JumpCloud’s Universal Chrome Browser Patch Management

Browsers are the gateway to online productivity. 

Without them, we would not be able to get work done. To that end, they are also one of the biggest attack targets for bad actors. If we are not careful, and do not make a conscious effort to upkeep web browser security, hackers can easily exploit browser vulnerabilities. 

What makes browsers especially appealing to these individuals? Browsers access, collect, and hold lots of sensitive data — from personal credentials to company information — that cyber hackers can sell on the dark web and use to blackmail companies.

According to Atlas VPN, Google Chrome, the world’s most popular browser, has the highest number of reported (303) vulnerabilities year to date. Google Chrome also has a total of 3,159 cumulative vulnerabilities since its public release. 

In this article, we’ll dive into the topic of browser vulnerabilities, the importance of patch management, and how to streamline protection.

A Closer Look at Google Chrome’s Latest Vulnerabilities

On November 8, 2022, the Center for Internet Security (CIS) reported finding multiple vulnerabilities in Google Chrome. 

The most severe vulnerability within this group could potentially allow for arbitrary code execution in the context of the logged on user. What does that mean? 

Depending on a user’s privileges, an attacker could install programs and view, change, or delete data. The bad actor could even create new accounts with full user rights! 

Of course, users whose accounts have minimal user rights on the system would be less impacted than those with administrative user rights.

Multi-OS systems were affected, including:

• Google Chrome versions prior to 107.0.5304.110 for Mac
• Google Chrome versions prior to 107.0.5304.110 for Linux
• Google Chrome versions prior to 107.0.5304.106/.107 for Windows

First and foremost, CIS recommends applying appropriate updates provided by Google to vulnerable systems immediately after appropriate testing. See here for all the other CIS recommended actions. 

The Need for Browser Patching 

Here are the key reasons you should regularly update or patch your browsers:

• Enhance Security: Prevention of spyware, malware, and other viruses that could give someone access to your data or trick you into handing it over.

• Improve Functionality: Outdated browsers might not work (well) or support new apps or software.

• Boost User Experience: Older browsers usually do not support the latest and greatest code and will have trouble loading component files in the website. This might cause a website to freeze, crash or take forever to work.

For IT admins, security aspects are probably the most important reason to patch browsers. Keeping browsers updated with the latest version (i.e., downloading and installing all provided patches) goes a long way toward preventing cyber attacks and bad actors from exploiting known vulnerabilities. 

How to Create Default Chrome Browser Patch Policies

One of the easiest ways to stay on top of patches, and reduce browser vulnerability risk, is to use the JumpCloud Directory Platform. 

The latest capability addition to our Patch Management solution provides a universal policy to keep Google Chrome up to date for macOS, Windows, and Linux. 

A universal policy saves time by automatically scheduling and enforcing Chrome security patches on a large number of managed devices.

The platform’s four universal preconfigured default Chrome browser patch policies allow admins to deploy browser updates with different levels of urgency. Admins also have the option to configure a custom universal policy; this feature allows for easy modification of existing policy settings to tailor update experiences to organizational needs. 

The four JumpCloud default Chrome browser patch management policies control how and when a Chrome update is applied. The recommended deployment strategies include:

• Day Zero: Deploy automated upgrades inside your IT Department the first day an update is available.
• Early Adoption: Deploy automated upgrades to early adopters outside of IT.
• General Adoption: Deploy automated upgrades to general users in your company.
• Late Adoption: Deploy automated upgrades to remaining users in your company.

Once you have created a Chrome browser patch policy, you can assign it to any devices, policy groups, or device groups. A policy group helps quickly and efficiently roll out existing policies to large numbers of similar devices. 

Capabilities of JumpCloud Browser Patch Management

JumpCloud’s new Browser Patch Management also introduces the following features:

• Enforce Chrome updates and browser relaunch. 
• Enforce or disable Chrome Browser Sign In Settings.
• Restrict sign-in to a regex pattern to ensure users sign in via company email accounts.
• Automate device enrollment into Google Chrome Browser Cloud Management, which unlocks limitless capabilities for browser and extension control within the Google Admin console. 

