Jump to content

Browser isolation: Difference between revisions

From Wikipedia, the free encyclopedia
Content deleted Content added
Comparison to other techniques: Add descriptions and references about why traditional web security approaches can't fully handle 0-day attacks.
Extract "market" descriptions from "mechanism" section to make the topic more clear. Add reports from Transparency Market Research and Market Research Media to the new "market" section.
Line 6: Line 6:
Browser isolation typically leverages [[Virtualization Technology|virtualization]] or containerization technology to isolate the users web browsing activity away from the endpoint device - significantly reducing the [[attack surface]] for rogue links and files. Browser isolation is a way to isolate web browsing hosts and other high-risk behaviors from mission-critical data and infrastructure. Browser isolation is the process by which you physically isolate your users browsing activity away from your local networks and infrastructure, isolating malware and browser based cyber-attacks in the process.<ref>{{Cite news|url=https://webgap.io/blog/what-is-browser-isolation.html|title=What Is Browser Isolation?|last=Bule|first=Guise|date=|work=The Browser Isolation Blog|access-date=2018-03-02|archive-url=|archive-date=|dead-url=|language=en}}</ref>
Browser isolation typically leverages [[Virtualization Technology|virtualization]] or containerization technology to isolate the users web browsing activity away from the endpoint device - significantly reducing the [[attack surface]] for rogue links and files. Browser isolation is a way to isolate web browsing hosts and other high-risk behaviors from mission-critical data and infrastructure. Browser isolation is the process by which you physically isolate your users browsing activity away from your local networks and infrastructure, isolating malware and browser based cyber-attacks in the process.<ref>{{Cite news|url=https://webgap.io/blog/what-is-browser-isolation.html|title=What Is Browser Isolation?|last=Bule|first=Guise|date=|work=The Browser Isolation Blog|access-date=2018-03-02|archive-url=|archive-date=|dead-url=|language=en}}</ref>


==Market==
In 2017, the American research group [[Gartner]] identified remote browser (browser isolation) as one of the top technologies for security.<ref>{{cite web |title=Canvas |url=https://support.kameleo.io/article/canvas/ |accessdate=10 May 2019}}</ref><ref>{{Cite news|url=https://www.gartner.com/newsroom/id/3744917|title=Gartner Identifies the Top Technologies for Security in 2017|access-date=2018-01-28|language=en}}</ref> The same Gartner report also forecast that more than 50% of enterprises would actively begin to isolate their internet browsing to reduce the impact of cyber attacks over the coming three years.
In 2017, the American research group [[Gartner]] identified remote browser (browser isolation) as one of the top technologies for security.<ref>{{cite web |title=Canvas |url=https://support.kameleo.io/article/canvas/ |accessdate=10 May 2019}}</ref><ref>{{Cite news|url=https://www.gartner.com/newsroom/id/3744917|title=Gartner Identifies the Top Technologies for Security in 2017|access-date=2018-01-28|language=en}}</ref> The same Gartner report also forecast that more than 50% of enterprises would actively begin to isolate their internet browsing to reduce the impact of cyber attacks over the coming three years.

Similar research conducted by [[Transparency Market Research]] shows that remote browser market is projected to reach US$5079.8 by the end of 2025; expanding at an exceptional CAGR of 19.6%.<ref>{{Cite web|url=https://www.transparencymarketresearch.com/remote-browser-market.html|title=Remote Browser Market to reach US$5079.8 mn by 2025 {{!}} TMR|website=www.transparencymarketresearch.com|access-date=2019-05-17}}</ref>

By [https://www.marketresearchmedia.com/ Market Research Media], the Browser as a Service (BaaS) market is forecast to reach $10 Billion by 2024, growing at CAGR 30% in the period 2019-2024.<ref>{{Cite web|url=https://www.marketanalysis.com/?p=171|title=Browser as a Service Market Forecast 2019-2024|date=2018-09-12|website=MarketAnalysis.com|language=en-US|access-date=2019-05-17}}</ref>


== Comparison to other techniques ==
== Comparison to other techniques ==

Revision as of 06:37, 17 May 2019

Browser isolation is a cybersecurity model that physically isolates an internet user's browsing activity away from their local networks and infrastructure. Browser isolation technologies approach this model in different ways, but they all seek to achieve the same goal, effective isolation of the web browser and a user's browsing activity as a method of securing web browsers from browser-based security exploits, as well as web-borne threats such as ransomware and other malware.[1]

When a browser isolation technology is delivered to its customers or users as a cloud hosted service, this is known as remote browsing or remote browser isolation (RBI), a model which enables organizations to deploy a browser isolation solution to their users without managing the associated server infrastructure.

