Mar 02, 2023The Hacker NewsBrowser Security

As a primary working interface, the browser plays a significant role in today’s corporate environment. The browser is constantly used by employees to access websites, SaaS applications and internal applications, from both managed and unmanaged devices. A new report published by LayerX, a browser security vendor, finds that attackers are exploiting this reality and are targeting it in increasing numbers (download report here).

The key report findings

1. Over half of all the browsers in the enterprise environment are misconfigured. While a configured browser is nearly impossible to compromise, stealing data from misconfigured browsers is like taking candy from a baby. The Leading misconfigurations are improper use of personal browser profiles on work devices (29%), poor patching routine (50%), and the use of corporate browser profiles on unmanaged devices.
2. 3 of every 10 SaaS applications are non-corporate shadow SaaS, and no SaaS discovery/security solution can address its risks. Shadow SaaS, and more than that, shadow identities, are the number one source for enterprise data loss. No existing data security tool (whether it being a traditional DLP or a DSPM) has access or control to what employees can do on their own personal applications.
3. Attackers adopt evasive attack techniques that neither email security nor network security tools can detect. Advanced browser-borne attack techniques, such as the use of SaaS applications to distribute malware or abusing high-reputation sites for phishing, have become a threat commodity.
4. Traditional security tools miss over half of those attack vectors at zero hour, making targeted browser attacks into a leading cause for enterprise breaches.
5. Most browser risks may lead to identity theft. Weak passwords, misconfigurations and SaaS security issues all circulate around the digital identity. This depressing finding outlines a main pain point – the digital identities are still the corporate Achilles heel.

The report also details the top browser security threats of 2022, which include phishing attacks via high reputation domains, malware distribution via file sharing systems, data leakage exploiting personal browser profiles, outdated browsers, compromised passwords, vulnerable unmanaged devices, high-risk extensions, shadow IT, and account takeovers with phishing credentials.

In addition to the stats and analysis of the prominent threats, the report provides a retrospect of the main news stories that left a mark in the world of browser security in 2022. Stories like the first Chrome browser zero-day hack of 2022, the end of Internet Explorer and the infamous Lastpass customer data breach are highlighted.

A New Perspective on Browser Security

The report’s effectiveness and value are twofold, providing readers with knowledge about a rising new security category, browser security, and driving readers to ask themselves whether they are familiar with the risks and trends in the report and if they have protective measures in place to detect and prevent those threats.

The report is able to provide a new perspective on the risk – and opportunity – of browser security. It provides insights into how employees are using browsers and which browser-related vulnerabilities can be exploited, as well as recommendations for dealing with them. This is the result of the report being a combination of original research based on LayerX’s own data points from within its environments alongside their analysis of information that is publicly available.

The report’s recommendations can be used as a reference point when security professionals evaluate their security stack and consider their budgets. As the corporate environment continues to rely heavily on the browser as its primary working interface, it is important to be aware of the risks associated with browser misuse and take measures to protect against these threats.

To get more insights and details about the 2022-3 browser security landscape, read the complete report.