What is a secure browser (enterprise browser)?
- Term
- Secure browser
- Meaning
- A secure browser, which vendors such as Island call an enterprise browser, is a browser your company manages so it can block downloads, printing and copying.
A secure browser is a web browser your company manages, so it can limit what people do in work apps, such as downloading, printing or copying data. In the US, vendors such as Island call it an enterprise browser. The two terms describe the same category.
What does a secure browser do?
The browser is where most work in web apps happens, so it’s where these products put their controls. Island, for example, describes its product as an enterprise browser built for business use, with controls over printing, downloads, screenshots, and copy and paste. Your IT team sets the rules centrally, and they apply whenever someone uses a work app through that browser.
What forms does it come in?
Vendors offer it in two ways. You either install a separate browser, or you add company settings and an extension to the browser people already use.
| Form | Examples (from each vendor’s official pages) |
|---|---|
| A separate browser to install | Island’s browser |
| Your current Chrome or Edge with company settings or an extension | Chrome Enterprise, Microsoft Edge for Business, Island’s browser extension |
Google says Chrome Enterprise Core lets admins apply more than 100 Chrome policies at no additional cost. The paid Chrome Enterprise Premium adds controls over copy and paste, uploads, downloads, printing and screenshots, built into Chrome without extra security software.
Microsoft Edge for Business turns on when someone signs in to Edge with a Microsoft Entra ID account. Entra ID is Microsoft’s company login service. Edge then keeps work and personal browsing in separate windows, and passwords, favorites and other data aren’t shared between them. On personal Windows computers, Microsoft pairs it with app protection policies in Intune, its device and app management service, to protect company data.
Island offers both forms. It says its extension supports most of what the full browser does, except where browser rules for extensions make that impossible.
What should you watch for on personal devices?
NIST SP 800-46 Rev. 2 covers telework and personal devices (bring your own device, or BYOD). It notes that data can end up stored on a device without anyone meaning it to, for example in the web browser’s cache. It also points out that agreements requiring owners to secure their devices generally can’t be enforced automatically. So before you allow a personal device, check what each product leaves behind on it.
The controls work only in that browser or work window. If someone opens the same service in another browser or a phone app, the controls don’t follow. Some products pair the browser with access rules that check who is signing in and from what device, and turn away anything that doesn’t meet your conditions. Chrome Enterprise Premium checks who is signing in, whether the device meets your security settings, and where it is. Edge for Business uses Conditional Access, Microsoft’s sign-in rules, for this on personal Windows computers.
Other ways to handle personal devices are compared in Options for letting staff use personal devices for work systems. Where an extension’s control stops is in What a browser extension can and can’t control in access management.
Frequently asked questions
Is a secure browser the same as an enterprise browser?
They name the same kind of product. US vendors such as Island use "enterprise browser."
Can we keep using Chrome or Edge?
Yes, depending on the product. Chrome Enterprise manages the Chrome you already use, Edge for Business splits work and personal windows, and Island also comes as an extension.
Does a secure browser leave no data on the device?
Not necessarily. NIST SP 800-46 Rev. 2 notes that data can end up on a device without anyone meaning it to, for example in the web browser's cache. Check each product's documentation.
What if someone opens the same service in a phone app?
The browser's controls don't apply there. Some products pair the browser with access rules that turn away sign-ins from users or devices that don't meet your conditions.
How Junify handles this
- Doing this by hand
- Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.
- With Junify
- For a service people sign in to with a shared password, an enterprise browser can't stop someone who knows that password from opening it in another browser or on a phone. With Junify, change the password at setup so only Junify holds it, and people sign in without seeing it. Junify opens the service in an incognito window, which leaves no history or cookies behind once it closes. Your admin can also block downloads per account.
Sources
- Island: The Enterprise Browser (product page)
- Chrome Enterprise: Chrome Enterprise Premium
- Chrome Enterprise and Education Help: Chrome Enterprise Core
- Microsoft Learn: Microsoft Edge for Business
- NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security
-
What's the difference between an audit log and audit evidence?
An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed.
-
What a browser extension can and can't control in access management
An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach.
-
What work data stays on a personal computer, and how to keep it off
History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.