Firewalls are superb at deflecting obvious network attacks. And intrusion detection systems continue to make remarkable advances. So why are network breaches continuing at an unprecedented scale?
One reason is the bad guys are adept at leveraging a work tool we all use intensively every day: the Web browser. Microsoft Explorer, Mozilla Firefox, Google Chrome and Apple Safari by design execute myriad tiny programs over which network administrators have zero control. Most of this code execution occurs with no action required by the user. That's what makes browsers so nifty.
A blessing and a curse
But that architecture is also what makes browsers a godsend for intruders. All a criminal hacker has to do is slip malicious code into the mix of legit browser executable code. And, as bad guys are fully aware, there are endless ways to do that.
Stay informed with a free subscription to SPWNR
The result: The majority of malware seeping into company networks today arrives via infectious code lurking on legit, high-traffic websites. The hackers' game often boils down to luring victims to click to an infected site, or simply just waiting to see who shows up and gets infected.
So if browsers represent a wide open sieve to company networks, could inoculating browsers be something of a security silver bullet? A cadre of security start-ups laser-focused on boosting browser security is testing that notion. The trick, of course, is to do it without undermining usability.
Branden Spikes, Spikes Security founder and CEO
ThirdCertainty recently sat down with one of these security innovators, Branden Spikes, to discuss the progress and promise of improving Web browser security. Spikes left his job as CIO of SpaceX, where he was responsible for securing the browsers of company owner Elon Musk's team of rocket scientists, to launch an eponymous start-up, Spikes Security. (Answers edited for clarity and length.)
3C: The idea of making Web browsing more secure certainly isn’t new.
Spikes: Let me break it down by drawing a line between detection and isolation. Browser security has been attempted with detection for many, many years, and it's proven to not work. McAfee, Symantec, Sophos, Kaspersky and all the anti-virus applications that might run on your computer became Web-aware a while back. They all try to use detection mechanisms to prevent you from going to bad places on the Web.
Then you have detection that takes place at secure Web gateways. Websense, Ironport (now part of Cisco), Blue Coat, Zscaler and numerous Web proxies out there have security features based on the concept of preventing you from going to places that look malicious or that are known to be bad. Well, hackers have figured out how to evade detection, so that battle has been lost.
3C: Okay, so you and other start-ups are waging the browser battle on a different front?
Spikes: When you realize that detection doesn't work, now you have to isolate. You have to say, :You know, I don't trust browsers anymore. Therefore, I'm not going to let my stuff interact with the Web directly." In the past five years, newer products have started to offer browser isolation technology. We've taken a very no-compromise approach to isolation technology.
Free IDT911 white paper: Breach, Privacy, And Cyber Coverages: Fact And Fiction
3C: So instead of detecting and blocking you're isolating, and sort of cleansing, browser interactions?
Spikes: Yes, and much like with detection technology, isolation can exist in either the endpoint or on the network. Some examples of endpoint isolation might be Invincea or Bromium, where you've got your sandboxes that do isolation on the endpoint. I applaud all the efforts out there. It spreads the whole gamut from minimal amount of isolation to sandbox technologies built into browsers. There's quite a bit of investment going into this.
3C: Your approach is to intercept browser activity before it can execute on the worker’s computer.
Spikes: If you come at the problem from the assumption that all Web browsers are fundamentally malware, you can understand our technology. We essentially take the malware off the endpoint entirely, and we isolate the execution of Web pages on a purpose-built appliance. What goes to the end user is a very benign stream of images and sound. There’s really no way for malware to get across that channel.
3C: If browser security gets much better, at least in the workplace, how much will that help?
Spikes: If we successfully solve the browser malware problem, we could, I think, allow for more strategically important things to occur in cybersecurity. We could watch the other entry points that are less obvious. This sort of rampant problem with the browser may have taken some very important attention away from other entry points into the network: physical entry points, social engineering and some of the more dynamic and challenging types of attacks.
