Page 242 - Cyber Defense eMagazine August 2024

credentials. This elaborate journey through trusted domains makes it nearly impossible for traditional
security systems to detect the malicious intent.

Attackers have honed their techniques, exploiting the trust placed in well-known sites like Dropbox and
Google. This sophisticated pathway easily slips through conventional defenses, highlighting the need for
enhanced security measures.

Limitations of Traditional Security Measures

Organizations typically deploy a comprehensive suite of security tools, including email security, firewalls,
DNS filtering, web proxies, endpoint detection and response (EDR), and antivirus (AV) software. While
these tools are foundational, they often depend on threat intelligence feeds listing known malicious
domains. However, phishing attacks leveraging trusted domains can evade these defenses.

For example, while EDR and AV solutions excel at identifying malware, they often miss credential theft
attempts that don’t involve malware. Similarly, email security and DNS filtering might not flag links from
reputable domains, allowing phishing emails to bypass these controls and reach users.

Bridging the Browser Security Gap

Web browsers are the primary interface for internet access, making them a critical target for phishing
attacks. Yet, they frequently represent a significant gap in many organizations' security strategies.
Existing protections like EDR systems, firewalls, and Secure Access Service Edge (SASE) technologies
offer some insight into browser processes and network-level activities but fall short in deciphering the
nuances of in-browser user behavior. Zero-day phishing attacks, overlaps between personal and work
accounts, and the intricacies of file-sharing and productivity applications in the browser remain elusive
threats to legacy solutions, challenging to preempt and mitigate.

Modern browser security solutions analyze web activity directly within the browser, providing real-time
visibility and control over user interactions with web pages. By scrutinizing the characteristics and
behaviors of web pages—such as advanced analysis of site content, web scripts, and the DOM to
understand context and activity risk—these solutions can detect and block malicious activities even if the
domain hasn’t been flagged as dangerous.

Key Use Cases for Browser Security

• Monitoring Domain Age: Domains less than 30 days old might be considered malicious and
automatically blocked or trigger a warning to employees to exercise caution before proceeding.
• Controlling Excessive Permissions: Sites requesting excessive permissions (such as clipboard
access, location, camera, etc.) are automatically blocked to prevent potential abuse.
• Blocking Typosquatting Links: Links that use typosquatting (slight misspellings of legitimate
domains) are identified and blocked to prevent phishing attacks.

Cyber Defense eMagazine – August 2024 Edition 242
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.