Seal the Browser Leak: Addressing Compliance and Data Protection Challenges
SchellmanCON 2025 Speaker
John Elliott, Security Advisor at Jscrambler
Data breaches and research have shown that control of what happens to data entered in the browser is gradually diminishing — whether that’s due to the JavaScript or “tags” on a webpage or the behavior of in-app browsers.
Regulators expect organizations to protect their customers from browser data leaks. The PCI SSC and HHS have both issued instructions in this respect. Do we have the risk management and security controls to comply, and if not, what should we do?
Agenda
John Elliott's presentation is essential for organizations aiming to fortify their data protection strategies in today's evolving digital landscape.
What’s the big problem?
The three threats
What is the regulatory view?
What should we do?
Prediction 1
Hostile threat actors will use JavaScript skimming techniques to exfiltrate more than just cardholder data.
Prediction 2
Managing the risk associated with JavaScript that executes in your customers’ browsers will become a regulatory requirement.
Prediction 3
Managing JavaScript will be painful for many organizations.
Prediction 4
There will be a disconnect between regulatory opinion and what is practical. Documented risk assessment will be key.
