Browser security startups insulate users from web-based threats
Companies plug holes through which attackers gain network access
By Byron Acohido, ThirdCertainty
Cyber attackers continue to exploit a significant security gap found in a familiar tool used pervasively in all company networks: the common web browser.
Mozilla Firefox, Google Chrome, Microsoft Explorer and Apple Safari all use an architecture that makes it relatively easy for an attacker to embed malicious code on an employee’s computer—and then use that infected machine as a foothold to probe deeper into the breached network.
Here’s the good news: There is a growing cottage industry of security vendors developing sophisticated technology specifically to plug this gaping exposure. Browser security vendors first appeared on the scene about 2010; leading innovators include Invincea, Bromium, Spikes Security and Menlo Security.
The morphing of browser usage
Mountain View, California-based start-up Authentic8 recently introduced a service called Silo, which isolates web browser malware code from the targeted computer—and the rest of the company network—by routing all employees’ browsing sessions to dedicated servers that it controls.
Authentic8 CEO Scott Petry has a long history helping companies keep intruders out of their networks. Petry founded email-filtering company Postini, which was bought by Google and folded into the search giant in 2007.
Petry, who co-founded Authentic8 with another Postini alum, Ramesh Rajagopal, observes that the arrival of sophisticated browser security tools, like Silo, is a reflection of how web browser usage in corporate settings has morphed over the past couple of decades.
In the 1990s IT departments “would control how you compute, when you compute and what applications you access,” Petry recalls.
Steadily, the web browser “became such a massive focal point or gravity center for how people consumed different web services,” Petry says. “It became extremely compelling for employees to access the web for personal use and for businesses to start taking advantage of the web as a way to perform business functions.”
Amazon pioneered e-commerce and Google got businesses and consumers accustomed to quickly searching for, and pinpointing, desired information. All of this leveraged the browser’s capacity to execute code on individual computers in response to users’ clicks.
“As soon as that happened, business data that IT departments used to control in their environment was suddenly scattered across third-party websites that they didn’t control,” Petry says. Then social media, including Facebook and Twitter, appeared and all bets were off.
Routing malware to silos
“It’s now a mess,” Petry says. “If you think about how the browser is used, it’s a one-size-fits-all solution. People use the same browser with a tab opened to get to Facebook, a tab opened to get to Dropbox and a tab opened to get to wherever. It’s a mix of personal use and business activity, and it’s no wonder that the browser is such a point of vulnerability.”
Venture capitalists are funding tech entrepreneurs coming forward with new systems to lock down browsers, because how we have come to use browsers is not likely to change much, going forward.
“I’m sure at some point we will move away from a monolithic browser,” Petry says. “It might
change over time, but people have been predicting the death of email for 10 or 15 years, and it is still the most common form of business communication. So, no, I don’t think the browser is going anywhere any time soon.”
Authentic8’s Silo product isolates all web code in a secure, remote container in the cloud, giving users a benign display of the web content. Nothing reaches the user’s device except pixels.
“The attack surface area is now ours, and that’s where we deal with it,” Petry says.
Instead of moving browser sessions into isolated servers, Herndon, Virginia-based Ntrepid addresses the problem by inserting a virtual browser into every employee’s computer.
Any malicious code arriving via a web browsing session is isolated from the hard drive or memory of the targeted computer. The machine, in essence, is inoculated against browser malware and cannot be used by the attacker as a beachhead to go deeper into the company’s network.
Web browsers by design execute code over which network administrators have zero control. This code execution enables all of the cool interactive things we can do on our browsers.
Trouble is, criminal hackers can all too easily slip malware into this mix. Like Authentic8’s isolated servers, Ntrepid’s virtual browsers protect the organization from “all web-based attacks, including web-delivered malware, watering hole attacks, spear phishing, passive information leakage and drive-by downloads,” according to Ntrepid.
Ntrepid’s technology, called Passages, enables employees to “safely browse anywhere,” providing them “the freedom to surf online without the risk of infecting their machines or compromising valuable enterprise data.”
To activate Passages, a user simply clicks on it on the desktop instead of Internet Explorer, Firefox or another conventional browser.
Any malware encountered on a website “is trapped” inside Passages’ virtual machine and can’t infect anything else on a user’s computer, says Lance Cottrell, Ntrepid’s chief scientist. The malware is destroyed when the browser session is over.
While browser security technology, for the moment, is being marketed to small and medium-size businesses and large enterprises, Ntrepid and Authentic8 are both developing marketing efforts to serve individual consumers.
“We’re starting off on enterprises—our early adopters—but they are always saying ‘what about my wife, what about my kids, can I get this at home?’” Cottrell says.
Cognizant of a massive data breach last year at the U.S. Office of Personnel Management—when hackers accessed personal information of more than 21.5 million employees, family members and others—Ntrepid is accelerating its marketing efforts to consumers, Cottrell says.
The company is offering every victim of the OPM data breach free access to Passages for a year, he says.
Authentic8 is doing something similar, providing Silo, for free, to all those who were affected by the OPM data breach, as well as the recent Department of Homeland Security hack. Government officials who have been notified that their data has been leaked may use Silo free for a year to help lock down their browser and secure their sensitive information.
ThirdCertainty’s Gary Stoller contributed to this report.
More stories about browser security:
Spikes Security isolates malware, keeps it from hijacking Web browsers
More organizations find security awareness training is becoming a vital security tool
Managed security services help SMBs take aim at security threats