FRONT-END SECURITY ARCHITECTURE: PROTECTION OF USER DATA AND PRIVACY

A. S. Chechet; M. V. Chernykh; Ia. S. Panasiuk; I. I. Abdullin

A. S. Chechet New Edge DWC-LLC https://orcid.org/0009-0002-4919-9957
M. V. Chernykh Boom Pay, Inc https://orcid.org/0009-0004-5871-4628
Ia. S. Panasiuk Agoda Services Co., Ltd. https://orcid.org/0009-0009-5600-2084
I. I. Abdullin National Information Technology Center https://orcid.org/0009-0003-7632-380X

Keywords: data encryption, vulnerabilities, cross-site scripting, technology development, implementation, architecture, governance as code.

Abstract

Investigation of this topic is relevant in light of the significant increase in the frequency and scale of cyber-attacks that affect various industries and organisations. The purpose of this study is to analyse existing data protection methods at the Front-end, which are able to effectively protect the confidentiality of user data in the face of modern cyber threats. Among the methods used, the analytical method, synthesis, classification, statistical and other methods should be noted. The study identified serious risks associated with storing confidential data on the client side. In particular, the use of cookies and local storage turned out to be vulnerable points that pose potential threats to data security. An analysis of existing web applications revealed the presence of cross-site scripting (XSS) vulnerabilities, which became a route for the introduction of malicious scripts. It was revealed that the generation and use of unique cross-site request forgery (CSRF) tokens for each request play a key role in preventing cross-site request forgery. The implementation of Governance as Code (GaC) technology has demonstrated potential for automating compliance with established architectural and security standards, thereby reinforcing front-end defenses against cyber threats. The findings emphasise the importance of educating end users on the basic principles of network security. The study highlights the importance of developers’ active involvement in Front-end security. Thus, a comprehensive overview of the Front-end security architecture with a focus on protecting user data and ensuring privacy is provided. The practical significance of the study lies in the provision of specific recommendations and practical solutions to improve Front-end security in web applications and represents a valuable set of tools and approaches that can be applied by developers and engineers to strengthen the security of web applications. The addition of Governance as Code technology introduces an innovative layer of automated security enforcement that is particularly suited to addressing emerging cybersecurity challenges in real-time.

