Third Party extensions for websites are a key target for cybercriminals as they are the place where critical customer and payment data flows through. Chris Olson, CEO at The Media Trust commented below.
Chris Olson, CEO at The Media Trust:
“The problem with third parties is that most remain unknown to website owners. Heavily trafficked online publishers, for example, have an average of 140 direct and indirect third parties whose code account for anywhere from 50-95% of all code executing on the websites. Using prevention technologies to control access and permissions of third-party code providers is a good first step to securing a website. However, these technologies will not prevent third parties, who require access to the website in order to support it, from getting hacked. Moreover, new security technologies no sooner emerge than bad actors learn to either weaponize or undermine them. To counter the growing threats of bad actors and to stay compliant with the GDPR, the California Consumer Protection Act, and other consumer data privacy laws, website owners should take a more comprehensive approach by implementing a robust digital vendor risk management (DVRM) program that lets a website owner work with their third parties on identifying who they are and what they do, as well as terminate code that violate privacy, security, and quality policies.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.