Foglight Administrators DB Performance Monitoring APM vWorkspace Virtualization
This article describes the concept of virtual browser and how it can help mitigate the security threats from Internet browsing. It describes what enterprises should consider before deploying the virtual browser, including how it can be set up and configured. It also discusses the user experience aspect of using a virtual appliance. Please feel free to add to the community knowledge!
Security exposures with Internet browsing continue to be big issues despite improving browser technologies and user awareness. According to Google's web security study one out of 12 sites they've studied contained some form of malware. Web based attacks are also getting more organized and sophisticated, and they not only try to exploit the software holes, but also use clever social engineering tricks. As we all know, humans in front of the computer can be the weakest link. Faced with the continued threat from Internet browsing, businesses and corporations are tightening up their network security, with stricter proxy and firewall rules as well as network quarantine policies. One issue with this fort under siege approach is that freedom of individual is restricted, to the extent in some case to affect productivity. As such, it is becoming a difficult balancing act to ensure corporate information security on one hand, and user productivity on the other.
Virtualization has become a popular word in IT industry recently, but its actually been around for quite a while. It is initially developed to run multiple operating system to run on a single hardware to increase the utilization of valuable mainframe computer, and to serve a broader user base. not surprising that servers are the first adopters of virtualization technology in the X86 computer space, with the same goal of increasing the server hardware utilization. Another attribute of virtualization is isolation (encapsulation), which provides a wall separation between the host operating system and guest operating system (and between multiple guest operating systems). This feature is getting more attention recently as it can be used enhance the client system security. In client systems, desktops and laptops, virtualization layer is normally installed on top of a host operating system (Windows or Linux), and one or more guest operating system is installed on top of the virtualization layer. This model is often referred to as host based virtualization or host-guest or application based (see firgure on the right).
As we look at the issues surrounding malware associated with browsing, and the isolation capability of virtualization, we have good fit for a emerging technology to help with a persistent and widespread problem. By using the web browser that is running on the guest operating system as a "sandbox", where you will do most of your browsing, you can reduce the likelihood of picking up malware on the host operating system. In the event you do pick up some unwanted software, it's easy to restore the guest operating system to a pristine state, without affecting the host operating system.
There are many ways to setup a virtual browser. You can install a full operating system on a virtual machine and use the browser included in the guest OS. This can be Microsoft Windows with built in Internet Explorer, or user installed Firefox browser, or a version of Linux operating system with Firefox browser. Alternately, you can download a virtual appliance specifically designed and optimized for browser. In the following sections, we'll examine various aspect of implementing and deploying the virtual browser.
You don't need a mainframe computer, or even a server class machine to run virtual browser, however, an old PC from five years ago with limited memory is not a good platform choice for visualization either. At a minimum, you should use a system with a dual-core processor. If you plan to run a full version operating system on a VM, you would want to have 2G bytes of system RAM. You can get by with 1G bytes if all you plan to do is to run optimized Virtual Browser appliance. Disk storage is not as much an issues these days, but be aware that virtualization can potentially be a disk hog, especially after you realize how handy it is to be able to run 2nd and maybe 3rd OS on a same machine and start to create many virtual machines. A virtual appliance may need only 1G bytes of storage, but a full operating system with rich set of application can take up just as much space was a real machine, 20~30G bytes or even larger amount of space.
There are many virtualization software for client systems available now for Windows platform (host operating system), and many of them are available for free. For example:
All of these software packages install very easily just like any other software applications. Once it's installed, you can either use a prepackaged or an existing VM, or create your own.
For most users who are used to used to Windows and Internet Explorer, the same OS would be a natural choice to install as the guest OS for the virtual browser. For business users, if you have Microsoft Software Assurance (MSA), you can run up to 4 copies of the same OS in the virtual machine as part of a MSA benefit. However, if do not have MSA or is a consumer, you will need to purchase a copy of Windows to run on a virtual machine. Be sure to review the end user license agreement before purchasing it to make sure that you can live with all the limitations and restrictions of running it in a virtual machine. You can either install an operating system yourself or get a preconfigured operating system with a browser, which is sometimes referred to as a virtual appliance.
If you plan to run virtual browser on a laptop on battery power, you’ll need to be aware that will reduce the overall battery run time of your system. How much it will be reduced will depend on your system configuration and what the type of web browser you visit. As we have more information on this we will make it available here.
Most virtualization software provide you with rich options for virtual machine network configuration. In most cases, you can either connect directly to the host network card at the MAC layer or connect through a virtual NAT router. By specifying which network card the virtual machine will connect to, you can control exactly how the virtual browser is connected to the Internet. For example, you can setup a static IP the virtual browser will use to connect to the Internet, that's is different from the host machine subnet, thereby separating the IP networks of host and guest OS to enhance security.However, if you have a laptop with both wireless network and Ethernet, you may want to use the virtual NAT router, so that VM will see a consistent network interface no matter how you're connected to the Internet.
Since all the state of a virtual machine is stored in a single file (e.g. VHD, VMDK files), it makes it easy to make a backup copy of a virtual machine, and use it to restore the state of the operating system if it gets damaged due to system failure or infected with malware. Making backup copy is easy, but if you try to take many snapshots, it can start to take up a lot of space. If you’re using a more advanced virtualization application, such as VMware Workstation, you can take a snapshot, and a restore point will be created for you without copying the entire VM. If you need to you can go back to any restore point.
Most virtualization application offer the capability to cut and paste between across the host and guest operating system, drag and drop files between the host and guest desktops, or having a file share that is accessible to both host and guest OS. While it’s convenient to have these features, they can also be the paths the malware will use to infect the host from the guest. The best security policy is to not allow any of these transactions by turning these features off. If you must transfer files, one way to limit the possibility of infection is to use a shared folder, and always scan the files you deposit in the folder from the guest OS for malware before you move them to other folders on the host. However, beware that this will not catch every potential malware as no scanning software is perfect and there are new malware created all the time.
If have two monitors connected to your system, you can dedicate one to the virtual browser and maximize it in that monitor. You can then open multiple browser windows within this maximized virtual window.
No matter what guest OS and browser you choose to use as the virtual browser, it’s likely that there will be updates that may be important for you to apply. Depending on how the virtual browser was build, you may be able to apply the updates as they become available from the software provider, or you may need to download a new version of the virtual appliance.
Removing a virtual browser or any virtual machine is really easy for most VM applications. In most cases you can just close the VM and delete its associated folder, and that’s all you’ll need to do. Just like when you are decommissioning a real system, you may want to save any files you may need. However, be aware of the potential for propagating malware when you transfer any file from a VM, and take proper precautions.
It’s important to emphasize here that virtual browser is not just another browsing application. Although it’s running on the same desktop as your other applications, it’s really another computer sharing the same monitor as your “real” computer. If you keep this in mind, it may become clearer as to why it does not behave quite like another browser applications. For example, you can download a file from a web site, but it cannot be used directly with the application from the host computer. This is because the file is stored in a different computer, and this is done to isolate the host computer from potentially harmful content. Once you’ve verified that downloaded file does not contain any malware, and if you need to use it on the host computer, it can be transferred to the host computer using shared folder or other mechanism.Security and convenience are usually trade offs, and by offering a safer way to browse the Internet, we hope to keep the web accessible and useful . We realized that it is not a replacement for the browser on the host OS, and users need to decide how to use these resources.