For many of us, our first point of contact with the outside world of the internet is a web browser application – a fact that’s known all too well by many an enterprising cyber-criminal. For years, hackers and cyber attackers have been looking for (and finding) weaknesses to exploit in the underlying code, active tool-sets, and associated tools of leading and lower market web browsers.
Whether it’s to hijack the functions or internet connections of a program or simply to spy on or steal the information passing through it, a web browser represents a value target – one made even easier to pick off if the user is careless or ignorant in protecting it from harm. There are several ways to ensure safe and secure browsing habits, and in this article, we’ll be offering some best practices and guidelines for strengthening your browser security.
Disable ActiveX for Better Browser Security
Intended as a means of mediating between Java and Flash interactions (animations, multimedia content, etc.) on certain websites and Microsoft’s Internet Explorer, Edge and third-party browser applications based on the Explorer engine, ActiveX has long been a source of worry to champions of cyber-security. In the wrong hands, ActiveX may readily provide an avenue for malicious software to gain access to your system.
It’s not used very often these days, and any site that asks you to install or activate it should be treated with great caution. You’re safer disabling ActiveX entirely if you use IE, Edge, or related browsers – even if that does mean that you miss out on some content on certain sites.
Block Those Pop-Ups
Pop-up windows are not only distracting and screen space consuming – they can be used as a front (literally) for malicious activities. These might take the form of direct action, where clicking on a pop-up link instantly triggers the download or installation of malware. Alternatively, a link embedded within a pop-up might direct you to a booby-trapped website, where malware might be installed, or your personal and financial data might be harvested.
Pop-up blocking is now a standard option with most browsers, and a function offered by specialist browser extensions. It’s an advisable step to take.
Cut Down on the Cookies
Cookies are little text files deposited in your browser’s cache (a portion of your device storage area) when you visit certain websites.
“First party” cookies are deposited directly by a site you visit, and may contain information such as your username and login credentials which can make it easier for sites to remember you, and quicker for you to log into your accounts next time you visit. This can be a great convenience – but the information contained in those cookies can also be a juicy target for cyber-criminals looking to steal your credentials or financial data for identity theft, outright theft, and fraud.
“Third party” cookies are commonly deposited by external websites or advertisers on a site you visit, to track your activities for marketing or other more sinister purposes.
Cookies can remain stored on your system for weeks or more, unless you initiate or set a specific routine to delete them regularly. Typically, there’ll be settings within your browser with various cookie management and deletion options. It’s up to you how regularly you clean them up – but you’ll need to weigh the convenience of instant login against the risks of having those cookies fall into the wrong hands.
Careful With Those Add-Ons and Extensions
Extensions and add-ons can bring extra functionality to your browser experience, but as with any third-party software, there’s a mixed bag of products and developers out there – some of them with malicious intent.
On a performance basis alone, it’s a good idea to limit the number of add-ons and extensions installed in your browser. You should also restrict your installations to products from reputable sources, and with a proven track record.
Govern Your Downloads
The standard wisdom on downloading software very much applies, so you should only download applications from above-board sources (torrent sites aren’t included in this definition), and from known developers/manufacturers with a reputation to uphold. Read the software description, Terms and Conditions, and any user reviews or comments associated with it.
Downloads also include streaming content such as video and audio – information streams in which it’s possible for cyber-attackers to insert malicious code. Be especially wary of websites that prompt you to install their advertised media players.
Optimize Your Privacy Settings
Securely managing your browser’s privacy settings is a great way to cut off many of the above cyber-risks at the source. Disabling tracking can prevent many websites from following your path across the web – although there are numerous ways around this, for the determined hacker.
Disabling the option to store and save passwords is another good move, while deactivating the “Auto-fill” function can help protect your credentials from the actions of keyloggers. Depending on the browser you use, there may also be options governing the storage and management of cookies, and the running of scripts and content from plugins.
Stay Up to Date
Older versions of operating systems and web browsers may contain vulnerabilities which cyber-attackers can exploit to gain access to systems and information. So keeping your software up to date with the latest versions and security patches is vital to your continued protection.
Updates can be set to run automatically in the background, and if your internet connection is stable and reliable enough, this is the preferred option.
Use a Strong and Safe Password Policy
The rules governing strong passwords always apply: Eight or more characters, with a mix of upper and lowercase letters, numbers, and symbols, renewed on a regular basis.
Using the same password (or obvious variations on a theme) across numerous accounts puts all of them at risk, so use distinctly different ones on each. There are dedicated software password generators and managers that you can use (the standard precautions for downloading and installing third party software apply). And if you have difficulty keeping track of them all, there’s always the analog option of writing them on a piece of paper which you keep locked up in a secure location.
Use Common Sense and Due Diligence
Financial offers or download gifts that sound too good to be true. Account detail confirmations from banks or other institutions that come out of the blue, in email messages littered with spelling errors and weird grammatical compositions. Unusual requests from work colleagues or external organizations.
All of these (and many, many more) are common ruses used in phishing and social engineering ploys to get you to reveal sensitive information, or to visit bogus websites where information may be extracted from you, or malware may be injected into your system.
If it looks too good (or bad) to be true, it probably is. And if a suspect message or document genuinely comes from the person or organization claiming to be the source, then they’ll be able to verify this if you phone or visit them, to confirm.
Use Recognized Security Software
A comprehensive anti-virus and anti-malware suite should be part of your arsenal. It should come from a reputable source, and should be kept regularly updated.
Visit Secure Websites
The Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols ensure the safe and encrypted transmission of data across the internet, and are indicated by the https:// prefix in their web addresses, and a locked padlock icon on your browser window.
Insist on visiting sites that meet these conditions – especially when conducting sensitive transactions. There’s a free browser extension called HTTPS Everywhere that negotiates secure connections with every website you visit.
Set Banking/Financial Alerts
Keep a close eye on your finances, by authorizing your accounts to send text message and/or email alerts each time a transaction occurs. This can be a crucial early warning system in the event that someone else gains unauthorized access to your account credentials and attempts to loot your reserves.
Take Precautions on Public WiFi
If you’re browsing at a free public hotspot, use a Virtual Private Network (VPN) to encrypt your session and isolate it from attack. And try to restrict your online activity to sites that don’t require signing in, or conducting financial transactions.
Share this Post