Browser isolation protects users from untrusted, potentially malicious websites and web content applications by confining browsing activity to a secured, remote environment.
After reading this article you will be able to:
Copy article link
Browser isolation (also known as remote browsing) is the cyber security approach of separating Internet browsing activity from the process of loading and displaying webpages locally.
Typically, a website visitor loads webpage content and code directly on the browser running on local devices. From a security perspective, this makes Internet browsing fairly risky, as this content and code often comes from unknown sources (e.g. cloud hosting and web servers). However, remote browser isolation (RBI) — the technology underpinning browser isolation — loads and executes web content in the cloud, away from local devices.
Just as machines can be used to monitor hazardous environments to keep humans away from harm, remote browsing “outsources” the detection of hazardous web content. This insulates Internet users (and the networks they connect to) from risky websites that carry malware and other threats.
Business processes no longer take place mostly within an internal corporate network. Instead, employees (whether onsite, fully remote, or hybrid) spend most of their time accessing websites and cloud-based applications such as email to perform their work — and they rely on web browsers to do so.
Browser isolation is an important component of the Zero Trust security model, in which no connection request is inherently trusted by default. In this case, applying that Zero Trust principle to browsing means no website code should be trusted to run on devices by default.
*A zero-day exploit is an attack that uses a vulnerability that has not previously been identified or patched. Though rare, zero-day exploits are nearly impossible to stop.
Remote browser isolation (RBI) technology, also called “cloud-hosted browser isolation, loads webpages and executes any associated code on a cloud server, far removed from users’ local devices and organizations' internal networks. The user's browsing session is deleted when it ends, so any malicious cookies or downloads associated with the session are eliminated.
RBI technology keeps untrusted browser activity as far away as possible from user devices and corporate networks. It commonly does so by conducting a user’s web browsing activities on a cloud server controlled by an RBI vendor. The RBI service then transmits the resulting output to the user's device so that the user can interact with the webpages like normal, but without actually loading the full webpages on their local browser and device. Any user actions, such as mouse clicks, keyboard inputs, or form submissions, are transmitted to the cloud server, where further controls can be applied.
There are three ways a remote browser isolation server can send web content to a user's device:
Common alternatives to RBI include on-premise and client-side browser isolation:
Client-side browser isolation virtualizes browser sessions; unlike remote and on-premise browser isolation, client-side browser isolation does this on the user device itself. It attempts to keep browsing separate from the rest of the device using either virtualization or sandboxing.
Virtualization: Virtualization is the process of dividing a computer into separate virtual machines without physically altering the computer. This is done at a layer of software below the operating system called the "hypervisor." Theoretically, what happens on one virtual machine should not affect adjacent virtual machines, even when they are on the same device. By loading webpages on a separate virtual machine within the user's computer, the rest of the computer remains secure.
Sandboxing: A sandbox is similar to a virtual machine. It is a separate, contained virtual environment where testing can safely take place. Sandboxing is a common malware detection technique: many anti-malware tools open and execute potentially malicious files in a sandbox to see what they do. Some client-side browser isolation products use sandboxes to keep web browsing activity safely contained within the sandbox.
Because client-side browser isolation involves actually loading potentially malicious content on the user device, it still poses a risk to users and networks. Physical separation of harmful code from the device is a core concept of the other types of browser isolation; client-side browser isolation does not have this separation.
By isolating browser sessions in a controlled environment, malicious content and code is kept off user devices and away from the organization's network. For example, a drive-by download attack would have no effect on a user within an organization that uses browser isolation. The download would take place on a remote server or in a sandbox and would be destroyed at the end of the browsing session.
In addition to stopping in-browser attacks, other emerging use cases for RBI include:
A Zero Trust security model assumes that even though a user has safely loaded a website 99 times, the website might be compromised on the 100th time. Browser isolation is one way to implement this assumption in practice.
As part of Cloudflare’s Zero Trust platform, Cloudflare Browser Isolation applies this “never trust” mindset to Internet browsing. Zero Trust browsing insulates users from untrusted web content and protects data in browser interactions from untrusted users and devices.
Cloudflare’s RBI service applies NVR to stream safe draw commands to the device, which ensures compatibility with any webpage in any browser, stops transmissions of malicious web page code, and minimizes latency. Cloudflare Browser Isolation is included in Cloudflare One, a SASE platform that combines network connectivity services with Zero Trust security services on a purpose-built global network.
About Access Management
About Zero Trust
Learning Center Navigation