Webinar Description
Key Takeaways
- Practical guidance on securing JavaScript behaviour in the browser without disrupting development workflows
- Technical focus on script-based attacks including eSkimming and formjacking
- Coverage of PCI DSS requirements 6.4.3 and 11.6.1 for client-side security
- Designed for developers, AppSec engineers and front-end development leads
- Relevant to e-commerce, financial services and organisations handling sensitive web data
Securing the Browser Without Breaking the Build
Source Defense presents a technical webinar addressing one of the more persistent challenges in modern web application security: protecting users from script-based attacks while maintaining development velocity. Titled “The Developers Guide to Preventing Script-Based Attacks: Eliminate Web Security Risks Without Slowing Releases,” the session targets developers, application security engineers and front-end leads who must balance security requirements against release schedules.
The timing reflects growing industry concern about client-side vulnerabilities. As websites increasingly rely on third-party scripts for analytics, payment processing, personalisation, chat functionality and consent management, the attack surface has expanded well beyond what traditional server-side controls can address. Each external script introduces potential risk, and those scripts often load additional fourth-party resources, creating complex dependency chains that are difficult to monitor and secure.
The Client-Side Security Gap
Script-based attacks such as eSkimming and formjacking exploit JavaScript running in the browser to intercept sensitive data—payment card details, login credentials and personal information—before it ever reaches the server. These attacks bypass conventional security measures because they operate entirely within the user’s browser environment, outside the visibility of server-side monitoring tools.
The challenge is compounded by the sheer volume of scripts on modern websites. Marketing teams add tracking tags, product teams integrate third-party widgets, and development teams incorporate libraries to accelerate feature delivery. Each addition represents a potential vector for malicious code injection, whether through compromised supply chains or vulnerable script behaviour.
PCI DSS and the Compliance Dimension
The webinar addresses specific PCI DSS requirements that have brought client-side security into sharper focus for organisations processing payment data. Sections 6.4.3 and 11.6.1 of the standard establish requirements for script inventory, authorisation and integrity verification—controls that many organisations have historically struggled to implement effectively.
Requirement 6.4.3 mandates that organisations maintain an inventory of scripts executing on payment pages and implement mechanisms to authorise their presence. Requirement 11.6.1 extends this to ongoing monitoring and integrity verification. For development teams, these requirements introduce new operational considerations that must be integrated into existing workflows without creating bottlenecks.
Behaviour-Based Protection Models
The session explores behaviour-based approaches to client-side protection, which focus on monitoring what scripts actually do rather than simply cataloguing their presence. This model offers advantages for development teams because it can identify risky behaviour—such as unexpected data access or exfiltration attempts—without requiring manual review of every script change.
Effective implementation requires understanding the distinction between legitimate script functionality and potentially malicious behaviour. A payment processing script legitimately needs access to card data fields, while an analytics tag should not. Behaviour-based systems can enforce these boundaries automatically, reducing the security burden on development teams while maintaining protection.
Intended Audience
The webinar is structured for technical practitioners rather than executive audiences. Front-end developers will find practical guidance on implementing client-side controls, while AppSec engineers can evaluate approaches for integrating browser security into existing application security programmes. Compliance officers responsible for PCI DSS attestation will benefit from understanding the technical mechanisms available to satisfy client-side requirements.
Organisations in e-commerce and financial services face the most immediate pressure to address these vulnerabilities, though any business operating web applications that handle sensitive user data should consider the implications of uncontrolled script execution in the browser environment.