As I wrote many times, I work in integrator company. Part of the job is that new technology land on my desk on regular basis. As example, few years ago it was SD-WAN, now common things Then it was cloud-delivered firewall. Then ZTNA. Now it’s managed browser turn.
Another new technology
Managed browser, sometimes called enterprise browser, is basically Chromium-based browser with policy engine attached to it — controlled centrally, same way you control endpoint or firewall. Nothing exotic on the surface. It’s still a browser, opens tabs, renders pages.
First question which came to my min, why would I pay for a browser when I have Chrome or other browsers for free?Paying for something that on the surface does exactly the same thing sounds like a hard sell. Well, there are reasons, turns out there is few good ones, and none of them is about the browser looking nicer.
First – Network security needs decryption to work
Firewall, IPS, DLP on network layer — all of it depends on seeing the traffic in clear text. Encrypted stream that firewall can’t decrypt is basically a black box passing through. Great job filtering, as long as it can actually see what’s inside. Decryption isn’t easy to deploy In theory, sure, just decrypt everything on the firewall. In practice it’s not only operational headache — certificate pinning breaks apps, performance cost on the box is real, users complain the moment something loads slow or throws certificate warning. There is legal side too, and in bigger corporation this is often the part that actually blocks the project, not the technical one. Decrypting traffic means inspecting content of what employee is doing, and it’s not something IT can just switch on. Legal department needs to be involved, policy needs to be written and communicated upfront. I’ve seen decryption project sit on lawyers’ desk for months, while the technical part was ready in a week. End result — most organizations end up with decryption bypassed for large chunk of traffic, partly for technical reasons, partly because legal never signed off.
Second – We have no idea what’s inside the browser
Even where decryption works fine, it inspects traffic on the wire. It says nothing about what’s installed inside the browser itself. Extensions, in particular. We manage the OS, we manage EDR, we manage the network — extension store is wide open, anyone installs anything. And there is a lot of malicious extensions out there. Stanford researchers counted around 280 million users who installed extension that turned out to be malicious. One of the caseses I like to mention: paid extension, certified, even promoted by Google as “featured” — and it was quietly stealing data and redirecting traffic. Badge of trust didn’t help at all.
Third: MFA bypass
MFA authenticates the login event — it confirms who you are at the moment you sign in, once for a given time. What keeps you logged in afterward is session cookie, a token the browser attaches to every request from that point on. If cookie can be read — malicious extension with broad permissions, infostealer malware, etc — it can be copied out and replayed from completely different machine. This is Pass-the-Cookie, see example below – Login to O365, MFA prompt. Then PowerShell script pulls session cookies and encryption keys from the browser’s storage. Cookies come out encrypted, so next step is decrypting them on Kali box. Once decrypted, I just load the cookie into Firefox using an extension, and session comes back — logged in as the user, no password, no MFA prompt.
So, is there a point in reducing this attack surface?
Given everything above — decryption that doesn’t cover everything, extensions nobody watches, sessions that survive MFA — yes, there is clear point. Not because current stack is bad, but because browser became the place where user actually works, and none of the classic controls were built with that in mind.
Prisma Access Browser
This is the product I demoed. Palo Alto’s Prisma Access Browser sits exactly on this gap — extension visibility and control down to permission level, session tied to the managed instance so a copied cookie doesn’t work elsewhere, and file/URL inspection happening int the browser without need of decryption.
To summarize
Ask yourself few simple questions. Do you actually know how many extensions are installed across your organization? Do you know what’s really running inside the browser? And, honestly — are your firewalls as effective as you think? See next post about more details regarding managed browser.