3 ms·
At my company, we used fixed dependency version numbers for external libraries. The libraries are tested and we do take sample traffic snapshots from browsers u
by ddalex 7y ago
At my company, we used fixed dependency version numbers for external libraries. The libraries are tested and we do take sample traffic snapshots from browsers using automation to see what our users see.
But this approach only takes care of simple, entry level attacks. A highly targeted attack, that lies dormant in a compromised library for ears, and it's engineered to avoid detection, e.g hiding for certain IPs or self-removing the code when the debug console is open - this is impossible to defend against, to my knowledge. How would you defend yourself?
- planetjones 7y agoI would daily compare the file running on the website that I deployed matched the file on the server verbatim. I think this would have been enough with BA. Secondly I would run a daily test in production which verifies the requests the browser makes match those expected. This would only need doing on the pages which capture payment information. Neither solution is particularly difficult. BA clearly did nothing. Hence the negligence and huge fine.