How to Secure Your Website Staging Environment

Your website’s staging environment is like a dress rehearsal for a theater production. It mimics the production environment and allows for safe testing of updates and changes. Using a staging environment helps to avoid problems and saves money by preventing the need for costly patches later on the live site. It also protects your reputation by ensuring that your website works as expected from the start.

How can you keep your website staging environment secure?

One of the most basic things that you can do is to prevent random people from accidentally accessing the staging site as it may contain security vulnerabilities. To avoid this, ensure that the staging environment is password protected and that its URL is kept confidential. It also helps if you make sure that it’s different enough from the live site URL that nobody will stumble across it by mistake.

Sandbox-Specific Vulnerabilities

CVE is a project created to ‘identify, define, and catalog publicly disclosed cyber security vulnerabilities.’ As of this post, 862 records on its extensive list contain the term ‘sandbox’, which is synonymous with staging.

One example, CVE-2023-29017 refers to a critical remote code execution vulnerability that the Oxeye research team discovered in the vm2 sandbox library while they were looking for potential vulnerabilities. This is a very popular JavaScript sandbox that allows users to run code that they don’t trust. They quickly informed vm2’s owners who within days issued a patch in version 3.9.11. There have been no reports of any associated problems, but with a CVSS score of 10 and 16 million downloads from vm2 per month, the potential damage that Sandbreak could have caused is enormous.

In another example on the list (CVE-2023-24422), Jenkins Security reported a sandbox bypass vulnerability that involves map constructors in its security plugin. It lets attackers with permission define and run sandboxed scripts, including Pipelines that can get around the sandbox protection and run random code in the context of the Jenkins controller JVM. Potential consequences could be severe, but a fix was issued.

With CVE-2023-0131, an incorrect implementation of the iframe sandbox in versions of Google Chrome before version 109.0.5414.74 allowed a remote attacker to circumvent file download restrictions using a specially crafted HTML page. This is a Medium severe threat, and the updated version fixed it.

Some common attacks on website staging environments include:

SQL injection – a cyber attack in which malicious SQL code is injected into a web application’s input field to gain unauthorized access to its underlying database.

Cross-site scripting (XSS) – attackers inject malicious code into web pages viewed by other users, leading to unauthorized access or modification of their web browser’s behavior.

Cross-site request forgery (CSRF) – the attacker tricks a user into unknowingly executing a malicious action on a web application, typically through a link or button, by exploiting the user’s existing authentication credentials.

File inclusion vulnerabilities – attackers exploit weaknesses in web applications that allow them to execute malicious code by including remote files, often resulting in data theft, system compromise, or denial-of-service attacks.

Vulnerabilities like these highlight the need for a continuous security solution like Reflectiz. With dozens of third-party apps, in-house apps, and open-source software used to deliver website functionality, time and again, it’s been these links in the supply chain that attackers have so often exploited.

They demand rigorous visibility because it’s imperative to make sure that all software is functioning as intended, that it’s free from vulnerabilities, and that its software processes meet compliance and security requirements.

Software Development Life Cycle

The Software Development Life Cycle (SDLC) approach to software development is also recommended as it treats maintaining security as an ongoing quest rather than a one-time activity or afterthought. And today, most teams recognize the importance of integrating security testing into the SDLC approach. Software security assurance practices call for the inclusion of security awareness and testing at every stage of the development process. Thanks to this kind of security-first ethos, when it comes time to scale, everything will still function securely and predictably, protecting sensitive data, avoiding breaches, and ensuring the continual smooth running of the business.

Software Bill of Materials

One of the advantages that Reflectiz brings to the table is its ability to automatically map all software creators and the elements required for your Software Bill of Materials. This gives you a tailor-made compliance checklist of what components to use and which to avoid, alerting you to potential security risks and ensuring that all the reams of code that your website relies on won’t compromise it.

Reflectiz Monitoring Solution

With these requirements in mind, Reflectiz offers several different monitoring profiles to suit different use cases:

Staging

The most appropriate option in this instance, the Staging profile was specifically designed to meet the particular requirements of monitoring pre-production website environments. It’s ideal for uncovering development and DevOps risks and ensuring that all software components are being used as they should prior to deployment on the live site.

Standard

The Standard monitoring profile offers comprehensive monitoring of a website after deployment, maintaining visibility of its internal pages and sections. It also helps to create an inventory of all the applications the website uses and their individual behaviors. This profile is particularly suitable for marketing websites and will typically involve ‘no-consent’ monitoring for full visibility. It also works with different geo-locations.

Checkout

As the name suggests, this profile is best suited to monitoring a website’s checkout process. It not only helps in the detection of web-skimming attacks it also ensures that the site complies with PCI DSS standards. It can perform different iterations of the entire purchasing journey, with or without credit card information, to identify vulnerabilities.

Forms

This profile monitors a particular business process on the website and is best suited to fulfilling PII compliance needs and identifying sophisticated attack vectors. The monitoring includes a full simulation of filling and submitting different forms.

Campaigns

Monitors specific campaigns that are not reachable by the main website, so it’s ideal for inaccessible pages or those managed by third parties. The monitoring process begins on one or more landing pages and simulates a profile-monitoring journey.

Authentication

Ideal for discovering applications post-authentication, PII listening, and discovering potential data leaks. It also monitors sensitive vendors who may have access to business data. It best suits monitoring of a website where pre-login is required. This can include a username, password, and mobile OTP. Following login, a standard monitoring profile will be implemented.

No-Consent

This one is best for validating the privacy policy and enforcing third-party compliance requirements. It is typically deployed alongside a regular monitoring profile for comparison. It is suited to monitoring a website when the user wants to reject cookies. After they opt out, a regular monitoring profile will be executed.

Customized

The Custom profile gives users the flexibility to include adaptations that meet their specific needs.

Conclusion

By using one or more of these profiles as well as implementing the suggested best practices for each new staging environment, site owners can vastly increase their security posture. Reflectiz can assist teams throughout the development journey by:

Keeping a continuous watchful eye on your internal and external software components to identify any security weaknesses and compliance concerns.

enabling you to follow the software development life cycle – from start to finish with constant monitoring during production.
Creating a comprehensive Software Bill of Materials (SBoM) that details all software creators and the components used in each application.