Dive deeper into the new Universal Chrome Browser Patch Management Release by exploring the release notes for this feature in the JumpCloud Community. 

Learn More About JumpCloud

The good news? Browser patching and patch management are included in JumpCloud’s affordable A La Carte pricing package. 

Try JumpCloud for free for up to 10 devices and 10 users. 

Complimentary support is available 24×7 within the first 10 days of account creation.

Remote desktop protocol (RDP) is a proprietary communication protocol initially built by Microsoft. It allows two computers to exchange a graphical user interface (GUI) via transmission control protocol (TCP)/internet protocol (IP). RDP is an extension of the T.120 point-to-point (P2P) communication protocols that are standardized by the International Telecommunications Union (ITU). 

There are three primary use cases for RDP. Firstly, IT admins can use this protocol to remotely perform administrative tasks, such as PC tuneups, ID protection settings, software installations, computer troubleshooting, and printer setups. By using RDP, IT teams can easily maintain and diagnose problems that individual employees are encountering from afar. 

Secondly, employees can leverage RDP to access their workstations remotely. For example, they could access enterprise resources while working from home or traveling. Thirdly, RDP is also helpful for “headless computers” or thin clients that employees may want to leverage to access powerful workstations in the office. 

How Remote Desktop Protocol Works

RDP is a secure protocol that furnishes the user on one computer with a GUI that they can use to connect to another PC over TCP/IP network directly. For this to work, the user originating the request must have an RDP client application installed on their computer. Similarly, the PC the user is trying to access must be running an RDP server software, allowing the client to connect remotely. 

Once linked, the user can now see the desktop of the PC to which they have connected through RDP to access applications and files on that desktop. All current Windows operating systems (OSs), including Windows Server and desktop versions, come with a built-in RDP server that provides remote desktop connection capabilities. 

However, the RDP client software is only available to Windows Pro and higher versions. For example, Windows Home users must upgrade their OSs to Windows Pro or higher versions to use remote desktop connection (RDC) services. 

RDC is one of the three client components of Microsoft’s Remote Desktop Services (RDS). It enables remote client PCs — powered by RDP — to connect with Windows-based platforms. The two other client components of Microsoft’s RDS are Fast User Switching and Windows Remote Assistance. Aside from RDCs, RDP clients are available for Unix, Linux, macOS, Android, and iOS. 

By default, RDP-based communications are established over TCP port 3389, or if the remote desktop gateway is used, the connections are made over TCP port 443. When a user connects to a remote PC, the RDP client redirects the mouse and keyboard events to the remote server. RDP uses its own on-screen mouse and keyboard driver on the remote server to receive these input events from RDC clients. 

To help render the user’s actions, RDP uses its own graphics driver to construct the display output into TCP/IP packets that are then redirected to the RDC client. On the client’s side, the RDC client receives the rendered data and translates it into corresponding graphics device interface (GDI) application programming interface (API) calls. 

As a multi-channel platform, RDP uses separate virtual channels for device communication, presentation data, and encrypted input events between the RDP client and server. RDP’s virtual channel ecosystem is extensible and can support up to 6,400 disparate channels for data connections and multipoint transmissions. 

Pros and Cons of RDP

Below are some advantages that organizations and users can derive from RDP:

• Easy access to enterprise resources. Employees can easily connect to their workstations from anywhere in the world. The protocol eliminates the need for employees to travel with flash drives. 
• Streamlined IT management. IT teams can manage every aspect of the enterprise’s network in real time from one location. For example, they can edit the permissions to individual users or groups within the organization through RDC. 
• Cost savings. Using RDP for RDC can help an organization save on hardware and ongoing maintenance costs. Employees can use their personal devices under the bring-your-own-device (BYOD) framework for work-related activities. 

Despite the advantages, RDP has its own disadvantages. Below are a few of them:

• Internet connectivity. You need reliable internet connectivity for a client PC to connect successfully to a remote machine. Otherwise, the entire RDC will break down.
• Security vulnerabilities. Although RDP-based sessions have inbuilt data encryption, access control, and activity logging capabilities, the protocol has inherent weaknesses that hackers can exploit and compromise the network. Let’s discuss some of these risks in more detail in the next section. 

