A New Way To Manage Your Web Exposure: The Reflectiz Product Explained

An in-depth look into a proactive website security solution that continuously detects, prioritizes, and validates web threats, helping to mitigate security, privacy, and compliance risks.

Reflectiz shields websites from client-side attacks, supply chain risks, data breaches, privacy violations, and compliance issues.

You Can’t Protect What You Can’t See

Today’s websites are connected to dozens of third-party web apps, trackers, and open-source tools like pixels, tag managers, and JavaScript frameworks. Some of these elements are stored on public CDNs, while others are loaded from third-party web servers that may be unfamiliar. These external web components and data items are not always visible to standard security controls, and they often expose you to security threats such as supply chain risks, client-side attacks, and vulnerabilities in your online software. This means that these serious challenges will frequently go unnoticed. Moreover, security and privacy regulations like GDPR, the Cyber Resilience Act, and CCPA have become stricter, creating compliance issues that can lead to costly fines and reputation damage.

The Result: Your web threat exposure is larger than you think.

No More Blind Spots

Reflectiz’s sandbox solution continuously monitors all first-, third-, and fourth-party web apps, external domains, and data items. It detects vulnerabilities and risks in your online environment, providing complete visibility over your web threat exposure, to reveal things like forgotten tracking pixels that are still collecting users’ data long after they should have stopped, or malicious e-skimmers running in iFrames that quietly harvest credit card details. The platform then effectively prioritizes and remediates these security threats and compliance issues.

The Reflectiz solution is executed remotely, requiring no installation. It does not impact your website performance and provides visibility over web components and data items that traditional web security tools may overlook. The platform’s intuitive user interface does not require any technical expertise.

Reflectiz’s Automated Detection Cycle

Proactive Security is Crucial for Managing Sophisticated Security Threats

In today’s sophisticated threat environments, security teams need to effectively scope, identify, prioritize, and address a wider range of threats imposed on their online businesses, shifting from merely fixing vulnerabilities to exposure management. Unlike traditional security tools, a proactive approach solution enables teams to continuously combat sophisticated web-based cyber threats, achieve enhanced visibility of their entire web exposure, and mitigate security and privacy risks before actual damage has been done.

Want to try the Reflectiz platform? Sign up for a 30-day free trial here.

Analyzing the Web Risk Factors

Reflectiz has developed a unique proprietary browser that explores each webpage on a website, running it dynamically like a regular user. This allows it to analyze and monitor everything that happens on a webpage, including loaded components’ behaviors, Javascript execution, and network requests. This creates a broader view on your website’s immediate risks and threats.

• The browser acts like a super client-side proxy, ensuring that no activity on a given webpage goes undetected.

• The browser collects millions of events that Reflectiz processes, allowing the platform to perform root cause analysisand map the entire supply chain.

• All web components and their activities are monitored and analyzed for behavior changes, including scripts, iFrames, tags, pixels, cookies, and http-headers.

• The browser has no limitations and can see all activities on any webpage, including iFrames, non-origin content, and first-party components

Reflectiz’s Unique WWW Approach

Dedicated dashboards for websites and subdomains offer extensive data and details based on Reflectiz’s WWW approach—WHO are your third-party vendors? WHAT are they doing on your websites? WHERE do they send the data they collect? The combination of the answers for each element allows Reflectiz to accurately assess the activity of any web app, domain, or data item, and immediately alert security teams.

For example, Reflectiz recently discovered sophisticated Magecart web skimming attacks involving counterfeit shops on the popular Shopify platform. By utilizing its WWW approach and analyzing browser activity from the outside, Reflectiz promptly identified the malicious activity and mitigated the attackers’ tactic.

For further insights read the Shopify Magecart attack case study.

Exposure Rating

Modern websites carry inherent risks. For instance, a financial website cannot function without user login and financial transaction capabilities, and an e-commerce platform is rendered useless without purchasing functionalities. But these vulnerable areas are precisely where risks are most likely to occur.

Have you ever wondered how secure your website is compared to your competitors? Have you ever thought that knowing would be a competitive advantage? Reflectiz recently introduced an innovative rating system to answer that question.

Reflectiz continuously monitors thousands of websites every day and has now developed the capability to analyze the data gathered and communicate web risk exposure levels in a simple metric.

Leveraging an extensive database, every Reflectiz client can now determine exposure rating for various categories, including web apps (1st-, 3rd-, and 4th-party), external domains, and website structure.

Every website receives an exposure rating based on an A-F scale, benchmarked against industry leaders. This score indicates your level of web threat exposure to web risks. Clients use it not just to see how they compare, but as a tool to guide their efforts to improve.

Complete Inventory

The foundation of exposure rating lies in Reflectiz’s comprehensive inventory of web apps, open-sources, domains, and data items across all websites. This includes global search and filtering options, making it easy to locate any data item within any web environment and allowing users to delve into different elements of risk.

• Applications – a complete list of all first-, third-, and fourth-party vendors’ applications running on your website. It includes details such as scripts, locations, hierarchy, and more. Additionally, clients can get access to the pages themselves or the code of each script, along with the current risk factors associated with each application.

