Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any specific and complete guidance on what is needed to harden a web browser given the number of attack vectors possible, particularly given that browsers allow so many varied plugins?

All I have managed to find are bits and pieces of stuff - including basic security settings, but nothing that is well thought out, defensible and complete from an IT Security perspective.

How are IT departments handling this?


share|improve this question
up vote 2 down vote accepted

Check out:

ISAE's Application Security - Browser Guidance

The STIGs contain technical guidance to "lock down" information systems/software that might otherwise be vulnerable to a malicious computer attack.

share|improve this answer
thanks! I am actually very familiar with the STIGs. Is that the extent of guidance for web browsers or do you know of other stuff? Regards. – Amzoti Jan 16 '13 at 0:27
To be honest what I see from orgs that are concerned about employees catching something bad from Internet browsing is to train those users (more often the high-visibility or high-value individuals) to use throwaway VMs for general Internet browsing. I am guessing that is because it is a cheaper or easier solution. – Tate Hansen Jan 16 '13 at 1:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.