1

The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation.

Employees depend on an open internet for research purposes (adblockers are a no-no), however, I can't allow the possibility of browser-spread malware within the organizational network. Employees must be able to use either their own device or their office workstations and browse the internet freely via our network.

What kind of solution would work best here to isolate the act of browsing from my internal network? browsing via VMs? sandboxing? containers? Has anyone had any experience with implementing such a solution?

2
  • 3
    To sum up: everyone needs to do anything on any device? – schroeder Feb 19 '19 at 12:23
  • How do you enforce sandboxing or VMs on personal devices? – schroeder Feb 19 '19 at 12:31
2

You are ok with the endpoints getting infected, but you don't want the infections to spread. This has been done before in a variety of ways.

Network segmentation:

  • personal devices (uncontrolled devices) do not get access to anything within the network except for the internet
  • if personal devices need access to company resources, they do so from a public portal
  • all internal, controlled devices that can browse the internet can only access certain resources within the network
  • have reinforced network infection detection and rapid response procedures to isolate affected endpoints

I work with a lot of universities and we do this because we do not have control over what everyone does/can do on the network.

Application segmentation:

  • No internet browsing is allowed in any form from any device (blocking ports/protocols on the perimeter)
  • Browsing can only be done through remote desktops/virtual application servers, which are themselves segmented off from the network
  • The remote/virtual environments are rebuilt as soon as the person exits

I have done this at a financial services company. This makes it possible to allow for BYOD, because the user just logs into the remote server if they want to browse. It's an annoying extra step, but far more secure. Virtual application servers can make this far more user-friendly (the desktop icon is a link to a remote virtual sandbox), but only if you have control over the endpoint (not so easy on BYOD).

VMs, sandboxing:

Sandboxing and VMs require that you can enforce those things even on personal devices, which is not going to be easy, and it is easy to have gaps in protection unless you also end up doing one of the above.

0
0

From what you are saying, it seems that you should consider Remote Browser Isolation (RBI) solution with integrated Content Disarm and Reconstruct (CDR).

RBI is a remote virtual browser on which the user’s browsing is executed, safely isolated from his device. This effectively neutralizes any browser borne threat.

To address the threats contained in downloaded files, which requires removing malicious file-embedded code before the file is delivered to the user.

CDR sanitizes files by removing malicious file-embedded code in three phases:

  • Phase 1 – Identify the file type;
  • Phase 2 – Based on each file type’s structural specifications, retain all file elements that irrefutably adhere to that file type’s specifications, and exclude all other file elements
  • Phase 3 – Build a duplicate file with specification-true elements of the original file type; then, deliver the reconstructed, sanitized file to the user

As specification-true file rebuilds, each file type’s original functionality is unaltered and retained in the rebuilt files that are delivered to users. This is effective in preventing exploits based on unknown, zero-day, and known software vulnerabilities as all malicious code is excluded from each file rebuild.

1
  • Sounds interesting, I will check RBI... – Peter_Sw Mar 5 '19 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.