Browser Isolation: An Island of Relief from Attack

Now that many of us are experiencing the downside of isolation as a result of Covid-19, this could be a good time to imagine the benefits isolation can confer.

For instance, suppose you could isolate your web browser from your network while you conducted research. And you knew that your network would be safe, even if some of the links you were clicking on proved the cyber equivalent of landmines. Wouldn’t that be a welcome form of isolation?

If you are nodding your head, you may be interested to know that this form of cybersecurity is not imaginary. It is real and available right now.

Cyberinc offers the Isla Isolation Platform. The description on the company’s website is compelling and sounds like something most companies could benefit from: “What if you could stop breaches before they happen?”

Rajiv Raghunarayan, the company’s senior VP for products and marketing, gave us a briefing on how it works. He also explained why law firms, in particular, should sit up and take notice.

It all starts with the browser. That’s where we’re all most vulnerable. The browser is our gateway to the world, especially as ever more applications move to the cloud. Everything from email, file-sharing, social media, news, business applications and research has now moved to the cloud. This also makes the browser a favorite entry point for attackers.

Browser isolation, Raghunarayan said, is all about disarming the dangers of the internet. What users see when they browse is the same, but the code and content they see in their browsers are transformed into a harmless stream of pixels. Browser isolation applies the concept of Zero Trust to eliminate the browser as an attack surface.

How It Works

There are three components to Cyberinc’s solution, Raghunarayan explained: the end user’s computer, the Isla Server and the Isla Control Center. The client is sitting at her computer. She accesses her browser, as usual, and clicks to visit a website. Instead of directly accessing the website, she is actually accessing the site through the Isla Server—a remote browser that works in conjunction with the local one to deliver a visual stream of web content.

The site looks the same, but she is not communicating with the internet, thus protecting her from inadvertently visiting a nefarious site. Similarly, email links she clicks on also open via the remote browser, to prevent phishing attacks from exfiltrating information or stealing her credentials.

Why is this so important? Because internet browsing constitutes 80 percent of the attack vector where danger lies, Raghunarayan continued. Ransomware, cryptojacking and phishing attacks are all sprung in that environment. But when you’re not really there, then you’re not susceptible to attack.

The Isla Control Center provides a single point of visibility and administration. It functions in two ways, he said. Company administrators can establish rules that will keep employees away from potential danger—or from distraction. They can block web categories like gambling or others that are deemed risky. And they can monitor activity in order to identify risk and foil attacks. For example, the rules can require that all documents downloaded by high-risk users are scanned via a malware scanner or sandbox before they can be accessed.

The Payoffs

The benefits are clear. Rather than scurrying to identify all of the potential dangers out there, and training the workforce how to try to avert them, Cyberinc’s approach segregates work from problems. When an employee clicks on a link that is dangerous, Isla renders the page remotely to ensure that no malware ever reaches the end point. The employee can continue working as she was before, without any exposure. Imagine if that was a ransomware attack, Raghunarayan said, which could have taken hold of her data, shut down the company’s operations or released confidential information to the highest bidder.

Anyone who spends a lot of time browsing the internet doing research can benefit from the Isla platform, such as lawyers, who are also the guardians of important client data. That should make this security solution of special interest to them, Raghunarayan noted.

Not long after our briefing, his words were underscored by the news that Grubman Shire Meiselas & Sacks was hit with a ransomware attack. The New York law firm with A-list stars that include Lady Gaga, Drake, Madonna and Robert De Niro was in a tight spot. Its website was down and the hackers released images of confidential documents. They were threatening to release more if they weren’t swiftly paid.

Splashy headlines aside, browser isolation would seem to be an appealing solution that firms might want to consider. Gartner has predicted a bright future for this technology. Though it’s only achieved about 5 percent market penetration so far, Cyberinc says, Gartner predicts it will reach 25 percent by 2022.

Asked what the marketing challenges have been so far, Raghunarayan said that the technology is not yet well-known. And potential clients sometimes worry that diverting the browser flow will slow computer performance and reduce productivity. But the technology has evolved from the old days of VDI, Raghunarayan said. The new breed of browser isolation solutions does its work with minimal to no impact on the employee experience, he added.

With all the havoc we see daily in the virtual world and the real one, perhaps it’s time to explore the benefits of isolation.

(This blog originally appeared in TAG Cyber Law Journal and is reproduced here with permission. To view the original, visit –https://www.cyberinsecuritynews.com/cyberinc)

David Hechler

Editor-in-chief TAG Cyber Law Journal Guest Blogger on Cybersecurity

Your email address will not be published. Required fields are marked *