time in users’ browsers and frequently change without notice. As a result, point-in-time vulnerability scans alone are not sufficient to analyze scripts for malicious or vulnerable code.

Code Defender provides rich insights into and analysis of JavaScript activity on your real consumers’ browsers. It flags and risk-scores any new or changed script behavior, and automatically generates alerts. Out-of-the-box integrations enable sending alerts to your favorite security and collaboration tools.

Mitigate Risky Scripts

Though providing significant business value, third-party client-side scripts and libraries can put you at risk of a user data breach.

Code Defender allows security teams to authorize important scripts, but disable their unnecessary, anomalous, or potentially malicious elements. With client side mitigation (CSM), security teams have real-time granular control over client-side JavaScript, so they can enable the business without sacrificing access control risks.

Comply With PCI

Client-side scripts can provide a means to silently leak your users’ PII, including credit card data. Suspicious scripts are typically completely out of your control, and simply removing them may break key functionality on your website.

The Code Defender dashboard offers an at-a-glance overview and actionable recommendations to stop compliance violations and generate compliance reports for audits by Internal Security Assessors (ISA) or PCI’s Qualified Security Assessor (QSA).

HUMAN_Code-Defender_01_Script-Connections-Map

Find Browser Scripts

Understand
Script Activity

Mitigate Risky Scripts

HUMAN_Code-Defender_04_PCI-Compliance-Inventory

Comply With PCI

“We wanted to find the anomalies and changes in our client-side scripts. The Code Defender behavioral analysis solution greatly simplifies this process.”

—Lee Tarver, Sr. Manager, Security Architecture and Engineering, Sally Beauty

Deploy

The first step is to insert a JavaScript snippet on the Template for all pages. Ideally this snippet should be loaded directly to the Document Object Model (DOM) via HTML, at the top of the <head> block as a first party. The snippet is very lightweight at approximately 30kb. Once loaded the page will send relevant information to the HUMAN Sensor. If Code Defender is enabled, it is included as part of the sensor.

Analyze

The Sensor collects activity signals from the client-side browser, including interactions with the DOM, network domains, and local storage. This information is sent to the cloud-based Detector for analysis. The Sensor does not collect any personal data from the browser.

Detect

The cloud-based Detector analyzes the client-side activity signals to build a baseline profile for every first-, third- and Nth-party script running on the web page. The Detector flags any changes in script behavior or execution of new scripts and automatically generates alerts.