Mechanism

Browser isolation typically leverages virtualization or containerization technology to isolate the users web browsing activity away from the endpoint device - significantly reducing the attack surface for rogue links and files. Browser isolation is a way to isolate web browsing hosts and other high-risk behaviors from mission-critical data and infrastructure. Browser isolation is the process by which you physically isolate your users browsing activity away from your local networks and infrastructure, isolating malware and browser based cyber-attacks in the process.[2]

Market

In 2017, the American research group Gartner identified remote browser (browser isolation) as one of the top technologies for security.[3][4] The same Gartner report also forecast that more than 50% of enterprises would actively begin to isolate their internet browsing to reduce the impact of cyber attacks over the coming three years.

Similar research conducted by Transparency Market Research shows that remote browser market is projected to reach US$5079.8 by the end of 2025; expanding at an exceptional CAGR of 19.6%.[5]

By Market Research Media, the Browser as a Service (BaaS) market is forecast to reach $10 Billion by 2024, growing at CAGR 30% in the period 2019-2024.[6]

Comparison to other techniques

Unlike traditional web security approaches such as antivirus software and secure web gateways[7][8], browser isolation does not rely on filtering content based on known threat patterns or signatures.[9] Traditional approaches can't handle 0-day attacks[10][11][12] since the threat patterns are unknown. Rather, browser isolation approach treats all websites and other web content that has not been explicitly whitelisted as untrusted, and isolates them from the local device in a virtual environment such as a container.

Web-based files can be rendered remotely so that end users can access them within the browser, without downloading them. Alternatively, files can be sanitized within the virtual environment, using file cleansing technologies such as Content Disarm & Reconstruction (CDR), allowing for secure file downloads to the user device.[citation needed]

Effectiveness

Typically browser isolation solutions provide their users with 'disposable' (non-persistent) browser environments, once the browsing session is closed or times out, the entire browser environment is reset to a known good state or simply discarded. Any malicious code encountered during that session is thus prevented from reaching the endpoint or persisting within the network, regardless of whether any threat is detected. In this way, browser isolation proactively combats both known, unknown and zero-day threats, effectively complementing other security measures and contributing to a defense-in-depth, layered approach to web security.

History

Browser isolation began as an evolution of the 'security through physical isolation' cybersecurity model and is also known as the air-gap model by security professionals, who have been physically isolating critical networks, users and infrastructures for cybersecurity purposes for decades. Although techniques to breach 'air-gapped' IT systems exist, they typically require physical access or close proximity to the air-gapped system in order to be effective. The use of an air-gap makes infiltration into systems from the public internet extremely difficult, if not impossible without physical access to the system . The first commercial browser isolation platforms[13] were leveraged by the National Nuclear Security Administration at Lawrence Livermore National Laboratory, Los Alamos National Laboratory and Sandia National Laboratories in 2009, when browser isolation platforms based on virtualization were used to deliver non-persistent virtual desktops to thousands of federal government users.

These early projects represented the birth of the modern browser isolation space and became known as Safeweb,[14] to this day thousands of federal government employees refer to the browser isolation platforms that they use to connect to the internet as 'Safeweb'. The name Safeweb was originally[15] coined by Robin Goldstone, project leader at Lawrence Livermore National Laboratory and Guise Bule to describe the platform they still use in 2018 to isolate their users browsing activity.

In June 2018, the Defense Information Systems Agency (DISA) announced a request for information for a "cloud-based internet isolation" solution as part of its endpoint security portfolio. As the RFI puts it, “the service would redirect the act of internet browsing from the end user’s desktop into a remote server, external to the Department of Defense Information Network.” At the time, the RFI was the largest known project for browser isolation, seeking "a cloud based service leveraging concurrent (simultaneous) use licenses at ~60% of the total user base (3.1 Million users)."

On Index.co,[16] the Browser Isolation Vendors directory lists Apozy, Authentic8, Bromium, Ericom, Menlo Security, Randed, Symantec, and WEBGAP. An IDC report, Validating the Known: A Different Approach to Cybersecurity[17] identifies several key RBI vendors: Ericom Software, Inc. (Ericom Shield), Fireglass (recently acquired by Symantec Corporation), Authentic8 (Silo), Cyberinc (Isla), Light Point Security, LLC (Light Point Web Full Isolation Platform), Menlo Security, Inc.[18] (Menlo Security Isolation Platform) and Randed[19] (Randed Isolation Technology - RITech).

Besides those vendors listed on above directories, there are many vendors deliver web isolation mobile apps, software packages, and services: CloudMosa (Puffin[20]), Mentistech (WIT[21]), Crusoe, Appsverse (Photon[22]), Skyfire (Acquired by Opera[23]), and Citrix (Secure Browser[24]).

Compared with other vendors mostly focus on single platform, client device, or few hardware architectures, CloudMosa Inc. has relatively very comprehensive product lines on many diverse platforms based on their browser isolation technologies (Puffin Browser on Android[25] and iOS[26], Puffin Secure Browser on Windows[27] and on macOS[28], Puffin Internet Terminal[29] on Linux, Puffin TV Browser[30] on smart TV, Puffin OS[31] on main stream smart phones. It's also known to work smoothly on resource-limited hardware like Raspberry Pi[29], set-top box[32], TV stick[33], etc).


