-: In this demonstration,
I'm going to show you
how we can configure our web browser more securely.
I'm going to show you this in two different ways.
First, is how an end user or a home user might do it,
and secondly, we'll do it through the group policy editor.
And that's how you may do it
if you're doing it in a large organization.
First, I'm going to show you
how an end user is going to secure their web browser.
For this example, I'm going to use Internet Explorer version 11
which comes on Windows 10, by default.
You can use whichever browser you like,
but the options will be a little bit different.
Whichever browser you're using, you're going to find
either three dots or a gear icon,
that'll bring you up to the tools menu.
You then want to go into your settings.
For Internet Explorer, it's going to be the Internet options.
Next, you want to go and verify what your homepage is set at.
I like to keep mine at Google
or it might be your corporate website.
But you want to make sure
it hasn't been changed to something nefarious
Next, you want to also look
at how your browser history is set up.
Do you want it to delete your browser history on exit
to keep your privacy secure?
And, if you look at your settings,
you can see how often those pages are cached
and how much disk space is being used for that.
We also can see what objects have been downloaded.
In this case, there are none
because it's a brand new installation.
Next, we'll go ahead and close that
and we will go through and tell it that, every time I leave,
I want it to delete my browsing history.
The next thing we want to look at is our security tab.
And here is where we have our different security zones.
Right now, I'm set to Internet,
which means it has a medium to high level of trust.
Now, if I go to my local intranet,
this should have a very high level of trust
because we control the intranet.
Next, we have our trusted sites.
These are sites that we trust
and we may allow them to actually
download active controls and other things like that.
Then, we have our restricted sites,
things that we want to have a high caution rate with
and we don't trust them at all.
You can actually add sites to these
by going through sites program here
and adding those sites to the list.
Next, we will look at our privacy tab.
This is where you're going to find information
about sites and cookies and pop-ups.
Notice the pop-up blocker is turned on right now,
but if I needed to, I could allow through certain sites.
For instance, I might say
that my website is allowed to have pop-ups
because that's how we do our payrolling
or something of that nature.
And we can go ahead and click close on that.
And we also can allow private extensions to be run.
If we look at our settings here,
do we accept third-party cookies and first-party cookies?
That's going to be a determination we want.
Generally, we're going to block third-party cookies
and we would prompt on our first-party cookies.
Next, we'll look at our content.
This would be what Digital Certificates
we currently have established.
And we also can make sure
we have our autocomplete settings,
based again on your privacy,
you may want to turn off all of your autocomplete settings
so nothing is stored from your information
When we look at our connections,
if you're going to have a proxy server set up,
you're going to go to LAN settings
and you're going to use your proxy server here,
whatever that proxy address is for your corporation,
for instance, it might be proxy 8080.
Again, this depends on your organization.
And then, you can see your programs
and which associated programs you're going to have,
as well as your advanced setting
where there are a ton of different options.
Some of the big ones you want to look at is that
you want to turn off SSL Version 3 and TLS 1.0.
Those are both older protocols
that are not nearly as secure as the newer 1.1 or 1.2.
So, we'll leave those enabled.
You may also want to see what else needs to be taken away,
what warnings do you want,
what things do you want to block?
Do you want to allow active content to be run?
Generally, you don't.
Do you want to have encrypted pages saved to the disk?
Those type of questions.
Again, this is going to depend on
how you want to configure your system completely.
But from the end user's perspective,
this is generally where they're going to go
to make all of the settings for their browser.
Now, as a corporation, though,
we're usually going to push this out through a group policy.
To do that, we would use Gpedit,
which is the group policy editor,
and then, under the administrative templates,
under Windows Components and then Internet Explorer
or whichever browser you're using.
Now, once I get here to Internet Explorer,
you will see that we have a long list of things
that we can turn on and turn off
For example,
Do we want to turn off ActiveX opt-in prompts?
This would mean that it's going to
right now, it's turned off,
which means that that prompt will show up
and give the user the ability
to accept or reject ActiveX controls.
That's a poor security practice.
So instead, we would want to go ahead and turn that on,
which means that it will block ActiveX
from running and not ask the user.
Again, as you go through the different settings,
each one will tell you what it has to do with.
We're not going to spend the time
to go through each one individually here.
But for example,
if I want to know about turning on ActiveX filtering,
if you double click it,
it will tell you what the policy is used for
and then you can make an intelligent decision
on whether you're going to enable it or disable it,
based on those things.
Once you save this, you can save it as a policy
and push it out across your domain
using your active domain controller.