Silo Browser Beats Google Chrome, Georgetown Study Finds

Security Without Compromise, Better for Enterprise Productivity

A new study by Georgetown University researchers confirms: Silo, the secure browser delivered as a cloud-based service by Authentic8, provides enterprise users with a higher level of protection against malware threats than Google’s Chrome browser.

*

The tests were conducted at the Security and Software Engineering Research Center at Georgetown University (S2ERC). Their results, now published in the S2ERC Productive Browser Report [PDF], cast a new light on browser security in the enterprise space.

One of the most telling outcomes of the study concerns a fundamental difference between a local browser – in this case, Chrome, often considered the most secure among “regular” browser – and a cloud browser like Silo.

When the S2ERC researchers exposed their testing environment running Chrome to 54 malicious files on the web, the machine running Chrome was infected by eight of them. The infection rate of the computer running Silo? Zero.

In short, approximately 1/7 of the malicious sites accessed with Chrome managed to pass on a dangerous payload to the machine running a local browser, while Authentic8’s cloud-based browser Silo prevented malware downloads in all cases.

For IT security insiders, the results of the Georgetown study hardly come as a surprise. These are the inherent benefits when you combine a remote browser (isolation, performance) with a cloud service (cost, management, control).

A local browser will never be as secure or efficient as a cloud browser. Regular browsers process all content from the web on the local machine, including malicious code that then can spread through the network.

With browser isolation via remote execution as provided by Silo, all web content is processed remotely, in a secure container in the cloud. Only a visual representation of the web – benign pixels – is transmitted back to the user. No malware can touch the local endpoint.

The security advantages of the cloud browser model over local browsers are also highlighted by other findings of the S2ERC Productive Browser Project. The S2ERC researchers conducted a series of rigorous security tests to measure and compare how successfully Silo and Chrome browsers defend against a wide variety of typical malware threats encountered by enterprise users.

Browser Security Test: Authentic8 Silo vs. Google Chrome

Their goal was to determine whether a virtual browser could provide sufficient security against malicious malware threats with minimal impact on the productivity of a typical enterprise end user.

To that end, the project focused on validating security properties hypothesized as a result of isolating the web browser through virtualization technology. The team studied the security capabilities of virtualized, cloud-based browsers in enterprise network environments.

Another distinct difference highlighted by the researchers was how Silo prevented infection of the local environment when downloading files.

While Silo did allow for downloading of 13 malicious files to Authentic8’s isolated cloud environment, it still provided complete protection against direct exposure for the local IT infrastructure. These files stayed in a virtual file system, with no programmatic access to the local system. They never reached the test laptop, nor did they reach the local enterprise network.

Chrome, on the other hand, executes all code locally, so built-in protection needs to be right one hundred percent of the time. When malicious code has already reached the endpoint, it’s too late to take chances.

Chrome relies on either Google’s built-in protection or the computer’s antivirus (AV) software (which often introduces additional risks, according to this research report from Concordia University in Quebec, Canada).

While 36 of the spiked files were blocked by the local machine’s AV tool and four more by Chrome itself, that still allowed those downloaded in Chrome to infect the computer.

“This allows for possible security breaches in an enterprise setting,” the Georgetown researchers concluded when announcing their findings. And: “[T]he ability for viruses to reach the computer posed a serious security threat to the users.”

I couldn’t have said it better.

*