See also

References

  1. ^ Miller, Daniel. "Cyber Threats Give Rise to New Approach to Web Security". Retrieved 2018-01-23.
  2. ^ Bule, Guise. "What Is Browser Isolation?". The Browser Isolation Blog. Retrieved 2018-03-02. {{cite news}}: Cite has empty unknown parameter: |dead-url= (help)
  3. ^ "Canvas". Retrieved 10 May 2019.
  4. ^ "Gartner Identifies the Top Technologies for Security in 2017". Retrieved 2018-01-28.
  5. ^ "Remote Browser Market to reach US$5079.8 mn by 2025 | TMR". www.transparencymarketresearch.com. Retrieved 2019-05-17.
  6. ^ "Browser as a Service Market Forecast 2019-2024". MarketAnalysis.com. 2018-09-12. Retrieved 2019-05-17.
  7. ^ "secure Web gateway - Gartner IT Glossary". www.gartner.com. Retrieved 2019-05-17.
  8. ^ Inc, Gartner. "Secure Web Gateways Reviews". Gartner. Retrieved 2019-05-17. {{cite web}}: |last= has generic name (help)
  9. ^ "Validating the Known: A Different Approach to Cybersecurity". www.idc.com. Retrieved 2018-04-03.
  10. ^ Goodin, Dan (2016-11-30). "Firefox 0-day in the wild is being used to attack Tor users". Ars Technica. Retrieved 2019-05-17.
  11. ^ "Unpatched Zero-Days in Microsoft Edge and IE Browsers Disclosed Publicly". The Hacker News — Cyber Security and Hacking News Website. Retrieved 2019-05-17.
  12. ^ "Disclosing vulnerabilities to protect users across platforms". Google Online Security Blog. Retrieved 2019-05-17.
  13. ^ "Lawrence Livermore National Laboratory deploy disposable virtual desktops for browser isolation". Retrieved 2018-03-02. {{cite news}}: Cite has empty unknown parameter: |dead-url= (help)
  14. ^ "Safeweb, a cybersecurity model developed in collaboration with the NNSA". Benzinga. Retrieved 2018-03-02.
  15. ^ "Safeweb Browser Isolation Cybersecurity". secjuice™. 2017-11-15. Retrieved 2018-03-02.
  16. ^ "Follow Browser Isolation Cybersecurity Vendors on Index.co". Index.co. Retrieved 2018-02-26.
  17. ^ "Validating the Known: A Different Approach to Cybersecurity". www.idc.com. Retrieved 2018-01-23.
  18. ^ "www.menlosecurity.com - For 100% Secure Browsing, Don't Detect. Isolate".
  19. ^ "www.randed.com - Complete Isolation of your company´s digital environment".
  20. ^ "Puffin Browser - The magic is in the cloud". www.puffin.com. Retrieved 2019-05-17.
  21. ^ "Web Isolation Technology – WIT". Mentis Technologies, LLC. 2017-02-22. Retrieved 2019-05-17.
  22. ^ "Photon Flash Player & Browser - Apps on Google Play". play.google.com. Retrieved 2019-05-17.
  23. ^ Russell, Jon (2013-02-15). "Opera Buys Skyfire for up to $155M". The Next Web. Retrieved 2019-05-17.
  24. ^ "Citrix Secure Browser – Virtual Browser". Citrix.com. Retrieved 2019-05-17.
  25. ^ "Puffin Browser on Android - Spend less, enjoy more". www.puffin.com. Retrieved 2019-05-17.
  26. ^ "Puffin Browser on iOS - It's wicked fast!". www.puffin.com. Retrieved 2019-05-17.
  27. ^ "Puffin Secure Browser - The cloud is the most powerful safeguard". www.puffin.com. Retrieved 2019-05-17.
  28. ^ "Puffin Secure Browser - The cloud is the most powerful safeguard". www.puffin.com. Retrieved 2019-05-17.
  29. ^ a b "Puffin Internet Terminal - Turning a tiny Raspberry Pi into a high-end PC". www.puffin.com. Retrieved 2019-05-17.
  30. ^ "Puffin TV Browser - Born for Excellence". www.puffin.com. Retrieved 2019-05-17.
  31. ^ "Puffin OS - Puffin OS for Smartphones". www.puffin.com. Retrieved 2019-05-17.
  32. ^ Inc, CloudMosa (2019-05-16). "Puffin TV Browser is ranked the best browser for Android TV". Medium. Retrieved 2019-05-17. {{cite web}}: |last= has generic name (help)
  33. ^ Nak 'D Ninja (2019-02-28), Puffin tv browser installed on Firestick, retrieved 2019-05-17