Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

10/23/2018
02:30 PM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

The Browser Is the New Endpoint

Given the role browsers play in accessing enterprise applications and information, it's time to rethink how we classify, manage, and secure them.

Asked to name their critical network endpoints, most IT pros would cite mobile devices, laptops, desktops, and servers. A few might include wearables and other emerging end-user hardware. Browsers, though, probably wouldn't make the list. After all, they're applications that run on the endpoints, not endpoints themselves. But given the valuable role browsers play in accessing enterprise applications and information, it's time to rethink how we classify them and, as a result, how we manage and secure them.

Evolution into an Endpoint
Initially, web browsers accessed data from a web server — HTML documents and images, maybe some video — and rendered it in a single page. As companies placed new demands on the web, browser functionality was supplemented by operating system resources and full-blown applications like Adobe Flash Player and Java.

The supplemental technologies gave browser users a better, more consistent experience that included streaming video and access to offline storage. However, they also gave criminals more vulnerabilities to exploit and more ways to attack the enterprise.

HTML5, the latest version of the HTML standard, goes a long way in addressing the security and other functional challenges posed earlier. Basically, HTML5 eliminates the need for Flash, Java and other add-ons, plug-ins, and third-party software components. Now, everything is handled by the browser itself.

Once Google, Microsoft, Mozilla, and other vendors implemented HTML5 in their browsers, software-as-a-service applications started leveraging HTML5's platform-neutral functionalities in favor of earlier, platform-specific technologies. In addition to a better user experience, HTML5 has fostered an explosion in enterprise-based, rich Internet applications.

HTML5 has also created a thriving ecosystem of browser extensions that improve the experience of Chrome, Firefox, Edge, and other HTML5 browser users. With extensions, users don't install full-blown software components on their devices. Instead, extensions install directly in the browser, typically enhancing the browser interface rather than introducing an additional user interface. In turn, end users can install and use extensions on their own, without IT support.

Browser Endpoint Challenges
With browsers at the center of so much corporate activity, they are now subject to many of the same challenges that face desktops, smartphones, and other hardware-based endpoints.

The first challenge concerns leaking sensitive corporate data. For example, many end users wind up using the same browser — on the same computer — for personal and professional purposes. Personal email, banking, shopping, and other unauthorized applications can compromise sensitive enterprise data as well as personal information. Typically, such applications aren't monitored and don't meet corporate security standards, and data is subject to loss or theft as a result.

Second, the number of surface attacks grows along with the number of browser extensions installed. Those extensions can read all the data exchanged between the device's browser and the back-end server. While users think the extensions are secure, they can leave users and their companies at risk of cryptojacking, ransomware, and other malware attacks that target one computer and then spread to other systems in the corporate network.

Finally, most companies are going to manage a hybrid application environment that combines HTML5 and legacy technologies. Not every enterprise application is going to move to the cloud immediately. Rebuilding and redeploying apps takes a lot of time. For many organizations, both types of applications will be used at the same time. And many organizations will have to manage legacy HTML4 applications.

Managing and Securing the Browser Endpoint
To meet the challenges above, IT teams need to manage their browser endpoints with the same professionalism they use to manage other endpoints. Teams need to manage not only their browsers but also the extensions as well as the plug-ins and add-ons used by older browsers and keep all of those technologies up to date. They need visibility to determine what should be given access to which resources and what should be restricted.

Teams also need to apply critical browser controls and harden browsers. Some vendors offer enterprise editions of their browsers, which include policy engines that govern the applications and extensions they can use, data security and privacy, and browsing experience. To harden the browsers, IT teams need to set bookmarks, the homepage, and trusted websites as well as tweak configurations to increase privacy and security.

Likewise, the activity of browsers and browser extensions needs to be sandboxed to prevent data being leaked to unintended third parties. When the same browser is used to conduct both personal and professional business, the data must be secured and managed to prevent leakage. For instance, users should not be able to download work documents from Office 365 and attach them to an email in their personal Gmail account.

Last, the team needs to allow corporate data access from trusted devices and restrict usage of untrusted devices for corporate purposes. When end users use their personal computers and devices to do company business, there's a good chance their hardware doesn't meet company security standards. Is the computer protected by a strong password? Is it running antivirus software? Have all the software updates and patches been applied? Bottom line, we need to make sure that corporate data is accessed from approved browsers and from trusted devices.

Given its central position in the enterprise, the browser needs to be rethought. It's more than another application. It's the hub of corporate collaboration, communication, and business operations. As such, the browser has evolved into an endpoint and now requires the heightened management and security applied to its hardware-based counterparts.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Rajesh Ranganathan is a Product Manager at ManageEngine, a division of Zoho Corp. In his 17 years with the company, Rajesh has held key roles on several teams, including the endpoint management and security product teams. When he isn't working, you'll find Rajesh watching a ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
CameronRobertson
50%
50%
CameronRobertson,
User Rank: Moderator
10/31/2018 | 10:09:16 PM
Re: Paradox
It is true that users often see things from the surface since that is the platform that we all engage with regularly. However, if we were to be required to tackle an issue, it should be from the root of the problem. Disruptions that are prevented from the top might still be processing at the base which becomes dangerous.
UdyRegan
50%
50%
UdyRegan,
User Rank: Apprentice
10/28/2018 | 11:57:54 PM
Re: Paradox
it's interesting to think about just how much thought and planning goes into a little application on your computer isn't it! I really wouldn't think so much every time I open up a Chrome or Firefox window that there's so much coding and communication behind it actually! That said, I reckon that we need to slow down and think very carefully about that impact on our lives like you've said and see just how important it is to secure that application properly too!
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
10/23/2018 | 4:15:11 PM
Paradox
Interesting points, but, alas, a fundamental paradox exists in the enterprise on this subject:

- Secure browsing

- Ban on Tor usage

Pick one.
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...