314 lines
7.3 KiB
Markdown
314 lines
7.3 KiB
Markdown
# SEC-11: Browser Security
|
|
|
|
Status: not started
|
|
|
|
Domain:
|
|
- 2.0 Security
|
|
|
|
Objective alignment:
|
|
- 2.11 Browser security
|
|
|
|
## What You Need To Know
|
|
|
|
Browsers are a major security target because users access email, banking, cloud apps, password resets, downloads, and work systems through them.
|
|
|
|
The exam wants you to know how to secure:
|
|
- Browser installation sources
|
|
- Updates and patches
|
|
- Extensions and plug-ins
|
|
- Password storage
|
|
- Certificates and secure connections
|
|
- Pop-ups, ads, cache, cookies, and private browsing
|
|
- Browser sync and proxy settings
|
|
|
|
## Memory Trick
|
|
|
|
Use **D-U-E-C-P**:
|
|
|
|
- **D**ownload from trusted sources
|
|
- **U**pdate the browser
|
|
- **E**xtensions only from trusted stores
|
|
- **C**ertificates must be valid
|
|
- **P**rivacy data can be cleared
|
|
|
|
Shortcut:
|
|
- **Browser trust starts before install and continues with updates.**
|
|
|
|
## Trusted Browser Downloads
|
|
|
|
Safe browser installation:
|
|
- Go directly to the vendor website or official app store.
|
|
- Avoid links in email.
|
|
- Avoid random third-party download sites.
|
|
- Verify downloads with hashes or signatures when provided.
|
|
|
|
Hash verification:
|
|
- A hash is a fingerprint of a file.
|
|
- If the downloaded file hash matches the posted hash, the file likely did not change.
|
|
- If it does not match, do not install it.
|
|
|
|
Exam clue:
|
|
- If a user needs to install a browser safely, choose trusted source and hash/signature verification.
|
|
|
|
## Browser Updates
|
|
|
|
Browsers need frequent updates because browser vulnerabilities are heavily targeted.
|
|
|
|
Updates may come from:
|
|
- The browser itself
|
|
- The operating system update process
|
|
- An enterprise software management tool
|
|
|
|
Best practice:
|
|
- Keep automatic updates enabled when possible.
|
|
- Restart the browser after updates if required.
|
|
|
|
Exam clue:
|
|
- If the browser has security vulnerabilities or degraded behavior from an old version, update it.
|
|
|
|
## Extensions and Plug-ins
|
|
|
|
Extensions add browser features, but they can also steal data.
|
|
|
|
Trusted sources:
|
|
- Official browser extension stores
|
|
- Microsoft Store
|
|
- Chrome Web Store
|
|
- Known vendor websites
|
|
|
|
Untrusted sources:
|
|
- Random websites
|
|
- Email links
|
|
- Pop-up prompts
|
|
- Extensions installed by malware
|
|
|
|
Possible malicious extension behavior:
|
|
- Credential theft
|
|
- Screenshot capture
|
|
- Keylogging
|
|
- Redirecting searches
|
|
- Data exfiltration
|
|
|
|
Best practice:
|
|
- Install only necessary extensions.
|
|
- Remove unused extensions.
|
|
- Review permissions before installing.
|
|
|
|
## Password Managers
|
|
|
|
Password managers store credentials in an encrypted vault.
|
|
|
|
Benefits:
|
|
- Unique passwords for each site
|
|
- Strong generated passwords
|
|
- Easier password hygiene
|
|
- Sync across devices when configured
|
|
|
|
Risk:
|
|
- The vault must be protected with a strong master password.
|
|
- Browser-saved passwords may be less controlled than enterprise password managers.
|
|
|
|
Exam clue:
|
|
- If the issue is password reuse across many websites, use a password manager.
|
|
|
|
## Secure Connections and Certificates
|
|
|
|
HTTPS uses certificates to prove the site identity and protect traffic.
|
|
|
|
Browser certificate warnings may mean:
|
|
- Certificate is expired
|
|
- Certificate is for the wrong domain
|
|
- Certificate is signed by an untrusted authority
|
|
- System date/time is wrong
|
|
- A captive portal or inspection device is interfering
|
|
|
|
Best practice:
|
|
- Do not ignore certificate warnings on sensitive sites.
|
|
- Check certificate details.
|
|
- Check the system date and time.
|
|
|
|
Exam clue:
|
|
- If a browser shows invalid certificate warnings, investigate before entering credentials.
|
|
|
|
## Pop-Up Blockers and Notifications
|
|
|
|
Pop-up blockers stop unwanted browser windows or prompts.
|
|
|
|
Best practice:
|
|
- Keep pop-up blocking enabled.
|
|
- Allow pop-ups only for trusted sites that require them.
|
|
- Disable only temporarily for troubleshooting.
|
|
|
|
Browser notifications:
|
|
- Websites may request permission to send notifications.
|
|
- Malicious or low-quality sites can abuse notification prompts.
|
|
- Disable unwanted site notifications.
