0

How do you know if extensions (e.g., Code, Chrome, Firefox), modules (e.g., PowerShell), or packages (e.g., Python, R) are not malicious? How can you control or monitor that in an environment? Stuff like this get out of hand quickly!

I can only think that strong application whitelisting would control this, or have a security policy for these application extras. (Is there a proper term for that instead of using application extras?)

I'm having trouble finding what Microsoft's stance is for PowerShell modules and the Code Marketplace? How are they making sure that those extras aren't malicious? How is any business making sure those extras aren't malicious?

Improve this question

1 Answer 1

Reset to default
1

The safest way is to vet it yourself by reading the source code before installing and the changes before each update. You can find guides to read each browser's extensions/addons source code here:

As for Visual Studio, you can choose only the extensions which are open source and read their linked repository from their marketplace page.

Regarding security policies, I believe most big companies have a policy for vetting each extension being installed in any service. You'll need an application or infrastructure security team for that.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.