RDP Security Risks 

RDP is the foundation for many remote access solutions within Windows-based environments. As such, it has become one of the most popular targets for hackers. Below are three common RDP security risks that hackers can exploit:

Weak Authentication

Most users rely on passwords to protect their workstations. They often reuse the same password across different systems, including RDP logins. If the password is weak, any hacker can attempt a brute force attack through techniques such as credential stuffing or rainbow table attack to gain access to the enterprise network. To mitigate these attacks, organizations can use single sign-on (SSO), multi-factor authentication (MFA), and adhere to password management best practices.

Unrestricted Port Access

By default, RDP connections take place on TCP port 3389. If this port is left open, an attacker can easily carry out on-path attacks and compromise the network. To protect against port-based attacks, you’ll need to lock down port 3389 and implement firewall rules. 

Unpatched Vulnerabilities

Microsoft has already provided and continues to provide OS updates and hotfixes for some of the most severe RDP vulnerabilities. Still, some of these vulnerabilities can cause damage, especially when left unpatched. 

For example, “BlueKeep”—a wormable attack that allows hackers to execute arbitrary codes on a remote PC—can cause damage to the organization if the OS is not patched. To mitigate against these vulnerabilities, you can leverage patch management tools to ensure their OS and applications are up to date. 

RDP Alternative

It’s no longer a secret that the shift to hybrid workplaces is having severe security implications for most modern organizations. To succeed in such environments, companies must ensure remote access solutions like mobile device management (MDM) tools are secure and fit into the organization’s budget. 

JumpCloud Remote Assist is a low-cost, easy-to-use, and secure remote access solution. IT admins can leverage the tool to connect to end users’ Windows, macOS, and Linux endpoints and fix technical issues from an intuitive cloud-based console. 

When used in an organization, JumpCloud Remote Assist allows IT admins to streamline access to organization resources. For example, they can easily customize, provision, and manage new security policies that better suit evolving workflows from a single place. 

Remote Assist will be a FREE add-on for organizations already using the JumpCloud Directory Platform^® to manage Windows, macOS, and Linux endpoints. 

Similar to MacOS and Windows systems, securing Linux devices is paramount to ensure critical and sensitive data is safe from outside threats. 

While many developers view Linux’s wide range of distribution and configuration options as desirable, the operating system (OS) presents a real challenge to IT admins. Those seeking to centrally monitor and secure Linux endpoints alongside other OS face challenges like managing root access/permissions, lack of centralized MDM while trying to stay up to date with the latest security patches across all of the different distributions.

Since there are numerous threat vectors, we recommend a simple, best practices approach to safeguarding organizational systems and data. This article highlights eight Linux System best practices worth following for better security.  

8 Ways to Safeguard Linux Systems from Cybersecurity Threats

Though by no means exhaustive, the following tips lay a strong foundation for implementing a Zero Trust Security framework in a Linux environment: 

1. Stay Current on Patches and Updates

Always update the software running on your devices as soon as possible to protect against vulnerabilities and/or security enhancements. This means ensuring your Linux distributions as well as other installed software are running the latest versions.

The JumpCloud Directory Platform makes it easy to set up patching policies for Ubuntu systems. You can also use JumpCloud to create your own custom scripts/commands to ensure all your devices and installed software are kept up to date.

2. Practice the Principle of Least Privilege 

NIST defines least privilege as follows:

The principle that a security architecture should be designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.

In other words, only provide access to needed resources at any given time. 

For example, the marketing department probably doesn’t need access to the same applications and data as the finance department. Use a platform like JumpCloud to manage which users have access to your Linux devices and what specific permissions and applications are available and/or accessible.

3. Utilize Data Encryption

Encrypt Linux systems data by ensuring only authorized users (with an encryption key) have access. Full-disk encryption only releases decrypted data contents after users provide proof of identity via a passphrase or key. 

This extra measure provides additional security beyond existing OS security mechanisms because it continues to protect content even after breach or removal. Follow JumpCloud’s recommended Linux Encryption Best Practices along with the Linux Check Disk Encryption Policy to verify your data is protected.

