Browser Security: Key Threats and Best Practices

As the primary interface between employees and the internet, web browsers play a vital role in the IT ecosystems of modern businesses. Today’s multi-cloud world sees companies and employees continue to adopt SaaS apps that run on thin browser-based clients (or, said a different way, application functions are carried out within a web browser versus a remote server). Employees also use browsers to perform research on the web, browse sites for personal purposes and even log in to internal apps.

Instead of focusing on more general online security threats, this article looks specifically at browser security and how your company might be at risk. You also get some tips and practices to harden your browser security defenses.

Browser Security Concerns

Here are some of the main browser security concerns to be aware of.

Account Hijacking

A coordinated international law enforcement sting that brought down Genesis marketplace in April 2023 thrust the topic of browser security into the spotlight. Here was a website available on both the open web and dark web that enabled fraudsters to essentially buy their way into various online accounts—estimates put the figure at 80 million credentials for sale.

The Genesis marketplace primarily offered browser fingerprints for sale in the form of IP addresses, session cookies, operating system information, auto-filled passwords and plugins. Purchasing these fingerprints and using the market’s special web browser enabled hackers to easily hijack a target’s account and log in to various apps or systems as that target without flagging security systems.

Further exemplifying the role of web browsers in account hijacking, hackers often obtain these browser fingerprints by getting victims to install infostealer malware that covertly steals their browser data. The main methods for tricking people into installing infostealers are browser-based tricks like cloned websites or website ad clicks that install malicious software.

Account hijacking facilitates many kinds of cybersecurity threats to your business, from fraudulent transactions to stolen proprietary data to ransomware.

Shadow IT

Web browsers are a primary source of shadow IT risks. These risks stem from employees using apps or performing actions without explicit organizational approval or oversight. Shadow IT poses significant risks because it is not subject to the same controls and protections as your sanctioned IT apps.

• Unauthorized Browser Extensions and Add-ons: Employees might install extensions and add-ons to their browsers to improve functionality or for convenience, without realizing that these tools could be insecure or could violate company policies. Employees may download extensions from unverified sources that are inherently malicious. Extensions can access browsing data, and in some cases, they can alter the information on websites or even capture sensitive data.
• Personal Websites and Apps: Remote work arrangements increase the likelihood of using the same device for both business and personal internet browsing. Risks occur when there is a crossover between personal and business uses. For example, an employee using a personal cloud storage account for work purposes could cause a data breach incident if their personal account lacks solid security.
• Uncontrolled Software-as-a-Service (SaaS): Web-based SaaS applications are everywhere. Employees use SaaS tools for document sharing, collaboration, project management and much more. A prominent source of shadow IT usage is when employees subscribe and use SaaS apps without IT’s knowledge, resulting in potential data privacy and compliance issues. A recent study estimated that 65% of SaaS apps used by employees are unsanctioned.
• Stolen Data: Increasing volumes of company data are stored in cloud systems that employees access via web browsers. Data theft risks arise when employees download this data from the web onto their personal devices. If someone steals their device or hacks into it from an unsecured public Wi-Fi network, your corporate data is likely to be compromised.

Insecure Browsing Practices

These practices include visiting insecure websites, using personal email or social media accounts on work devices, or downloading files from untrusted sources. Introducing malware into the corporate network or leaking confidential data are just some of the risks.

Furthermore, like any other software application, neglecting to update browsers and plugins provides an obvious attack vector for threat actors to try their luck with.

Hardening Browser Security

To harden your defenses against browser security threats, here are some tips and best practices worth following.

• Consider remote browser isolation: this type of technology hosts users’ web browsing sessions in the cloud rather than on their endpoint devices. This isolation between the device and the internet ensures that browser security threats get contained within the virtual environment rather than spreading directly to someone’s local machine. Latency and compatibility issues are potential drawbacks of this technology, so it’s worth testing potential solutions out with your users and apps to ensure you don’t replace a security issue with a performance one.
• Include browser security in training and awareness programs: make browser security a central theme in your training and awareness programs. Well-informed users help prevent many browser-based security risks. Ensure that training modules teach people to recognize unsecured websites, keep their browsers up to date, know the risks of using personal web services for business purposes, and avoid using unapproved apps or browser extensions.
• Set policies for the use of browser extensions: It’s worth creating a list of approved extensions and prohibiting the use of any that are not on the list. This list should feature prominently within your company’s internet access/usage policy.
• Disable unnecessary features: Features such as autofill and password storage are convenient for your users, but cybercriminals often exploit them. Disabling these features globally is usually a good idea, especially on shared computers or devices used for business.

Nuspire’s Managed Detection and Response

Despite best efforts in hardening browser security, mistakes and breaches can still occur. Maintaining constant vigilance over your IT environment for browser-based threats and other security incidents is vital for detecting incidents and stopping attackers in their tracks. But this is no easy task for overburdened security teams consumed with other tasks, especially given the necessity of 24/7 protection.

Nuspire’s managed detection and response (MDR) service outsources the threat detection and response task to a team of experienced and dedicated security professionals. Our service arms you with protection from new, successful attacks within minutes rather than days. You also get real-time incident validation and clear remediation steps so that your security team receives only information they can act on in the most efficient way.

Learn more about MDR here.