Workstation Security Policies as Code
Overview
The article discusses the security risks associated with browser extensions and how Palantir has implemented a low-friction management system for these extensions across its enterprise. It details the transition from a denylist to an allowlist approach, emphasizing user involvement and automation in managing browser extensions to mitigate risks while maintaining productivity.
What You'll Learn
1
How to implement an allowlist for browser extensions in an enterprise environment
2
Why user involvement is crucial in managing browser extensions
3
How to automate the management of browser extensions using CI/CD tools
Prerequisites & Requirements
- Understanding of browser extension functionalities and risks
- Familiarity with GitHub and CI/CD tools like CircleCI(optional)
- Experience with managing enterprise software policies
Key Questions Answered
What are the risks associated with browser extensions in an enterprise?
Browser extensions can introduce significant security risks if uncontrolled and unmonitored, as they run within browser sessions and can access sensitive information. Malicious extensions can collect user data, monitor activities, and manipulate web traffic. Additionally, benign extensions can become harmful if sold to untrustworthy parties.
How did Palantir transition from a denylist to an allowlist for browser extensions?
Palantir shifted from maintaining a denylist of known bad extensions to creating an allowlist based on user feedback and data analysis. They utilized osquery to identify commonly used extensions and established a process for employees to request new extensions, fostering a collaborative environment.
What automation tools did Palantir use for managing browser extensions?
Palantir implemented CircleCI for automating the validation of extension requests and PowerShell scripts for updating Group Policy settings on Windows machines. This automation allows for quick updates to the extension allowlist with minimal human intervention, enhancing security and efficiency.
How does Palantir ensure the security of approved browser extensions?
Palantir investigates the permissions required by each extension, checks privacy policies, and conducts OSINT searches for any indicators of malicious behavior. This thorough vetting process helps balance productivity benefits against potential security risks.
Technologies & Tools
Some links below are affiliate links. We may earn a commission if you make a purchase.
Data Analysis
Osquery
Used to query and analyze installed browser extensions across the enterprise.
Automation
Circleci
Automates the validation of browser extension requests and checks for compliance.
Scripting
Powershell
Used to update Group Policy settings for browser extensions on Windows endpoints.
Macos Management
Jamf Pro
Used for managing browser extension policies on macOS devices.
Key Actionable Insights
1Implement a user-driven process for managing browser extensions to enhance security and productivity.By allowing employees to request extensions and participate in the approval process, organizations can ensure that necessary tools are available while maintaining oversight of potential security risks.
2Automate the management of browser extensions using CI/CD tools to reduce administrative overhead.Automation can streamline the process of validating and updating extension allowlists, making it easier to maintain security without burdening IT teams with manual tasks.
3Regularly review and update the extension allowlist to adapt to changing security landscapes.As new threats emerge and user needs evolve, it is essential to keep the allowlist current to mitigate risks while supporting productivity.
Common Pitfalls
1
Failing to monitor browser extensions can lead to security vulnerabilities.
Organizations often overlook the risks associated with browser extensions, which can introduce significant security threats if not properly managed. Regular audits and user engagement are essential to mitigate these risks.
2
Over-reliance on denylist approaches can hinder productivity.
Using a denylist can block necessary tools for users, leading to frustration and decreased productivity. Transitioning to an allowlist approach allows for necessary extensions while maintaining security.
Related Concepts
Browser Security Best Practices
Enterprise Software Management
User-driven It Policies
Automation In It Management