-: Web Browser Security.
Your web browser is your gateway to the Internet
and all of the wonders that it has,
but it's also your gateway to the Internet
and all of the dangers that are out there lurking for you.
This is why web browser security is really important.
And in our organizations,
it's becoming more and more important everyday.
In the old days, when I first got started,
if there was a custom application that need to be built,
a company would hire a software firm
and they would create something
specifically for the Windows operating system
that we could use inside our organization.
Those days are pretty much gone.
Instead, most people are going to use web apps instead,
and this allows us to do quicker deployment
as well as cross-platform functionality
because it'll work on either Linux, Mac, or Windows,
but it does rely on having a good secure web browser,
so it makes this lesson even more important
when your company uses web apps.
So, how do we ensure that our web browser is secure?
The first thing you need to do is ensure your web browser
is always up-to-date with the latest security patches.
If an attacker has found a way to exploit a browser,
you know that the manufacturer is going to figure that out,
create a security patch,
and deploy it out into the environment.
For us, that means we want to get that patch tested
and then install it throughout our network.
But when you're installing these patches,
I want you to remember, I said the patches.
I don't want you to jump on
and be the first to upgrade to a new browser,
instead, let other people upgrade
to the newest browser immediately
while they can figure out
what all the bugs are and the issues,
while you're staying on a nice stable browser.
What do I mean by this?
Well, for example, let's say there was Internet Explorer 11,
and there's all these security bugs in Internet Explorer 11,
there's patches that have been released,
those are good, you want to get those,
test those, and install those in your network.
But if they decide to jump up to version 12,
you want to let that go out for a little while
into the open market first
before deploying that in your organization
because new browsers tend to be a little bit more buggy
and they're not very stable.
So, we want to make sure
that we have something stable and reliable,
and let other people be out on the bleeding edge
with the latest technology.
Now, the next thing we want to look at
is updating our browsers.
Whenever you're going to update your browser,
if you're doing it in a home environment,
you're probably going to be doing this through Windows Update.
You're going to get the latest security patches
and install them on your machine.
But if you're going to be doing this
in an enterprise environment,
you're more likely going to be
downloading that patch separately,
testing it in your lab,
and then deploying it
through your patch management system.
Either way, you do want to make sure that your web browsers
are getting those security fixes though,
they are really important to have.
The other question I get a lot from students
is which web browser should I actually use?
Well, this is a great question.
And a lot of it comes down
to the needs of your organization,
the sites that you're actually using,
and the operating system you're using,
because some browsers are only on certain operating systems.
For example, you can't get Internet Explorer on a Macintosh,
but you also can't get Safari on a Linux machine.
They just don't exist there.
And there's a lot of different browsers out there,
and so it really depends on which one you like best.
Some corporate websites are only made and supported
for a single type of browser.
For example, I worked with one large corporation
where all of their web apps were developed
that they only supported Internet Explorer.
I've worked with other corporations
that don't support Internet Explorer at all,
and instead they have to use something like Firefox.
Whether you're going to use Opera, Firefox, Safari,
Internet Explorer, or Google Chrome really does depend
on the operating system you have and your needs.
If your company is running a Windows environment,
you're probably already going to have
Internet Explorer and Edge installed by default,
but you could install Chrome or Firefox in addition to that
if your company allows.
If you're using a Mac system,
you're going to have Safari by default.
But again you can install Chrome
or Firefox if you like as well.
Personally, I like Chrome.
It's cross-platform,
it works on Windows, Mac, and Linux,
and it allows you to get
a lot of frequent updates and patches to it,
as well as being cross-platform
and a pretty speedy browser.
So, that's just my preference,
but you can use whichever one you like
as long as you configure it properly.
So, with the basics of web browsers covered,
let's talk about the four general actions
that you should start with
to best secure your browser,
whichever browser you decided
to install in your organization.
The first one is to implement good policies.
You want to make sure you're creating
and implementing web browsing policies
as either an administrative or a technical control.
This means that you can have either a handwritten policy
that's an administrative control
or you can have a more technical policy
that's implemented through a configuration file,
a group policy, or other technical means.
It's your organization, after all.
You get to decide what is
and what is not allowed
to be added and loaded
through your web browsers,
not your users.
You can decide to block things
like Flash, ads, content filters,
and all sorts of other things.
Again, it's really up to you.
The second thing is train your users.
User training will prevent
so many issues within your organization.
This might be how to show people how to go to the HTTPS
or secure website for the thing they're browsing to.
It can show them how to close the browser
using keyboard shortcuts
instead of clicking the X on a pop-up,
because sometimes the X you're trying to click
actually does naughty things.
And you can teach them other safe browsing habits.
Again, user training is really important
to the security of your organization.
The third thing you can do to secure your browser
is to use proxy and content filtering.
Proxies will allow you to cache the website
to reduce requests and the bandwidth being used.
So, instead of having to go all the way out to the Internet
to pull a copy of that website,
you'll instead pull it from the local proxy.
The other thing you can do
is enabling yourself a content filter.
Content filters can be used
to blacklist specific websites
or entire categories of websites.
One of the colleges I taught at
had a rule that you couldn't go
to any gambling websites for instance,
which kind of makes sense because at college
you don't need to go and do gambling
when you're trying to learn something.
Your business can do the same thing.
I've been in some organizations
that will block social media
because they want to make sure
their employees are on task and on target
as opposed to going and wasting time at work.
Whatever your decision is,
you can blacklist those specific sites
or entire categories of sites
using a good content filter.
The fourth and final thing you can do
is to prevent malicious code from being loaded.
How do you prevent malicious code from being loaded?
Well, you're going to configure your browser
to prevent ActiveX controls, Java applets,
JavaScript, Flash, and other active content
from being downloaded and run on your machine
through your web browser.
If you do these four things,
you'll be well on your way
to having a more secure browser.