Cybersecurity sometimes calls for an obvious solution. If most attacks on the network come in through the web browser, why not simply disconnect the browser from the network?<\/p>\n\n\n\n
Analysts at Gartner call this \u201cremote browser isolation,\u201d and they say it can reduce cyber risk across the enterprise.<\/p>\n\n\n\n
The Defense Information Systems Agency put out a call to industry in June to determine whether an enterprise cloud-based internet isolation capability would be feasible. Now the agency says it is moving ahead with the idea.<\/p>\n\n\n\n
The threat landscape<\/b><\/p>\n\n\n\n
Defense planners say that they need a fundamentally new approach to cybersecurity because the threat landscape has changed in recent years.<\/p>\n\n\n\n
\u201cThe browser has evolved and become more powerful than what it was years ago. It\u2019s executing thousands of lines of code and bringing a lot of content back to that endpoint,\u201d said Steve Wallace, technical director at DISA\u2019s development and business center.<\/p>\n\n\n\n
Two years ago, the agency started to explore the emerging browser-based threat. It hit upon a new approach that calls for browsing to take place on a commercial cloud, one that is not connected to Defense Department servers. In these cases, the end user will still interact with the internet, but all that will actually get through to the user is an image of the browsing session.<\/p>\n\n\n\n
\u201cThis new technology would move [browsing] traffic at a collection point off of the DoD network and into a secure commercial cloud,\u201d said Angela Landress, DISA\u2019s Cloud-Based Internet Isolation program manager.<\/p>\n\n\n\n
If hackers tried to exploit the browser, \u201call of that potentially malicious code or content wouldn\u2019t touch the DoD network. Instead, it would be contained in the commercial data center, sanitized, inspected there,\u201d she said. \u201cIt presents a much safer way to browse.\u201d<\/p>\n\n\n\n
DISA heard from 45 companies in response to a request for information and planners say this interest is driving an aggressive timeline. An initial prototype implementation to 100,000 users could come this spring, Landress said.<\/p>\n\n\n\n
DISA officials say they don\u2019t yet know whether the agency would award the project to a single vendor or to multiple contractors. \u201cWe\u2019re going through our acquisition strategy right now. It could go either way,\u201d Wallace said.<\/p>\n\n\n\n
Sound strategy?<\/b><\/p>\n\n\n\n
Technology analysts and cyber experts alike generally give high marks to a cloud-based strategy for isolating browsing activity, although some raise questions about how exactly this could be rolled out at scale.<\/p>\n\n\n\n
As a general rule, \u201cit\u2019s good practice to segregate high-risk internet data from operational network,\u201d said George Kamis, chief technology officer for global governments and critical infrastructure at security firm Forcepoint. \u201cThe DoD will certainly increase their security posture by implementing a cloud-based internet isolation solution.\u201d<\/p>\n\n\n\n
In addition to tightening security, the cloud approach also could have an operational impact, making it easier for soldiers in the field to access critical information.<\/p>\n\n\n\n
Processing in the cloud rather than at the tactical edge, expeditionary forces with constrained communications could find their connectivity enhanced. \u201cSending pixels and compressed audio is less of an overall bandwidth requirement,\u201d said Scott Scheferman, the director of global services for security solutions provider Cylance.<\/p>\n\n\n\n
At the same time, experts raise concerns about the possible negative effects of shifting browsing to the commercial cloud.<\/p>\n\n\n\n
\u201cAn isolation browser can impact user experience and usability,\u201d Kamis said. Such tools \u201cgenerally require users to take extra steps to enter and use that environment, and the browser is often restricted and pre-configured. This can impact productivity.\u201d<\/p>\n\n\n\n
Moreover, cloud-isolated browsing could lull users into a false sense of security.<\/p>\n\n\n\n
\u201cObviously browsing is a risk, but the growth area in cyberattacks comes through content downloads and email attachments \u2014 Word attachments, PDFs and video files,\u201d said Sherban Naum, senior vice president at cyber provider Bromium. \u201cThere is value in divorcing your browsing from the internet, but with an email attachment an attacker could still circumvent that entire process.\u201d<\/p>\n\n\n\n
While DISA planners recognize concerns around this emerging cyber strategy, they express confidence that the new architecture could be successfully deployed.<\/p>\n\n\n\n
A simplified approach<\/b><\/p>\n\n\n\n
Cyber strategies are naturally sophisticated: Engineers build up firewalls and other defensive mechanisms; they implement protocols that can slow computing and put in place elaborate security hoops through which end users must jump. DISA is eyeing cloud-based browsing as a way to cut through the clutter.<\/p>\n\n\n\n
\u201cWe\u2019re looking to turn the problem on its head,\u201d Wallace said. \u201cRather than adding more boxes, which adds more latency \u2014 then the users become more and more frustrated with the performance \u2014 we\u2019re looking for a different way to do this.\u201d<\/p>\n\n\n\n
While it\u2019s clear that a browser-based approach will not stop all cyberattacks, DISA is playing the odds here. Some 30 to 70 percent of cyberattacks come through the browser, Wallace said. A single solution that short-circuits those incursions would go a long way toward hardening the network. This approach could even help to curtail so-called phishing attacks \u2014 scams that come to the user via email.<\/p>\n\n\n\n
\u201cTypically, in the phishing attack, it\u2019s embedding a link that sends that user to a given website where they then hit malware,\u201d Wallace said. If such an attack made it through via email, the cloud-based approach would keep it at arm\u2019s length. \u201cThat browsing session will launch out in the cloud. That malware will be executed out there and not on the endpoint or within the DoD networks.\u201d<\/p>\n\n\n\n
A successful pilot program conducted a year ago led DISA officials to believe in the basic viability of this emerging strategy. \u201cWe do know technically that this works,\u201d Wallace said. While he noted the relatively small number of vendors in the space could pose a technical hurdle, others have suggested that DISA\u2019s interest could accelerate the pace of development.<\/p>\n\n\n\n
\u201cWith over 3 million DoD users, the amount of spending is going to be significant and will drive startups to create innovative new offerings,\u201d said Matt Chiodi, the vice president of cloud security at RedLock. \u201cDoD will literally drive the market to create new tech to meet this demand.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
The Defense Information Systems Agency is looking for internet browsing to take place on a commercial cloud and away from Department of Defense servers.<\/p>\n","protected":false},"author":7,"featured_media":54064,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":110,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[110,33],"tags":[],"coauthors":[2081],"class_list":["post-18353","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-cloud-report","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"K7YQUXQLXBFWBBVYCJLU4MWVOA","arc_canonical_url":"\/show-reporter\/disa-forecast-industry\/2018\/11\/05\/when-is-the-network-not-really-the-network-2\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n