# Lab SEC-11: Browser Security Inspection

Domain:
- 2.0 Security

Works on:
- Windows
- Linux
- Optional macOS

## Goal

Inspect browser security settings and practice safe browser decisions without deleting important data.

Do not clear saved passwords, reset the browser, remove profiles, or uninstall extensions during this lab unless you intentionally choose to do that outside the lab.

## Part 1: Version and Update Check

Open your main browser and inspect:
- Browser name:
- Browser version:
- Update status:
- Whether automatic updates appear enabled:

Common paths:
- Chrome: Menu > Help > About Google Chrome
- Edge: Menu > Help and feedback > About Microsoft Edge
- Firefox: Menu > Help > About Firefox
- Safari: Apple menu > System Settings > General > Software Update

## Part 2: Extension Review

Inspect installed extensions.

Record:
- Number of installed extensions:
- One extension name:
- Why it is needed:
- Whether its source appears trusted:
- One permission it has, if shown:

Do not remove anything during the lab unless you know the impact.

## Part 3: Privacy and Site Data

Inspect privacy settings.

Record:
- Pop-up blocker status:
- Third-party cookie or tracking protection setting:
- Saved passwords area found:
- Clear browsing data area found:
- Browser sync status:
- Notification permissions area found:

Do not clear saved passwords or reset settings.

## Part 4: Commands

Windows PowerShell:

```powershell
start ms-settings:dateandtime
Get-FileHash "$env:USERPROFILE\Downloads\example.exe"
```

Record:
- Date/time appears correct:
- What happened when checking the example file:

If the example file does not exist, record that. Do not download a random file just for this lab.

Linux:

```bash
date
sha256sum ~/Downloads/example-file
```

Record:
- Date/time output:
- What happened when checking the example file:

If the example file does not exist, record that. Do not download a random file just for this lab.

Optional macOS:

```bash
date
shasum -a 256 ~/Downloads/example-file
open -b com.apple.Safari
```

Record:
- Date/time output:
- What happened when checking the example file:
- Safari opened:

If the example file does not exist, record that. Do not download a random file just for this lab.

## Part 5: Scenario Matching

Choose the best browser security action:

1. A user downloaded a browser installer from an unfamiliar third-party website.
2. A browser warns that a banking site certificate is invalid.
3. A user has 18 extensions and cannot explain why most are installed.
4. A site is broken after a recent update and keeps loading old content.
5. A user thinks private browsing hides activity from the employer network.
6. A company wants browser traffic filtered and logged centrally.
7. A user reuses the same password on many websites.

## What You Should Learn

- Browser installers should come from trusted sources.
- Hashes verify file integrity when a known-good hash is provided.
- Updates patch browser vulnerabilities.
- Extensions are useful but can be dangerous.
- Certificate warnings should be investigated.
- Private browsing protects local session traces, not full network privacy.
- Browser sync and password managers need strong account protection.