+APP.1.2 Web Browsers
---+APP.1.2.G1. Execution of Malicious Code by Web Browsers
---+APP.1.2.G2. Exploit Kits
---+APP.1.2.G3. Eavesdropping on Internet Communications
---+APP.1.2.G4. Loss of Integrity in Web Browsers
---+APP.1.2.G5. Loss of Privacy
---+APP.1.2.A1 Use of Basic Security Mechanisms (B)
---+APP.1.2.A2 Support for Secure Communication Encryption (B)
---+APP.1.2.A3 Use of Trusted Certificates (B)
---+APP.1.2.A6 Password Management in Web Browsers (B)
---+APP.1.2.A13 Use of DNS over HTTPS (B)
---+APP.1.2.A7 Data Economy in Web Browsers [User] (S)
---+APP.1.2.A9 Using an Isolated Web Browser Environment (H)
---+APP.1.2.A10 Using the Private Mode [User] (H)
---+APP.1.2.A11 Checking for Malicious Content (H)
---+APP.1.2.A12 Two-Browser Strategy (H)

APP.1.2 Web Browsers

Introduction

Web browsers are application programs that can access (hypertext) documents, images, video, audio, and other data formats on the Internet for processing, viewing, output, and storage on local IT systems. Web browsers can also transmit data to the Internet.

Today, stationary and mobile clients are unthinkable without web browsers because many private and business applications use corresponding content. At the same time, online content is becoming more and more diverse. Most websites use embedded videos, animated elements, and other live content. State-of-the-art web browsers cover a large spectrum of further functions through the integration of plug-ins and external libraries. In addition, there are extensions for certain functions, data formats, and content. However, the complexity of state-of-the-art web browsers also comes with a great deal of potential for serious design errors and technical vulnerabilities. It increases possible risks pertaining not only to attacks from the Internet, but to programming and operating errors, as well.

The risks to data confidentiality and integrity are also significant. Moreover, such vulnerabilities threaten the availability of entire IT systems. As a matter of principle, Internet content must thus be considered untrustworthy from a web browser perspective.

Objective

The objective of this module is to describe security requirements for web browsers used on clients—that is, on stationary and mobile IT systems, including tablets and smartphones.

Scoping and Modelling

APP.1.2 Web Browsers must be applied once to every web browser.

It includes basic security requirements to be considered and met when installing and operating web browsers to access data from the Internet.

Web browsers are some of the most commonly used applications. They access unchecked, potentially malicious data on the Internet and thus provide a gateway for attackers to spread to other parts of operating systems. In order to safeguard operating systems, the requirements of the modules in the layers SYS.2 Desktop Systems and SYS.3.2 Tablets and Smartphones should be met.

Web applications used with browsers, along with the servers that provide such applications, are addressed in the modules APP.3.1 Web Applications and Web Services and APP.3.2 Web Servers.

General requirements for the safe use of software are not covered in this module. These are included in APP.6 General Software, which should be used in addition to this module.

Useful Resources

  • BSI publication on cyber security, BSI-CS 047: “Safeguarding Options When Using Web Browsers”
  • Minimum standard of the BSI for the use of SSL/TLS protocol by federal authorities according to Section 8, subsection 1(1) of BSIG
  • Minimum standard of the BSI for secure web browsers according to Section 8, subsection 1(1) of BSIG
  • Common Criteria Protection Profile for Remote-Controlled Browsers System (ReCoBS): BSI-PP-0040

1. Übersicht

APP.1.2.A1 Use of Basic Security Mechanisms (B)

Any web browser used MUST ensure that every instance and process can only access its own resources (sandboxing). Webpages MUST be isolated from each other in independent processes, or at least in their own threads. Plug-ins and extensions MUST also be executed in isolated areas.

Any web browser used MUST implement the Content Security Policy (CSP). The current highest level of the CSP SHOULD be met.

