Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

PCI DSS 4.0 Compliance: A Guide to Requirements 6 & 11

In the ever-evolving landscape of cybersecurity, staying ahead of threats and ensuring the safety of sensitive customer data is paramount. For organizations that handle payment card information, complying with industry standards like PCI DSS (Payment Card Industry Data Security Standard) is not only a best practice, but a compliance requirement that can result in hefty fines upwards of $100,000 a month.

Node.js vs. Deno vs. Bun: JavaScript runtime comparison

JavaScript runtimes help you build advanced, server-driven JavaScript projects that aren't dependent on the user's browser to run. There are several choices of runtimes available, with the supremacy of the old stalwart Node.js being challenged by Deno and Bun. Deno is the latest project produced by the same developer who originally created Node.js, Ryan Dahl, back in 2009.

Mitigating DOM clobbering attacks in JavaScript

The Document Object Model (DOM) acts as an interface between HTML and JavaScript, bridging the gap between static content and dynamic interactivity. This function makes the DOM indispensable for modern web developers. However, the DOM has a pitfall — DOM clobbering. DOM clobbering occurs when HTML elements conflict with global JavaScript variables or functions, which can lead to unexpected behavior and a potential security loophole in your web application.

How to generate an SBOM for JavaScript and Node.js applications

SBOM is the acronym for Software Bill of Materials, which is a list of all the open source npm packages that are part of your project. But it’s not only limited to open source or software packages, and can include operating system libraries, microservices inventory and more.

Pixels/Trackers transfer data to foreign locations around the globe - including nation states of concern

By analyzing over 3,000 websites and over 100,000 associated webpages (using the client-side security scanning feature of Feroot Inspector) across 6 sectors, it was determined that pixels/Trackers transfer data to almost 100 countries around the globe. Table 1 shows the top 40 destinations of data being transferred by pixels/trackers collecting data from the analyzed websites – all of which were US-based.

Pixels & trackers are present on mission-critical webpages and thereby increasing the likelihood of risks

In an analysis of over 3,000 websites and over 100,000 associated webpages (using the client-side security scanning feature of Feroot Inspector) found pixels/trackers on 95% of their websites. Each website in the study corresponds to an unique organization (company, non-profit, or government agency). The high 95% reflects the extent of data harvesting that is done by marketing, advertising, and performance platforms today.

Pixels/Trackers Can Collect & Transfer Data Without Consent

Analysis on 3,000 websites and over 100,000 associated webpages (using the client-side security scanning feature of Feroot Inspector) revealed that pixels/trackers are collecting and/or transferring data prior to the explicit consent (e.g., cookie acceptance) of a website user. (While some do not require actual consent for one reason or another, the consent is not explicitly made.) Table 1 shows the degree to which some pixels/trackers were present on the analyzed websites.

TikTok Trackers Can Still Be Present Regardless of TikTok App Installation

In an analysis of over 3,000 websites and over 100,000 associated webpages (using the client-side security scanning feature of Feroot Inspector) across 6 sectors, it was discovered that TikTok pixels/trackers were present on 7.41% of the analyzed websites (shown in Table 1). Here, TikTok pixels/trackers were within the code of the web pages that load into a user’s browser from those websites.

Independent of their Apps, bad actors banned by various executive orders have pixels/trackers on everyday websites

“ manipulate content, and if they want to, to use it for influence operations” – FBI Director Chris Wray “To maintain the security of data owned by the state of Nebraska, and to safeguard against the intrusive cyber activities of China’s communist government, we’ve made the decision to ban TikTok on state devices.” – NB Governor Pete Ricketts “Protecting citizens’ data is our top priority, and our IT professionals have determined, in consultat

Why Pixels/Trackers are Common and Abundant

As part of a detailed study of pixels/trackers, an analysis of over 3,000 websites and over 100,000 associated webpages (using the client-side security scanning feature of Feroot Inspector) found pixels/trackers on 95% of their websites. Each website in the study corresponds to an unique organization (company, non-profit, or government agency). The high 95% reflects the extent of data harvesting that is done by marketing, advertising, and performance platforms today.