Secure Browsing Because malware usually doesn’t identify itself

Introduction The threats are known. The vectors are many. It takes many, often overlapping, technologies to protect your company and stay out of the headlines.

Anatomy of a hack If we look at the cyber kill chain/anatomy of a hack, we can see how it happens. Reconnaissance, Weaponization, Delivery, Exploit, Installation, Command & Control, Actions

The Vector One of the more common vectors to “deliver” an attack relies on the internet and the users who browse them. This relies heavily on end user behavior. Whether on purpose or by accident, as in the case of the "drive-by download", when a user is connected to the internet bad things can happen. The sites are very convincing and setup to trap the user.

Current State Many of the current methods to address this vector are based on sigs/defs which need to already 'know' the threat or advanced analytics which tries to understand bad/suspicious behavior. Why is my thermostat talking to Russia? Unfortunately, they are not and truthfully cannot be 100% since the threats are changing as the defenses evolve. Your blacklists\definitions\signatures are pretty much outdated as soon as you deploy them.

What does Secure Browsing actually mean? This brings us to concept of secure browsing. A methodology/technology that leverages the concept of isolation. Since, as we already said, you can never know with 100% certainty if something is safe or harmful, keep it isolated.

Why isolate? Isolation insures that content never reaches your true ‘endpoints’ which is where it needs to run to do what it was designed to do. Compromise an endpoint then compromise your network. Remember, the threat is now coming from inside. Isolation can also be “disposable” and help with any potentially “persistent” threats.

Where to implement it Isolate on the endpoint Isolate off the endpoint

Secure Browsing Basic Flow Remote Browsers Pool Remote Browser File Cleaning Log Configuration Orchestration Management ICAP Server Policy Proxy HTTP/HTTPS Browser (HTML5) Technology Black List White List

In with the new, out with the old? Does this mean you throw out your firewalls, URL filters, antivirus, behavioral analysis tools and security education programs? Not at all. Cybersecurity is best addresses by a layered approach. Belts and suspenders. Defense in depth. Adding Ericom Shield as a layer to your enterprise will go a long way to insuring the malware cannot get in in the first place.

Reach out to us @ Ericom.com and we can show you how Ericom Shield can provide a critical outer layer to your security that can keep threat off your network to begin with.