• Domains – a comprehensive inventory of external and owned domains communicating with third parties. This information includes SSL certificate data, domain Whois records, cyber-reputation tests, and more.

• Data – This section contains analyzed records of all active data items on the website, covering inputs, network parameters, trackers, and pixels. It connects these items to the bigger story of the WWW [Who? What? Where?], including related applications and domains. Furthermore, it identifies which third parties are accessing each data item.

• Alerts – This section displays all alerts generated by the system, along with detailed information and recommendations for each one. The information is presented in understandable language to ensure all users can make informed decisions.

Deeper Exploration of Specific Risk

Reflectiz aggregates all scripts into a single web app or data item view, along with the current risk factors for each, allowing you to easily identify problematic applications and take immediate actions. The list is dynamic, enabling you to view new third-, fourth-, and nth-party applications and scripts that are added, including those through tag managers or other means.

Managing of specific data items provides the following:

• Identification of remote web servers connected to data items, including the applications that load them and those they load. For example, when integrating a third-party web app like Google Tag Manager into your website, you also integrate fourth-party web apps that already exist on it, such as Meta pixel or TikTok pixel. These elements often go unnoticed by standard security controls and may be exploited.

• Utilization of business intelligence statistics like global popularity rank, which informs you if a specific data item is commonly used by others, and site coverage rate, where you can observe the spread of a certain data item across your web pages. For example, Google Tag Manager boasts an 80% global popularity rank, indicating widespread adoption, whereas the SnapChat pixel lags behind at 10%. This means that 80% of modern websites use Google Tag Manager, while only 10% incorporate the SnapChat pixel. Armed with this information, security teams can assess the necessity of integrating less popular elements like the SnapChat pixel, thereby reducing overall risk.

• Investigation of risk factors for each data item involves addressing questions such as whether it has access to sensitive information or communicates with unsecure locations. For example, Reveal.js, a framework for creating attractive presentations using HTML, can exhibit several risk factors, including low popularity ranking, execution outside of trusted domains, loading from an open CDN, and access to sensitive inputs. The combination of these risk factors results in a high alert severity level.

Management Panel

The high-level management panel enables decision-makers to obtain a comprehensive overview of their web security status for all their websites in one place. This is achieved by providing a summary of alert severity levels and categories, such as malicious detections, privacy concerns, misconfigurations, and more. Additionally, it includes geographic and workflow displays, allowing managers to observe detected anomalies in their web environment over the past three months.

Addressing PCI DSS v4 New Web Requirements

Reflctiz has recently introduced an add-on feature: a dedicated PCI Dashboard.

The current version of PCI DSS is set to expire by the end of March 2024. With the new PCI DSS 4.0 requirements coming into effect in Q1 2025, Reflectiz enables clients to ensure compliance with mandates such as 6.4.3, by demonstrating how you monitor and manage all payment page scripts executed in the consumer’s browser, and 11.6.1, by showing how you activate a change and tamper detection mechanism for prompt alerts on unauthorized modifications.

The Reflectiz PCI Dashboard also facilitates the generation of compliance reports essential for audits by the PCI’s Quality Security Assessor (QSA). Reflectiz’s PCI compliance solution operates remotely, eliminating the need for installations and providing security teams with immediate real-time visibility into the online ecosystem. This means staying in compliance without imposing a heavy resource burden.

Beyond PCI compliance, the dashboard empowers you to monitor third-party web apps and data items accessing payment and credit card data, while maintaining a comprehensive inventory of all third- and fourth-party scripts. Experience watertight web security that exceeds PCI standards with Reflectiz and take advantage of a free 30-day trial of our PCI DSS Dashboard to seamlessly meet the latest v4.0 requirements.

Establish a Security Baseline

So, how do you start with Reflectiz? The first step for every client is to create a security baseline that aligns with the organization’s risk appetite for approved third-party web apps, marketing pixels, open-source activities, and more. It ensures safe execution and continuous monitoring of all actions.

The security baseline also helps identify any new items that bypass your allow list or detect anomalies in behavior. By design, it reduces the number of alerts and keeps track of changes.

For example, if an unapproved cookie or marketing pixel collects user data without consent, an immediate alert will be issued. You can then approve or unapprove the specific cookie or pixel behavior according to your business context. If choosing to eliminate the risk, Reflectiz will provide mitigation steps to resolve the issue quickly by removing or blocking the specific rogue web app or data items.

About Reflectiz

Reflectiz is a cybersecurity company specializing in web exposure management. Years of research by infosec experts have gone into the creation of their cutting-edge platform, which global companies now rely on to keep their websites safe. Reflectiz offers a suite of powerful cybersecurity tools gathered within a user-friendly dashboard. It empowers online businesses to continuously monitor both their websites and the web apps they rely on, so they can quickly identify and resolve security threats and privacy issues before they can become a problem.

Want to try the Reflectiz platform? Sign up for a 30-day free trial here.