4. Maintain Up-to-Date Images

Linux systems are often built or copied from “golden” images. While this hack is great scaling without building from the ground up, many admins forget to update the golden images regularly. 

Ensure you’re building secure systems by maintaining your images with the latest patches and security updates. Here is a quick tutorial that walks through setting up critical policies and management practices with the JumpCloud agent.

5. Secure and Monitor Network Activity

Monitor and secure your network devices and traffic to mitigate vulnerabilities, threats,  and potential for breeches. Regularly monitor your networks for abnormal activity that might indicate a new threat. 

You can utilize Jumpcloud’s Network Parameters Policy to enhance your systems’ network security. This policy can disable IP and packet forwarding, prevent routed packets from being accepted, ignore ICMP broadcasts, enable path filtering and TCP SYN cookies, and log information about suspicious packets.

6. Minimize Software Footprint

Only install the software necessary for any given system. Unneeded and/or unused software increases the security risk and potential threat vectors. Further, by removing unneeded software, you also get the benefits of reduced storage space, memory allocation, any associated licensing costs while optimizing your system performance

7. Enforce Strong Passwords, MFA and/or SSH keys

Protect and prevent unauthorized access to organizational systems by enforcing strong passwords, SSH keys, and multi-factor authentication. 

Ensure passwords and/or SSH keys are changed regularly. Further, utilize Jumpcloud’s SSH Root Access and SSH Server Security Enforcement to help ensure only authorized access. The SSH Server securely provides remote access to devices. 

The settings in this policy only apply if the SSH daemon is installed on the system. To ensure access is restricted to only authorized users, configure your server to: place sensible resource limits, disable features with high potential for abuse, and disable algorithms and ciphers known to be weak.

8. Stay Vigilant with Ongoing Training 

IT Security is always changing to adapt and protect against new threats. We are all in this together to foster a safe IT environment as the backbone of our technologies. 

As the saying goes, “It takes a village!” IT professionals must stay abreast of emerging security threats and openly share their knowledge with the community. We recommend monitoring the following resources for the latest security landscape happenings:

• https://learn.cisecurity.org/ms-isac-subscription
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/
• https://cve.mitre.org/

Of course, the above list is certainly not exhaustive. Each IT admin and organization should determine which security measures to take in order to best achieve their objectives. 

Manage Your Linux Systems With JumpCloud for Free!

At JumpCloud, we’re constantly building additional security and management measures to help meet emerging regulatory compliance requirements, security posture, and device management needs. 

Please review our growing suite of Linux Security Policies and let us know how we can help provide you the tools you need to better manage your Linux systems. JumpCloud’s cross-OS platform makes it easy to manage Linux (Ubuntu) servers, Red Hat clients, Windows fleets, and macOS devices.

The demand for web applications compelled tech vendors to adopt standards that allow authorized users to access resources, across domains, through a single set of credentials. That approach, called federated authentication, has simplified SaaS adoption. However, small and medium-sized enterprises (SMEs) still face barriers when they attempt to extend single sign-on (SSO) to all of their resources. Not every asset is an app, and IT teams struggle to set up access control throughout their entire infrastructure and often turn to complex or siloed systems.

Delegated authentication is a simpler approach that addresses the shortcomings of federated authentication by broadening the protocols (and resources) that your identities can interface with. This article explores both types of authentication in more detail and outlines how an open directory adds more value to your existing identity and access management (IAM) investments.

What Is Federated Authentication?

One identity should log your users into all of their web apps.

Overview

Standards of federated authentication including OAuth, OIDC, and SAML make it possible for one identity provider (IdP) to manage access and authorization into many service providers (SP). For instance, that’s what happens when you log into a non-Google service with your Google Workspace credentials. Your credentials don’t pass over the web and the IdP determines whether access is granted. SSO users are managed from a single directory, even if applications have unique entitlements. 

Benefits and Drawbacks

Federated authentication increases productivity, lowers management overhead, simplifies user lifecycle management, and increases security. There’s fewer passwords to manage (assuming passwords are still required) and service providers don’t store credentials. That has the benefit of reducing the risk of identities being compromised from third-party breaches. This form of authentication has given rise to entire ecosystems of cloud-native apps with seamless integrations that wouldn’t have been possible without SSO. Those authentications are protected by other IdP security controls such as multi-factor authentication (MFA). Some IdPs are even adopting more user-friendly and secure passwordless solutions for frictionless access control. 