Browsers MUST support same-origin policy and subresource integrity safeguards.
APP.1.2.A2 Support for Secure Communication Encryption (B)

Web browsers MUST support a secure version of Transport Layer Security (TLS). Connections to web servers MUST be encrypted with TLS whenever this is supported by the web server in question. Insecure versions of TLS SHOULD be deactivated. Web browsers MUST support and implement the HTTP Strict Transport Security (HSTS) security mechanism according to RFC 6797.
APP.1.2.A3 Use of Trusted Certificates (B)

If a web browser provides its own list of trusted root certificates, it MUST be ensured that only administrators can change them. If this is not possible by means of technical safeguards, users MUST be prohibited from changing this list. It MUST also be ensured that web browsers can revoke certificates locally.

Web browsers MUST comprehensively check the validity of server certificates using the public key while taking the respective validity periods into account. Web browsers MUST also verify the lock status of server certificates. The certificate chain, including the root certificate, MUST be verified.

Web browsers MUST indicate to the user in a clear and visible manner whether communication is taking place in plain text or in an encrypted manner. Web browsers SHOULD be able to show the user the server certificate in use upon request. Web browsers MUST alert the user when certificates are missing, invalid, or revoked. In such cases, the web browser in use MUST terminate the connection until the user explicitly confirms it.
APP.1.2.A6 Password Management in Web Browsers (B)

If a password manager is used in a web browser, it MUST create a direct and unique relationship between each webpage and the password stored for it. The stored passwords MUST be encrypted. It MUST be ensured that the passwords stored in the password manager can only be accessed after entering a master password. Furthermore, it MUST be ensured that the authentication for password-protected access is only valid only for the current session.

The IT Operation Department MUST ensure that web browsers allow users to delete stored passwords.
APP.1.2.A13 Use of DNS over HTTPS (B)

An organisation MUST check whether the browsers in use employ DNS-over-HTTPS (DoH). Whether or not the function should be used MUST be specified.

If an organisation uses DNS servers as resolvers that are accessed over untrusted networks, DoH SHOULD be used. If DoH is used, the organisation MUST specify a trusted DoH server.
APP.1.2.A7 Data Economy in Web Browsers [User] (S)

Cookies from third parties SHOULD be refused in web browsers. It SHOULD be possible for users to delete stored cookies.

The auto-complete function for data SHOULD be deactivated. If this function is nevertheless used, the user SHOULD be able to delete the corresponding data. The user SHOULD also be able to delete the web browser's history data.

If available, a web browser's synchronisation with cloud services SHOULD be deactivated. Telemetry functions and the automatic sending of crash reports, URL entries, and search entries to a browser's provider or other external parties SHOULD be disabled whenever possible.

Location sharing and peripheral devices such as microphones or webcams SHOULD only be enabled for websites on which they are absolutely necessary. Browsers SHOULD offer the option to configure and deactivate WebRTC, HSTS, and JavaScript.
APP.1.2.A9 Using an Isolated Web Browser Environment (H)

In case of increased protection needs, web browsers SHOULD be used that run in an isolated environment such as ReCoBS or on dedicated IT systems.
APP.1.2.A10 Using the Private Mode [User] (H)

In case of increased confidentiality requirements, web browsers SHOULD be run in private mode so that no information or content will be stored permanently on the user's IT system. Browsers SHOULD be configured so that local content will be deleted once a browser is closed.
APP.1.2.A11 Checking for Malicious Content (H)

Web browsers SHOULD check the Internet addresses accessed by the user for potentially malicious content. Web browsers SHOULD warn the user if information on malicious content is present. It SHOULD NOT be possible to establish a connection that is classified as malicious. The procedure used for checking MUST NOT infringe on provisions of data protection or the protection of classified information.
APP.1.2.A12 Two-Browser Strategy (H)

If a web browser in use has unresolved security problems, an alternative browser on a different platform SHOULD be installed as a fallback option for the user.

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
includes APP.1.2.G1. Execution of Malicious Code by Web Browsers
includes APP.1.2.G2. Exploit Kits
includes APP.1.2.G3. Eavesdropping on Internet Communications
includes APP.1.2.G4. Loss of Integrity in Web Browsers
includes APP.1.2.G5. Loss of Privacy