References

1. Tsulukidze, M., Nyman-Metcalf, K., Tsap, V., Pappel, I., Draheim, D. 2019. Aspects of personal data protection from state and citizen perspectives – Case of Georgia. In: I.O. Pappas, P. Mikalef, Y.K. Dwivedi, L. Jaccheri, J. Krogstie, M. Mäntymäki (Eds.), Proceedings of the 18th IFIP WG 6.11 Conference on e-Business
“Digital Transformation for a Sustainable Society in the 21st Century” (pp. 476-488). Cham: Springer. https://doi.org/10.1007/978-3-030-29374-1_39.
2. Napetvaridze, V., Chochia, A. 2019. Cybersecurity in the making – Policy and law: A case study of Georgia. International and Comparative Law Review, 19(2), 155-180. https://doi.org/10.2478/iclr-2019-0019.
3. Sivasangari, A., Kishor Sonti, V.J.K., Poonguzhali, S., Deepa, D., Anandhi, T. 2021. Security framework for enhancing security and privacy in healthcare data using blockchain technology. In: A. Khanna, D. Gupta, S. Bhattacharyya, A.E. Hassanien, S. Anand, A. Jaiswal (Eds.), Proceedings of ICICC 2021 “International
Conference on Innovative Computing and Communications” (pp. 143-158). Singapore: Springer. https://doi.org/10.1007/978-981-16-2594-7_12.
4. Feldman, D., Haber, E. 2020. Measuring and protecting privacy in the always-on era. Berkeley Technology Law Journal, 35(1), 197-250. https://btlj.org/data/articles2020/35_1/05_Haber_FinalFormat_WEB.pdf.
5. Amo, D., Alier, M., García-Peñalvo, F.J., Fonseca, D., Casañ, M.J. 2020. Protected users: A moodle plugin to improve confidentiality and privacy support through user aliases. Sustainability, 12(6), 2548. https://doi.org/10.3390/su12062548.
6. Kaur, J., Garg, U., Bathla, G. 2023. Detection of cross-site scripting (XSS) attacks using machine learning techniques: A review. Artificial Intelligence Review, 56(11), 12725-12769. https://doi.org/10.1007/s10462-023-10433-3.
7. Likaj, X., Khodayari, S., Pellegrino, G. 2021. Where we stand (or fall): An analysis of CSRF defenses in web frameworks. In: RAID ‘21: Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses (pp. 370-385). New York: Association for Computing Machinery. https://doi.org/10.1145/3471621.3471846.
8. Dalimunthe, S., Reza, J., Marzuki, A. 2022. Model for storing tokens in local storage (cookies) using JSON Web Token (JWT) with HMAC (Hash-based Message Authentication Code) in e-learning systems. Journal of Applied Engineering and Technological Science, 3(2), 149-155. https://doi.org/10.37385/jaets.v3i2.662.
9. Cheah, S., Selvarajah, V. 2021. A Review of common web application breaching techniques (SQLi, XSS, CSRF). In: Proceedings of the 3rd International Conference on Integrated Intelligent Computing Communication & Security (ICIIC 2021) (pp. 540-547). Dordrecht: Atlantis Press. https://doi.org/10.2991/ahis.k.210913.068.
10. Walton, S., Wheeler, P.R., Zhang, Y.I., Zhao, X.R. 2020. An integrative review and analysis of cybersecurity research: Current state and future directions. Journal of Information Systems, 35(1), 155-186. https://doi.org/10.2308/isys-19-033.
11. Kaur, J., Lamba, S., Saini, P. 2021. Advanced encryption standard: Attacks and current research trends. In: 2021 International Conference on Advance Computing and Innovative Technologies in Engineering (ICACITE) (pp. 112-116). Greater Noida: Institute of Electrical and Electronics Engineers. https://doi.org/10.1109/ICACITE51222.2021.9404716.
12. Raman, R.S., Evdokimov, L., Wurstrow, E., Halderman, J.A., Ensafi, R. 2020. Investigating large scale HTTPS interception in Kazakhstan. In: IMC ‘20: Proceedings of the ACM Internet Measurement Conference (pp. 125-132). New York: Association for Computing Machinery. https://doi.org/10.1145/3419394.3423665.
13. Li, S., Xu, C., Zhang, Y., Du, Y., Chen, K. 2022. Blockchain-based transparent integrity auditing and encrypted deduplication for cloud storage. IEEE Transactions on Services Computing, 16(1), 134-146. https://doi.org/10.1109/TSC.2022.3144430.
14. Omotunde, H., Ahmed, M. 2023. A comprehensive review of security measures in database systems: Assessing authentication, access control, and beyond. Mesopotamian Journal of Cyber Security, 2023, 115-133. https://doi.org/10.58496/mjcsc/2023/016.
15. Song, L., García-Valls, M. 2022. Improving security of web servers in critical IoT systems through selfmonitoring of vulnerabilities. Sensors, 22(13), 5004. https://doi.org/10.3390/s22135004.
16. Hiremath, P.N., Armentrout, J., Vu., S., Nguyen, T.N., Minh, Q.T., Phung, P.H. 2019. MyWebGuard: Toward a User-Oriented Tool for Security and Privacy Protection on the Web. In: T.K. Dang, J. Küng, M. Takizawa, S. Ha Bui (Eds.), Proceedings of the 6th International Conference “Future Data and Security Engineering” (pp. 506-525). Cham: Springer. https://doi.org/10.1007/978-3-030-35653-8_33.
17. Hutt, S., Baker, R.S., Ashenafi, M.M., Andres‐Bray, J.M., Brooks, C. 2022. Controlled outputs, full data: A privacy‐protecting infrastructure for MOOC data. British Journal of Educational Technology, 53(4), 756-775. https://doi.org/10.1111/bjet.13231.
18. Al Hawamleh, A.M., Alorfi, Sulaiman M, A., Al-Gasawneh, J.A., Al-Rawashdeh, G. 2020. Cyber security and ethical hacking: The importance of protecting user data. Solid State Technology, 63, 7894-7899. https://solidstatetechnology.us/index.php/JSST/article/view/7202.
19. Arora, C. 2019. Digital health fiduciaries: Protecting user privacy when sharing health data. Ethics and Information Technology, 21(3), 181-196. https://doi.org/10.1007/s10676-019-09499-x.
20. Saravanan, N., Umamakeswari, A. 2021. Lattice based access control for protecting user data in cloud environments with hybrid security. Computers & Security, 100, 102074. https://doi.org/10.1016/j.cose.2020.102074.
21. Method and system for verifying the architecture of a software/hardware solution. 2022. https://patentscope.wipo.int/search/en/detail.jsf?docId=WO2022250564.