Entitlement management, through a directory and groups, can enforce least privilege computing to ensure that users don’t become a risk. For example, JumpCloud automates group memberships by continually auditing attributes. The result is that IT admins remember to remove access when one of your team members changes his/her role.

This approach to identity management is auditable and serves to satisfy cloud compliance requirements. Your organization can more easily attest to its compliance by using SSO.

Potential Lock-In

The spirit of openness doesn’t always survive a vendor’s stack. Identity providers and service providers can diminish the intention and effectiveness of using open standards by introducing closed practices and roadblocks. IAM lock-in presents itself in the form of vendor-specific considerations such as integrations with proprietary APIs that are roadblocks to accessing data and features. Spending on development projects for APIs creates a higher cost of switching. Other roadblocks include requiring components and licensing to work with other systems. 

For example, Microsoft’s approach to IAM can obligate organizations to adopt its extended stack including Azure Active Directory (AAD), licensing Windows Server, in addition to either Active Directory Domain Services (AD DS), or Active Directory Federation Service (AD FS) for users to access web apps. That’s because Active Directory wasn’t intended for the internet. Microsoft embraced open standards, but intertwined its monoculture with the IAM services it introduced.

Hidden Costs

Service providers may also upcharge for SSO, a practice that’s dubbed the “SSO Tax.” Interoperability is possible, but it comes at a higher cost per user. The SSO tax runs contrary to the spirit of open standards and may even compromise security if the MFA solution that your organization has implemented can’t function environment-wide. Some IdPs, such as Microsoft, restrict the number of apps your users can access without incurring additional charges. Always consider hidden costs and how subscriptions change over time before you select an IdP or service provider. A directory that provides true federated authentication should make it possible to assemble the optimal stack of services from the vendors of your choosing, without limits.

Accessing Non-Web Apps

SMEs commonly have resources that authenticate using RADIUS or LDAP, including VPNs or Wi-Fi networks. Identity and access management (IAM) suites strive to fill in the gaps when interoperability falls short, but not every solution works the same way. Operational overhead can vary dramatically, depending on the use case, and how those solutions are implemented.

Typically, this work is prerequisite:

• Installing and provisioning the server
• Configuring policies
• Managing user access to the RADIUS server
• Ongoing maintenance of the server including updating and patching

Without delegated authentication, SMEs must implement dedicated authentication tools that exist independently from IAM infrastructure, creating identity silos, and more work. Other interventions include configuring physical servers such as Microsoft Network Policy Server (NPS) or FreeRADIUS. These setups increase the cyberattack surface area in addition to overall management overhead and operational costs. It can also be cumbersome to integrate those services with your IdP, or a solution may lock you into a specific stack. Cloud RADIUS is another option, but these solutions generally don’t support authentication via an in-place IdP.

Use Cases

SSO protocols make many different scenarios possible.

• Mobile apps commonly deploy OIDC for SSO, because it’s lightweight, and many of the facilities that developers use are pre-built or available from add-on libraries.
• Most web apps have SAML built-in, providing an readily available method for federated authentication. IdPs provide pre-built connectors to streamline SSO connectivity. It is also ideal for accessing enterprise apps via a user portal.
• OAuth 2.0 or OIDC extend federated identity to APIs and microservices architecture.
• Enterprises sometimes favor SAML due to its capacity for customization and prioritization of secure data exchange.

What Is Delegated Authentication?

Your existing IdP credentials can be used to grant secure access beyond web apps.

Overview

Delegated authentication is a standards-based approach (OAuth 2.0 and TLS) that securely brokers established policy and credentials from one IdP to services provided by an open directory. For example, AAD doesn’t offer Cloud RADIUS, but AAD credentials can be leveraged through delegated authentication for seamless and appropriate access into network resources.

Benefits and Drawbacks

The primary benefit is maximizing your existing IAM infrastructure with an in-place IdP while minimizing the number of vendors and siloed solutions necessary to use RADIUS. 