|
|
|
|
## Clearing Private Data
|
|
|
|
Browser data can include:
|
|
- History
|
|
- Cookies
|
|
- Cache
|
|
- Download list
|
|
- Saved form data
|
|
- Saved passwords
|
|
|
|
Cache:
|
|
- Stores parts of websites locally.
|
|
- Can speed up browsing.
|
|
- Can cause stale-page or troubleshooting issues.
|
|
|
|
Cookies:
|
|
- Store session and site data.
|
|
- Can keep users signed in.
|
|
- Can also be used for tracking.
|
|
|
|
Best practice:
|
|
- Clear cache/cookies when troubleshooting site problems.
|
|
- Be careful before clearing saved passwords.
|
|
|
|
## Private Browsing Mode
|
|
|
|
Private browsing does not save normal local session history after the window closes.
|
|
|
|
It can remove:
|
|
- Browsing history for that session
|
|
- Download history list
|
|
- Temporary cache/cookies for that private session
|
|
|
|
It does not make you invisible to:
|
|
- Websites
|
|
- Employer/school networks
|
|
- Internet provider
|
|
- Network logging tools
|
|
|
|
Exam clue:
|
|
- Private browsing is local privacy, not full anonymity.
|
|
|
|
## Browser Data Synchronization
|
|
|
|
Browser sync can share data across devices.
|
|
|
|
Synced items may include:
|
|
- Bookmarks
|
|
- History
|
|
- Extensions
|
|
- Passwords
|
|
- Settings
|
|
|
|
Risk:
|
|
- A compromised browser account can expose synced data.
|
|
- Unwanted extensions may appear on multiple devices.
|
|
|
|
Best practice:
|
|
- Protect sync accounts with MFA.
|
|
- Disable sync for sensitive categories if policy requires it.
|
|
|
|
## Ad Blockers and Proxies
|
|
|
|
Ad blockers:
|
|
- Can reduce ads and some malicious ad risks.
|
|
- May break some websites.
|
|
- Should come from trusted extension stores.
|
|
|
|
Proxy:
|
|
- Sits between the browser and the destination site.
|
|
- Can cache content.
|
|
- Can enforce access control.
|
|
- Can filter traffic.
|
|
- Can be configured manually or by policy.
|
|
|
|
Exam clue:
|
|
- If browsing must be filtered or logged centrally, think proxy or content filtering.
|
|
|
|
## Commands To Enter
|
|
|
|
Windows PowerShell:
|
|
|
|
```powershell
|
|
Get-FileHash "$env:USERPROFILE\Downloads\example.exe"
|
|
```
|
|
|
|
What it does:
|
|
- Calculates a hash for a downloaded file.
|
|
- Replace `example.exe` with a real file name only when you intentionally want to check it.
|
|
|
|
```powershell
|
|
start ms-settings:dateandtime
|
|
```
|
|
|
|
What it does:
|
|
- Opens Windows date and time settings.
|
|
- Wrong date/time can cause certificate warnings.
|
|
|
|
```powershell
|
|
start chrome://settings/privacy
|
|
```
|
|
|
|
What it does:
|
|
- Opens Chrome privacy settings if Chrome is installed.
|
|
|
|
Linux:
|
|
|
|
```bash
|
|
sha256sum ~/Downloads/example-file
|
|
```
|
|
|
|
What it does:
|
|
- Calculates a SHA-256 hash for a downloaded file.
|
|
- Replace `example-file` with a real file name only when checking a download.
|
|
|
|
```bash
|
|
date
|
|
```
|
|
|
|
What it does:
|
|
- Shows the system date and time.
|
|
- Incorrect date/time can cause certificate warnings.
|
|
|
|
```bash
|
|
xdg-open chrome://settings/privacy
|
|
```
|
|
|
|
What it does:
|
|
- Attempts to open Chrome privacy settings.
|
|
- Works only if a compatible browser handles the URL.
|
|
|
|
macOS:
|
|
|
|
```bash
|
|
shasum -a 256 ~/Downloads/example-file
|
|
```
|
|
|
|
What it does:
|
|
- Calculates a SHA-256 hash for a downloaded file.
|
|
|
|
```bash
|
|
date
|
|
```
|
|
|
|
What it does:
|
|
- Shows the system date and time.
|
|
|
|
```bash
|
|
open -b com.apple.Safari
|
|
```
|
|
|
|
What it does:
|
|
- Opens Safari.
|
|
- Use Safari Settings to inspect privacy, extensions, passwords, and website permissions.
|
|
|
|
Do not clear saved passwords, remove profiles, or reset browser settings during this section unless you intentionally want those changes.
|
|
|
|
## Quick Checks
|
|
|
|
You should be able to answer:
|
|
- Why download browsers from trusted sources?
|
|
- What does a file hash prove?
|
|
- Why do browser updates matter?
|
|
- Why are extensions risky?
|
|
- What does a certificate warning mean?
|
|
- What does private browsing protect, and what does it not protect?
|
|
- Why protect browser sync with MFA?
|
|
|