/ Glossary / What is Zero Trust Network Access (ZTNA)?

What is remote browser isolation?

Remote browser isolation (RBI) is a web security measure used to create a "gap" between a remote user's internet browser and corporate networks. It separates web browsing activity from endpoint devices by redirecting sessions to an isolated environment. This reduces the attack surface, ensuring browser-based cyberthreats don't reach the company's digital resources.

Explore additional browser isolation topics:

Why do companies need browser isolation?

As companies shift to hybrid work models, many employees are using web browsers as a central portal for corporate resources. People use them to share files, log in to SaaS apps, collaborate on content, and more. 

But for all their convenience, those browser windows are also riddled with risks. Cybercriminals are finding all kinds of ways to exploit vulnerabilities in public internet and home networks—the kind that can ultimately allow hackers to access corporate networks. That means a simple browser window can be the gateway to a company's most sensitive data. 

At the same time, the growth of remote workforce policies and bring your own device (BYOD) programs are compounding this problem. With many important applications delivered to these users as SaaS, it's simply a fact of life that employees will have their browsers open while completing critical work. They also browse for personal reasons when taking breaks, checking email, watching videos, or listening to music. The sheer variety of websites an average person visits is vast, and businesses need a solid strategy to defend against the many threats found online. Without remote browser isolation, attackers who succeed in delivering threats via compromised websites or similar methods will have an open path to the corporate network. Even a single successful cyberattack can cause a company severe financial losses and reputation damage. 

By evolving internet browser security, businesses can stop bad actors before a serious exploit makes its way into the company's networks.

How does browser isolation work?

Browser isolation is based on the premise that users need to have full access to the web, but with controls in place to prevent any web-based threats from making their way into company networks. It accomplishes this by creating unique, one-time sessions that let end users log into SaaS applications without their web traffic touching the corporate network.

RBI technology moves browsing sessions to an isolated environment in the cloud. Users can navigate the web and apps as needed to get work done, without exposing the corporate environment to risk. Any threats that may be encountered by visiting malicious websites are isolated from the network. And because isolated browsers are stateless and discarded at the end of each session, there’s no way for malware to reach your corporate infrastructure.

SOLUTION BRIEF

Your journey to ZTNA starts with the Citrix Enterprise Browser

Learn why secure browsing is essential to zero trust security.

Download the solution brief

How does browser isolation counter today's security threats?

Cyber criminals today understand that companies' browsers are the main path through which they can break into corporate systems. Delivering malware and malicious content via email is a classic method, but many businesses already have antivirus software and other countermeasures in place to defend against these. In addition, an email phishing attack could end up ignored for days—if not indefinitely. Delivering malicious code through a compromised website, link, or browser plugin is more direct.

The types of threats users can encounter when browsing the web run the gamut of today's biggest risks. These include:

  • Ransomware: These malicious software kits lock down data or software until users pay a ransom. 
  • Spyware and keyloggers: This type of malware is designed to record user activity, potentially giving attackers access to users' credentials.
  • Backdoor threats: Creating a backdoor is a way for attackers to give themselves access to a company’s network resources and privileged data.
  • Data export tools: Some malware exists to exfiltrate important data directly, giving the attackers access to proprietary information, customer records, employee files, and more.

A traditional approach to keeping these exploits from reaching company networks might involve creating a blacklist of blocked URLs, pushing out patches to browsing software, and manually updating each endpoint. But these methods can’t keep up with the constantly evolving attacks devised by today's cyber criminals. And often, they compromise the user experience.

Browser isolation helps on both those counts: It allows companies to contain attacks and prevent them from penetrating network infrastructure, and it allows users to browse the web as needed.

How does browser isolation work as a compliance tool

Sometimes, web isolation technology is a must for meeting industry regulations. A secure browser can be a relatively easy way to achieve compliance. This is especially relevant for:

  • Government agency offices: Government agencies are often required to keep their internet browsing sessions separate from central network functions, and browser isolation is the easiest way to accomplish this.
  • Retail stores: Devices that process credit cards must not connect to the internet, as mandated by the Payment Card Industry Data Security Standard (PCI-DSS). Connecting remote employees' unmanaged devices with browser isolation is an effective way to create this separation.
  • Financial institutions: Remote contributors to financial institutions can use isolated browsers to perform work in departments such as customer support, marketing, social media communications, and more, while not endangering the heavily regulated corporate networks.
  • Health care, manufacturing, and more: In truth, any organization that maintains privileged information on clients is a good candidate to use browser isolation for traveling or full-time remote employees. Regulators need to verify that IT teams have put adequate protection in place, or else their businesses risk major fines—especially if they have been breached.

Considering today's cybercriminals are focusing on web browsers as a primary attack vector, businesses of every kind should think about what they're doing to cut off this pathway.

Citrix solutions for remote browser isolation

Companies that select an effective approach to access control and digital security now are not just guarding against today's threats, they're also building defenses for tomorrow. Citrix Remote Browser Isolation lets companies provide a full-fledged browsing experience for employees, without exposing the corporate network to cybersecurity risks.