There’s very little technical overhead involved to use delegated authentication and non-centralized logins are eliminated. Delegated authentication reduces the need for IT involvement in RADIUS infrastructure, freeing resources to focus on higher priorities that add business value. This also lowers the potential for security and operational failings through credential sharing and improves the user experience while enabling secure employee Wi-Fi access that segregates out undesirable traffic. Guests and vendors can access your network on a separate VLAN.

Technical constraints restrict authentications to a single factor, but additional security controls such as role-based access control can be layered on for a stronger posture. Group management permits you to achieve fine-grained control of Wi-Fi and VPN access based on established policy and identity settings. JumpCloud has plans to add device-level logins.

Use Cases

The primary use case is authentication for WAP2 Enterprise/802.1x applications, switches, and networking appliances. No configuration is required on device endpoints, and there’s no need for physical servers.

What Is Cloud RADIUS?

Can Federated and Delegated Authentication Be Used Together?

Federated authentication and delegated authentication are complementary IAM solutions that benefit SMEs that have standardized on IdPs that don’t offer readily available RADIUS services.

Try JumpCloud

JumpCloud’s open directory platform consumes identities from established IdPs such as AAD to grant convenient, secure, and appropriate access to RADIUS resources. The platform also provides identity management with environment-wide Push MFA, and LDAP, in addition to cross-OS unified device management. Conditional access rules, patching and password management are also available as add-ons. New accounts are fully functional and free for up to 10 users/devices. Complimentary chat support is available to help you get started.

Sometimes self-service doesn’t get you everything you need. If that’s how you’re feeling, schedule a 30-minute consultation to discuss options for implementation assistance, migration services, custom scripting, and more.

• Unification

• Directory Services
• User Access

Integrations are an oft-requested item from customers and prospects of JumpCloud. This is especially true with our Managed Service Providers (MSPs) who use many tools to run their business efficiently. One of the most common tools MSPs use are Professional Services Automation (PSA) tools. These PSA tools serve several purposes: CRM, project management, help desk management, billing, and invoicing (to name a few). 

Most IT Admins start their day with a cup of coffee (at least they do in the US) and an email check-in for any urgent issues. They spend a great part of their day solving support tickets, responding to phone calls, and answering emails from end users in addition to trying to get ahead on any projects. However, the process to access the information they need to solve support tickets can quickly become untenable, which will always take away from strategic projects and initiatives. 

Having different systems and communication tools to solve problems can in itself be very time consuming. In order to simplify that process, we built a native connector from JumpCloud to PSAs such that, when an important alert is generated on any of your clients, a ticket gets created in your PSA and assigned to a tech or a queue automatically. This helps technicians more quickly respond to client issues by centralizing the pertinent information they need in their preferred platform of action.

Helping Admins Stay on Top of Issues

JumpCloud’s open directory platform generates alerts that require an admin to take action and fix. Some common alerts include: 

• User Lockout: This is generated when a user has tried to login to their managed device with a wrong password too many times. They are now locked out and in need of being unlocked. 
• Password Expiration: A user’s password has gone past the organization’s threshold for number of days of usage.
• Sudo Admin Access Granted: A user has been granted superuser access on a device or a group of devices. This access might need to be revoked to avoid accidental damage.

When such actionable alerts are generated, MSPs can configure them to automatically create tickets in their PSA. Then they can take pre-emptive action before the user calls or submits a support request.

Configuring the Integration

Here are the 3 things you need to do to set up an integration to your PSA from JumpCloud:

1) Authentication

ConnectWise Manage requires you to have a public key and private key combination in order to authenticate and set up the integration.

Autotask requires you to have an API key and secret.  

2) Company Mapping

Map the companies in your PSA to the organizations in JumpCloud to ensure that the ticket is properly associated with the company that had the alert.

3) Configure and Enable Ticketing

Turn on ticket generation overall and configure the alert level. Every alert can be assigned a priority, status, source, due date and resource or queue assigned to.

Congratulations! You are good to go and should start receiving tickets in your PSA when important alerts happen. 

Want to check out more integrations? Not a partner yet? Sign up here to trial JumpCloud For MSPs!