Client-Side Defense
About Client-Side Defense
F5® Distributed Cloud Client-Side Defense (CSD) provides a multi-phase protection system that protects web applications against Formjacking, Magecart-style, and other malicious JavaScript attacks. This multi-phase protection system includes detection, alerting, and mitigation.
- Detection. A continuously evolving signal set allows CSD to understand when scripts on web pages exhibit signs of exfiltration. CSD detects network requests and form field reads by malicious scripts that attempt to exfiltrate PII data.
- Alerting. CSD generates timely alerts on malicious changes in behavior of scripts, provided by a continuously improving Analysis Engine. The Analysis Engine contains a machine learning component for accurate and informative analysis and provides details on the behavior of malicious script to help troubleshoot and identify the root cause.
- Mitigation. CSD detects threats in real-time and provides enforcement with one-click mitigation. CSD leverages the same obfuscation and signal technology as F5® Distributed Cloud Bot Defense, delivering unparalleled efficacy.
The diagram below shows the basic data flow for CSD.
Figure: CSD Data Flow
CSD Data Flow
- An end-customer comes to web site protected by CSD and the CSD JS executes. When it executes, it detects actions of other scripts running on the web page.
- The CSD JS sends script information (a list of actions of other JavaScripts) as a signal to the CSD Analysis Service.
- The script information is analyzed by the Analysis Service and it generates a risk score.
- If the risk score is greater than the threshold for normal behavior (which means a suspicious data exfiltration was detected), an alert is raised on the CSD Dashboard (and also raised on the other alert channels configured by the customer).
- The user can take a one-click mitigative action to instruct CSD to immediately block such exfiltration.
Page Tamper Detection
Client-Side Defense includes Page Tamper Detection to alert users about unauthorized client-side modifications to payment pages. This helps prevent malicious actors from exploiting client-side vulnerabilities to exfiltrate sensitive information, such as credit card information and credentials.
Page Tamper Protection saves a snapshot of your payment page HTTP headers and then alerts you if it detects any modifications to the headers. The HTTP header snapshot is periodically updated to account for changes in your IT environment.
Enabled by default in Client-Side Defense, Page Tamper Detection can help your organization demonstrate accountability and adherence to PCI DSS standards during audits and can help streamline your ability to respond to potential threats.