Google Chrome is about as ubiquitous on computers as a water cooler or a coffeemaker are in an office space.
Chrome is also the king elsewhere, unless the systems are Macs, and Safari is the browser of choice. With its minimalist, crisp interface and Google brand, most people are easily satisfied. Even IT Professionals, with too many other things to handle and not enough people to handle them, can also be sometimes lulled into Chrome complacency.
“Google is great for its ease of use, but that very ease can also apply to hackers – whether they be outside or even inside jobs,” says Parker Hodges, an independent cybersecurity consultant in Seattle.
That’s why employees must ensure that passwords don’t get saved in the Google browser. While it may be a convenience for the home user that supersedes the security risks, it’s just not worth it in a business environment. “Someone may innocently use a terminal, but when they poke around and see passwords stored, the temptation to do something bad is there,” Hodges explains.
New security updates from Google
Chrome is not a static product, Hodges points out. People install Chrome on their computers and think it is a set and forget exercise, but it is not. The algorithms and behind-the-scenes ecosystem are constantly in flux, creating openings for bad actors. Recently, Google attempted to tamp down on one discovered opening. They released a security update with an urgent patch on February 14 for Chrome, with the goal of fixing several security issues.
According to Google, “This new Chrome version fixes several security issues, one of which is being exploited actively.” Google did not reveal how widespread the attacks are, but Chrome users are highly encouraged to update to the latest version as soon as possible. The security issue is only found on versions of Chrome earlier than 98.0.4758.102.
“IT Pros and CISOs need to have a regular patching regimen anyway, and vulnerabilities in Chrome should be part of that,” Hodges advises.
A hotspot for security vulnerabilities
Though, most recently, an alert was part of a slew of vulnerabilities discovered. Chrome announced earlier in February that it found 27 issues, eight labels as “high risk”: meaning hackers could exploit to load malware, steal data, or unleash ransomware. The problems could impact Windows, Linux, or Mac users. These issues come on the heels of a number of other Chrome vulnerabilities discovered last fall, making zero-day attacks more likely.
Tech Times says that “the Chrome browser has recently become a hotspot of different vulnerabilities,” in an article that outlines the specific vulnerabilities and their fixes.
Hodges recommends that businesses do an annual “Chrome Audit” to see who is using it as the main browser on their workstations. Once an inventory is made, those Chrome stations should be put on monthly maintenance to fix vulnerabilities and ensure that saved passwords are cleared, and fixes are implemented.
MSPs can help businesses make Chrome a safer place
Another ongoing challenge for business, according to Hodges, is the need to work on improving awareness training. “Even though Chrome is not infallible, it still falls upon the user to make smart decisions and not make it even for a hacker to get hands-on information,” he says.
Other actions businesses can take to make Chrome safer include using Chrome’s Enhanced Protection. Chrome’s default is the standard browsing experience, but businesses can switch to the enhanced protection setting, which offers many more security features such as:
- Blacklisting: If employees visit certain sites prone to problems, then block them.
- Two-Step Verification on Google Accounts: This adds another layer of built-in security. This can be especially valuable when battling internal office threats, says, a rogue employee trying to access a unit that they shouldn’t be.
- Extensions: As part of a Chrome audit and maintenance program, make sure unnecessary and unwanted extensions are removed.
- Script-Blocking: This is a handy feature that will prevent ad-loading and malware-laced video programs from loading.
- Set Chrome to Default: When in doubt, do a full reset to get rid of unwanted extensions.
A combination of actions by the business and better education for end-users is a potent mix. Videos, malware, advertising, streaming, and other potentially threatening elements from outside, can converge to make Chrome a very dangerous place without some basic precautions. Managed Service Providers (MSP) are in a good spot to implement these safeguards for businesses.
“The thing with Chrome is that it is so universal, so widely accepted, that people just get too comfortable. Hackers know that and exploit the comfort,” Hodges concludes.
