There’s been a sharp rise in threats targeting browsers — and a critical increase in the need to secure and manage them.
Research has shown that the browser is the most widely used application in the enterprise, and Google Chrome and Microsoft Edge are by far the most popular. Both of these fully featured browsers are provided at no charge, making them an excellent choice for enterprises and end-users alike.
As they have evolved, these browsers have added an astonishing number of differentiated features, becoming more like an operating system than a simple method of fulfilling search queries. Like any other enterprise asset, it is vital to manage these powerful browsers to ensure that their advanced features are used appropriately and that they do not expand the enterprise attack surface or defeat data privacy controls.
Modern security teams need a browser security strategy. Even if browsing sessions are isolated and secured, the endpoint browser controls many aspects of how users interact with the web, including managing passwords, validating HTTPS connections, determining what types of data are shared with external services, and more.
One of the biggest issues with managing browser policies is that there are so many of them to choose from, and within each policy there are often two to three different options. While it is possible to handle this task manually, it is time-consuming and laden with implications that aren’t obvious at first glance.
Both Chrome and Edge regularly release new features, either to correct issues or to enable new functionality; for example, Chrome releases a full browser update about every 6 weeks, while minor updates, such as security fixes and software updates happen more frequently.That means that the process of managing the browser is not a “one-and-done” proposition, but rather a dynamic process that must be maintained over time.
Simply allowing the browser to go unmanaged may have been the simplest approach in the past. Unfortunately, this path is increasingly untenable. In part, that’s because many new browser capabilities are created to ease consumer friction and build the browser vendor’s ecosystem. And many of these features are enabled by default.
But these capabilities, while creating conveniences for consumers, can have security, compliance, and privacy implications that are problematic in the enterprise.
Managing the browser is a vital component of many different types of standards, including those from the Center for Internet Security (CIS). CIS benchmarks are often adopted in the following industries:
As mentioned earlier, some browser features can affect overall enterprise security in unforeseen ways, including expanding your attack surface and thwarting data privacy policies. Some elements may require intervention even in cases where the default policies seem appropriate. That’s because if policies are not specifically locked down, websites may query users for access, leaving the choice up to them.
Each enterprise — and each group of users within an enterprise — has its own needs and requirements. There is no such thing as “one-size-fits-all,” and you know better what will work than an outsider. The modern enterprise browser has flexible policy controls and reporting capabilities to ensure users only have access to the websites, applications and features needed to perform their role. Simplified iterations of policies are important, but whether or not to implement recommendations should remain in-house.
Browser Posture Manager
