Cyber secure communications system
A communications system for providing secure access to a digital resource of a group of digital resources accessible via the internet, the system comprising: a data processing hub accessible via an IP (internet protocol) address; and a plurality of user equipment (UEs) useable to communicate via the internet, each configured to have a cyber secure isolated environment (CISE) isolated from ambient software in the UE, and comprising a secure web browser (SWB); wherein the hub and CISE are configured so that digital resources in motion and at rest in CISE are visible to the hub.
1. A system comprising:
a user equipment (UE) having thereon ambient software secure isolated environment comprising a secure web browser (SWB), wherein the secure isolated environment the SWB from the ambient software in the UE;
the SWB configured to obtain a security token to access one or more digital resources of an enterprise and configured to monitor and control ingress and egress data with respect to the secure isolated environment, wherein the SWB configured to control the ingress and egress data comprises the SWB configured to enforce one or more security constraints of an enterprise associated with the UE on the ingress and egress data,
wherein the secure isolated environment is configured to run a set of one or more software integrity tests of the SWB according to a testing policy of the enterprise, and wherein the SWB being configured to obtain a security token comprises the SWB being configured to obtain the security token if a sufficient integrity value is determined from the one or more software integrity tests.
2. The system according to claim 1 wherein the secure isolated environment wraps at least one software application to conform with the one or more security constraints which are defined by a security policy of the enterprise.
3. The system according to claim 2 wherein the secure isolated environment comprises at least one secure service application useable by the SWB and the at least one wrapped application.
4. The system according to claim 2 wherein communications between wrapped applications in the secure isolated environment is via a secure encrypted communication channel and communications between the SWB and a wrapped application are via a secure encrypted communication channel.
5. The system according to claim 1 wherein the SWB monitors communications of a user of the UE to acquire data characterizing browsing behavior of the user and websites that the user visits.
6. The system according to claim 1 further comprising a data processing hub having a secure communication channel with the SWB, wherein at least one of the hub and the SWB processes the acquired data to determine normal patterns of interaction of the user with websites that the user accesses.
7. The system according to claim 1 wherein, the secure isolated environment is configured to determine risk of at least one of the ambient software and a user and to determine whether cladding of the SWB is sufficient with respect to the determined risk, and wherein the SWB being configured to obtain the security token comprises the SWB being configured to obtain the security token if the cladding is sufficient.
8. A method comprising: isolating a web browser within a secure isolated environment on a user equipment (UE) from ambient software also on the UE;
authenticating a web browser with an extended identifier;
after authenticating the web browser, running a set of one or more software integrity tests of the web browser according to a testing policy of an enterprise;
determining whether the web browser has a sufficient integrity value from the one or more software integrity tests;
based on successful authentication of the web browser and determining that the web browser has a sufficient integrity value, issuing the web browser a security token to access one or more digital resources of the enterprise; and
after the web browser is issued the security token, the web browser monitoring and controlling ingress and egress data with respect to the secure isolated environment, wherein the web browser controlling the ingress and egress data comprises the web browser enforcing one or more security constraints of the enterprise on the ingress and egress data.
9. The method of claim 8 further comprising the secure isolated environment wrapping at least one software application to conform with the one or more security constraints which are defined by a security policy of the enterprise.
10. The method of claim 8 , wherein authenticating the web browser comprises requesting a data processing hub of the enterprise to authenticate the browser.
11. The method of claim 8 , wherein the extended identifier comprises a browser identifier, a user identifier, and an identifier of the UE.
12. The method of claim 8 , further comprising the web browser acquiring data characterizing browsing behavior of a user and websites that the user visits, while monitoring the ingress and egress data.
13. The method of claim 12 further comprising the web browser processing the acquired data to determine normal behavior patterns or the web browser communicating the acquired data to a data processing hub of the enterprise via a secure communication channel with the web browser and the data processing hub processing the acquired data to determine normal patterns of behavior with respect to the user interaction with website.
14. The method of claim 8 further comprising:
running software environment safety tests on the ambient software;
retrieving a risk profile of a user identified with a user identifier that is part of the extended identifier;
determining risk based on a result of the software environment safety tests and based on the risk profile; and
determining whether cladding of the web browser is sufficient with respect to the determined risk,
wherein issuing the web browser the security token is also based on determining that the cladding is sufficient.
15. The method of claim 14 further comprising amending the cladding after an initial determination that the cladding is insufficient and then determining that the cladding is sufficient after amending the cladding.
16. The method of claim 8 , wherein authenticating the web browser comprises requesting an identity service provider to authenticate the web browser and then, based on successful authentication of the web browser, determining whether the web browser is permitted to access digital resources of the enterprise.
17. The method of claim 8 further comprising retrieving the set of software integrity tests.
18. The method of claim 17 further comprising:
determining a weight for each of the set of software integrity tests, wherein the weights are based on at least one of a type of the UE, true positive rate of the corresponding software integrity test, true negative rate of the corresponding software integrity test, nuisance rating, past performance of the corresponding software integrity test, and a current cybersecurity context,
wherein running the set of one or more software integrity tests on the web browser comprises selecting which of the set of software integrity tests to run based on the weighting.
19. The method of claim 8 , wherein running a set of one or more software integrity tests of the web browser according to a testing policy of an enterprise comprises running the set of software integrity tests based on at least one of frequency of user activity with known malicious websites and time since software integrity of the web browser was tested.
20. The method of claim 8 , wherein the web browser monitoring ingress and egress data comprises the web browser acquiring at least one of data characterizing browser extensions and data indicating access behavior with respect to the digital resources.