Protect website users without slowing down business
Modern digital experiences are powered by the interactions between application servers and client-side scripts. Application developers often use common third-party scripts, code libraries, and dependencies to build their public-facing web applications. Though this practice speeds up and simplifies delivery, it has the potential to introduce unknown security vulnerabilities.
Any vulnerabilities in third-party scripts can leave users vulnerable to client-side attacks, where cyber criminals modify code at runtime to launch cross-site scripting (XSS) attacks, credit card skimming (Magecart) attacks, and other types of malicious activity.
Figure 1: Client-side attack
Defend against client-side attacks
Fastly Client-Side Protection provides a simple set of tools for script inventory and management right within the Fastly dashboard. It allows website owners to monitor scripts on pages and control what is loaded and executed in user browsers to protect their websites from client-side attacks.
Fastly Client-Side Protection provides you with the ability to inventory and control the resources (e.g., scripts, images, and fonts) that load on an end user’s browser from defined areas of your web applications by building and enforcing content security policies. When a resource violates your content security policy, the end user browser will block or log the resource depending on the option you choose. Based on these policy violation reports, you can adjust your content security policies as needed to address any issues.
You can also provide a justification as to why each client-side script is or is not allowed. These capabilities help you guard against cross-site scripting attacks (e.g., Magecart attacks) and enable you to maintain compliance with Payment Card Industry Data Security Standard (PCI DSS) 4.0.1 - Sections 6.4.3 and 11.6.1.
Benefits
Build comprehensive inventory of scripts and justifications in minutes
Monitor third-party scripts in real time and detect unauthorized activity
Alert on any unauthorized or malicious scripts
Maintain compliance with PCI DSS 4.0.1 Sections 6.4.3 and 11.6.1
Manage third-party scripts in the Fastly dashboard without a separate tool
Figure 2: How Fastly Client-Side Protection works
Getting started with Fastly Client-Side ProtectionFastly Client-Side Protection gives your organization the visibility to fully document, understand, and manage your client-side attack surfaces. Best of all, it only takes minutes to build your inventory. Spend less time worrying about security and get back to delighting your customers.
Ready to get started? Contact us.
Are you ready for the PCI DSS compliance deadline?
Standards from OWASP, NIST, PCI-DSS, and others have identified client-side protection as critical to complement existing server-side protections against cyber attacks.
Client-side security is an essential component of PCI-DSS 4.0, which mandates that businesses must maintain a full inventory and business justification of every script on their payment pages, along with methods for determining integrity and authorization.
To avoid penalties, organizations that process payment card data must comply with PCI-DSS 4.0 requirements by March 31, 2025.
