Web browsers shape the digital world as they connect us to information, transactions, and the world with every click, scroll, and search. With 75% of enterprise employees now spending the majority of their device time within web browsers, the need for a renewed focus on browser security has never been more critical. So what are the key trends shaping the landscape for browser security in 2024?

Highly Evasive and Adaptive Threats (HEAT) dominate the landscape

Despite years of technological innovation, cyber threats like Highly Evasive Adaptive Threats (HEAT) persist, exploiting vulnerabilities in web browsers. These threats have proven to be highly effective. They include techniques such as:

• Multi-factor authentication (MFA) bypass
• HTML smuggling
• Malicious password-protected files
• Legacy URL Reputation Evasion (LURE)

Using similarly evasive techniques, SEO poisoning is a type of cyberattack that attempts to exploit SEO algorithms for malicious purposes. It involves the manipulation of website content and code in order to raise its ranking on search engine results pages (SERPs). A recent example of a threat that evaded security tooling was seen in the Ducktail malware campaign. It cleverly hid malware within PDFs, strategically evading detection tools. In this case, cybercriminals strategically evaded detection tools by infiltrating trusted images and links. The scale of these threats demonstrates the need for advanced browser security solutions. Organizations must prioritize advanced browser security solutions to thwart these meticulously crafted and highly successful attacks.

Browser security arrives on every CISO’s roadmap

Security investment vs. effectiveness

Attacks are becoming more successful, even though security measures are still being improved. According to Gartner, worldwide end-user spending on IT security is projected to total $215 billion in 2024, an increase of 14.3% from 2023. Organizations are spending billions of dollars on security tooling, yet security attacks continue to make headlines daily. Despite substantial investment in IT security, highly evasive threats persist. CISOs recognize the danger and are moving quickly, taking care to incorporate browser security into their strategic plans this year.

Enterprise browsers emerge

Established enterprise browsers are joined by replacement browsers.  CISOs must balance browser security solutions with the costs of assessing an altogether new local workspace tool, considering integration challenges and expanded attack surfaces. In a tight economy, Palo Alto Networks acquired Talon for $625M. Island.io has raised $285M. Chromium-based giants like Google Chrome and Microsoft Edge expand and partner with security providers for additional enterprise browser capabilities. 

This dynamic market action reflects the importance of browser security, however CISOs are already grappling with an ever-expanding attack surface. Adding another browser only compounds this issue. Add that to how difficult it can be to ensure seamless integration between your SaaS applications and the enterprise browser. CISO must now face a hefty decision: construct the right browser-security architecture. In 2024, CISOs will seek holistic approaches, exploring solutions that leverage cloud security and recognize the cost and exposure of deploying yet-another-local application.

Holistic approaches

From managing existing browsers to leveraging browser extensions, CISOs must select the best approach to secure their enterprise without introducing unnecessary complexity. 

To secure the browser, CISOs will look to different cloud offerings that go beyond installing a new local application. Cyber teams must consider how they will manage existing enterprise browsers, like Chrome and Edge. They also must manage browser extensions and consider how extensions help or degrade their browser security posture. 

Increasing browser-security capabilities must start to offer more “last-mile” data protections, so that the browser reduces risk instead of just being a local application that is exposed to attacks. Bowser security will emerge as the hot item on every security leader’s agenda. They will need to get ahead of threats fast. CISOs and their teams will be focused on determining which approach reduces risk cost effectively.

Addressing data security in AI adoption

Executive Order impact

The Biden Administration’s Executive Order on Artificial Intelligence signals a regulatory shift. However, the benefits of AI adoption are too attractive to ignore, and the technology is evolving and improving at such a rapid pace – people don’t want to be left out of this exciting trend. In 2024, CISOs will need to lean on strong data security practices rather than solely relying on government regulation to safely but effectively leverage AI. 

AI risks

With risks like optimized attacks and data leakage, CISOs must prioritize data security strategies for AI adoption. Recently, Microsoft briefly blocked employees from using ChatGPT because of security and data concerns.

But given the magnitude of impact AI has and its staying power, in 2024 CISOs will need to prioritize implementing data security strategies for AI. Employees have started using it, whether or not it is technically sanctioned by the organization. Best practices and guidelines are essential to protect corporate data in the AI era.

Increased stakes for CISOs amid incident disclosure rulings

SEC rulings impact

The incident disclosure rulings by the SEC in 2023 intensify the stakes for CISOs in 2024. It was announced that public companies were required to disclose any material breach within four business days of discovering that the incident had material impact. A four-business-day disclosure requirement raises concerns, leading CISOs to seek protective measures.

Protective measures

It’s common knowledge that the full impact of a breach can take months if not years to become known after rigorous investigation. Because of this, in 2024, we will expect an increase in CISOs seeking D&O insurance and personal lawyers to navigate the uncertainties of incident disclosure regulations. 

Incident disclosure regulations may discourage information sharing among CISOs. The security community may witness a shift from open sharing to a more cautious and secretive approach. CISOs will be more likely to keep potentially incriminating details close to the chest, holding off until it seems safe to share.

The Prolonged Era of Remote Work

The work-from-home revolution persists, with a hybrid workforce becoming the norm. According to a recent Pew Research study, 35% of workers who can work remotely are doing so full-time, up from only 7% before the pandemic. Some employees have been gradually working remotely over the years. In January 2022, 43% worked remotely full-time, and in October 2020, it was 55%. However, returning to the way things were before the pandemic is not possible.

Corporate leaders must acknowledge that a full return to pre-pandemic work realities is unlikely. In 2024, securing the digital landscape for remote work takes center stage. Browser security, zero-trust access, and SaaS security are paramount for ensuring productivity in the extended era of remote work.

Next steps in 2024

As we navigate the dynamic landscape of browser security in 2024, organizations must prioritize advanced solutions to counter Highly Evasive Adaptive Threats. CISOs play a crucial role in shaping holistic security strategies, addressing data security in AI adoption, and adapting to increased stakes amid incident disclosure rulings. The prolonged era of remote work underscores the importance of securing digital landscapes for the hybrid workforce.

How is your organization preparing for the rising threats in browser security?

To learn about how Menlo Security cloud based Browser Security prevents phishing and malware attacks on any browser across your hybrid enterprise, see here.

The post Navigating the evolving browser security landscape in 2024 appeared first on Menlo Security.

*** This is a Security Bloggers Network syndicated blog from Menlo Security authored by Devin Ertel. Read the original post at: https://www.menlosecurity.com/blog/navigating-the-evolving-browser-security-landscape-in-2024/