Tag Management System: the Agile Way to Add Vulnerabilities on your Website

The talk looks at a gap in web application security: third-party scripts that marketing teams add to live sites through tag managers such as Google Tag Manager. These tags let non-developers insert analytics, A/B testing, pop-ups and other code without going through the normal development cycle or code review, so the speaker argues they often escape security checks entirely.

The speaker, who moved from a marketing background into security engineering, walks through how these systems work and what can go wrong. Risks covered include security misconfiguration, unvetted scripts that can introduce cross-site scripting, tags that are not sandboxed, and domain hijacking of a trusted vendor. A live demo shows a custom HTML tag that carries arbitrary JavaScript, and a newspaper incident illustrates how a third-party script can take over page content. Because tag managers cannot easily tell malicious code from legitimate analytics, the talk stresses that marketing staff are themselves a target for social engineering.

For practitioners, the talk recommends speaking to marketing in their own terms, such as bounce rate and conversion impact, and inventorying which tools and data are collected. Suggested controls include restricting custom HTML, requiring approval steps, using subresource integrity and Content Security Policy where feasible, and setting data-layer rules that block tags on sensitive pages such as checkout. The closing message is that security should cover the tag manager lifecycle and that protecting users is a shared responsibility between developers and marketing.