Security Tip: 5 tips for better browser security

My intent in this week's column is to review the top ways to harden a web-browsing environment, and not cover the entire breadth of browser security. Moreover, I'm sidestepping the argument about what browser is more secure by suggesting that you look more programmatically at what we can do to protect users regardless of browser choice. So here goes ...

#1. Enable only the browser technologies you need. If you don't need Active X, Java or the like, configure the browser or web gateways to turn them off. If someone must go to WhizBangActiveXsite.com, they can either do so on their own systems at home; you could build a few web-browsing kiosks on a separate network segment, or use something like a Live CD environment for them. Then, users can visit the web sites that they "need" without endangering the organization. However, be careful with doing this for key technologies like Javascript as it may break things that you really need.

#2. Install up-to-date anti-virus and anti-spyware on every system (servers too). I know this is about browser security, but these components are the critical additional layers of defense against browser attacks. Put them on servers, because administrators have been known to browse from a server in "urgent situations". This might be forbidden by policy, but trust me, during penetration tests, we have compromised more than a few servers by the admins surfing to a client exploit site. It happens, so guard against it.

#3. Prevent users from loading arbitrary browser plugins and enhancements. Each new plugin and enhancement brings some form of risk. It could be malware code disguised as a plugin, or it could be a plugin technology that later turns out to be exploitable. I know this seems to minimize the user experience, but minimization is required to secure their working environment. If they want, or "need", to use some plugin - make the decision carefully. Lab test them before you agree to let them in the enterprise.

#4. Keep browsers up to date. Just like the OS, you must keep them patched. Users should be taught how to do this, or it should be automatic. Make sure this happens often enough to really be useful in protecting against threats. Once a month is likely not often enough. Once a week or so, may be more likely to be truly helpful. Test browser versions occasionally and spot check them by log reviewing your web gateways. Help the offenders understand the risk and bring them back into the fold by reinforcing to them how and why their browsers must be up to date. Be vigilant.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine