Is there any specific and complete guidance on what is needed to harden a web browser given the number of attack vectors possible, particularly given that browsers allow so many varied plugins?

All I have managed to find are bits and pieces of stuff - including basic security settings, but nothing that is well thought out, defensible and complete from an IT Security perspective.

How are IT departments handling this?


1 Answer 1


Check out:

ISAE's Application Security - Browser Guidance

The STIGs contain technical guidance to "lock down" information systems/software that might otherwise be vulnerable to a malicious computer attack.

  • thanks! I am actually very familiar with the STIGs. Is that the extent of guidance for web browsers or do you know of other stuff? Regards.
    – Amzoti
    Jan 16, 2013 at 0:27
  • To be honest what I see from orgs that are concerned about employees catching something bad from Internet browsing is to train those users (more often the high-visibility or high-value individuals) to use throwaway VMs for general Internet browsing. I am guessing that is because it is a cheaper or easier solution. Jan 16, 2013 at 1:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .