Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?

Question

I currently work in a manufacturing company with round about 5000 computers and 6000 employees.

We use a lot of web based line of business applications (all internal, non over the Internet) in order to keep the production running, developed by the internal Applications department. Although from the functional aspect they run quite well, their adoption of new releases of the browser stack is very, very slow.

In order to run the programs, they require Internet Explorer as well as the Java plug in. Any new release of any of these two requires them intense testing. Before they confirm, we can’t roll out anything new.

From the security perspective, the current stack is far too old. Right now, we are allowed to install Internet Explorer 8 as well as Java 1.6 U30 (about 9 months old).

Since neither I nor our CISO were able to change these procedures (they got full support for this from the CEO), we would like to implement a “Green” and a “Red” browser.

The idea is to cut of Internet Explorer and the IE Java plugin from the Internet (using rules on the local firewall, the central firewall and/or the central proxy) and installing Google Chrome. Internet Explorer would then be the “Green” browser for anything internal and Chrome the “Red” one for Internet Access.

As Chrome would be used solely used for Internet Access, updating it with a new version and plug ins wouldn’t need any testing from the Application department. This way, we would always have the newest version with the best protection.

Of course, this would require some extra work from our side (Version checks, deployment jobs etc.) but I think the extra benefit for security would outweigh this extra work.

Would this be considered a good solution, or would we open new security issues with it?

Answer 1

Theoretical security is a world of absolutes, but the world we live in is made of compromise. You have to find a good balance between strong security and usability. Your approach pretty much hits the nail on the head.

What you're essentially doing is separation of duties. You have an insecure browser, which is unsuitable for web browsing, but must be used for a particular business purpose. As such, you're creating a second role (filled by Chrome) and separating the duties they have to perform.

The only suggestion I'd give, if it's possible, is to skip the firewall configuration and just unplug the box from the network entirely.

Answer 2

Yes, I think this is an excellent, pragmatic choice. I like the way you think!

One suggestion: you can make the "green" browser (the IE8 in a VM) a site-specific browser, so it is configured to connect only to your internal site. There are multiple ways to do it, but one way to do it is to set up firewall rules in the VM which prevent any network connection to the outside Internet. (Alternatively, it may also be possible to enforce this by configuring the IE browser in the VM.) I think this is a good idea, because it avoids a risk where users accidentally use the "IE8 in a VM" to browse external web sites.