Browser Security 101: What Is It And Why It Matters In 2023
By Avihay Cohen, CTO & Co-Founder, Seraphic
Today’s businesses have grown increasingly reliant on browsers as their primary application delivery tool due to increased remote work and bring-your-own-device (BYOD) policies, with the side-effect that browsers are now the main productivity tool for today’s workforce. More widespread browser use has caused a corresponding increase in attack surface, which threat actors find enticing because it enables them to target both individuals and businesses by targeting a single application.
So, how do businesses ensure that these browsers are secure? Major browser vendors like Google, Microsoft, and Apple are constantly patching vulnerabilities in the browsers that organizations rely on, yet enterprises are still turning to browser extensions, encryption services, and a number of other web security tools.
Enter the world of browser security. Browser security encompasses all the tools and platforms that organizations rely on to secure users and business assets operating in web browsers. Here are some important considerations for organizations looking to strengthen their browser security postures.
Rising up
Since the turn of the decade, browsers have hit several vulnerability-related milestones, including Firefox recording its 2,000th total flaw since its creation in 2003. Between Chrome, Firefox and Safari, the number of security vulnerabilities increased year-over-year in 2022 for two of the three top players in the browser market. While Chrome actually experienced a slight decrease in vulnerabilities, the browser’s 283 total flaws more than doubled that of Firefox.
As enterprises’ use of browsers to conduct business expands to more devices in more locations, cybercriminals will capitalize on gaps in protection and leverage both old and new techniques to mount attacks on browsers.
Bridging the patching gap
Most browser vendors release updates (including security patches) at a regular cadence, which gives organizations some measure of risk reduction. A reliable patch management process, after all, is foundational to any effective cybersecurity strategy. That said, a patch does not always mean the end of a vulnerability. In 2022, half of the zero-day vulnerabilities identified as part of Google Project Zero actually targeted flaws that had already been patched by Google (and some had been patched at least twice).
And with the increasing and seemingly endless stream of patches and updates end users and organizations can struggle to keep up. With the right browser security tools, organizations don’t have to upgrade users’ browser immediately when a new vulnerability is discovered, as previous versions can still be used safely. These tools enable browsers to “defend themselves” without necessitating software upgrades or configuration changes. This gives organizations the flexibility to make changes at their own pace and ensure they are prepared by conducting necessary tests before upgrading, without putting undue burden on IT and security teams, or end users.
On my level
A lot of organizations deploy a combination of point solutions for their browser security, including Cloud Access Service Brokers (CASBs), Secure Web Gateways (SWGs), or Endpoint Detection and Response (EDR) tools. While these tools all have the capability to bolster browser security in various ways, their main limitation is that they function outside of the browser. Such point solutions that operate outside of the browser may leave organizations exposed. For example, EDR is designed to secure the endpoints and networks connected to a user’s web browser. This provides defense for the operating system, but not inside of the browser itself since an EDR can only monitor the primary browser processes but it cannot monitor the code the browser executes (such as JavaScript or browser extensions). Solutions that work within the browser itself are ideal for businesses looking to maximize their browser security.
Additionally, today’s users should be able to browse every site, performing their work and personal tasks via their preferred browser, without risk to corporate or personal data. Providing a safe browsing experience both on- and off-premises should be a top priority for enterprises, but organizations will need to investigate and implement new solutions to protect themselves and their users from browser-based attacks, while maintaining a frictionless user experience regardless of which browser they may be using.
So, what now?
As the numbers illustrate, attacks on browser are only likely to increase. Given today’s economic landscape, threat actors are increasingly looking at businesses as a financial opportunity—particularly with the rise of threats like ransomware.
Considerations like patching are important, but recent history shows us that it takes more than the basics to properly secure the browser for enterprise users. The right security strategy for the year ahead accounts for protecting the browser where threats are most likely to occur – on the browser level.