CompTIA A+ Core Certification: The Basics of Security - Configuring Browser and Relevant Security Settings

Objective 2.10: Given a scenario, install and configure browsers and relevant security settings.

The web browser is arguably the most commonly used app in daily use.

Web browsers such as Google Chrome, Microsoft Edge, Apple Safari, and Mozilla Firefox are used billions of times a day for everything from sending emails; communicating live with family, friends, or coworkers; and conducting banking and other highly confidential transactions. Knowing how to install, update, configure, and secure commonly used browsers is a skill that every tech should possess. 

Browser Download and Installation
When downloading browser software (or any app, for that matter), you should do so only from trusted sources.

Table below displays reliable, trusted source Internet reference links where you can safely download the most popular web browsers in use today. Notice the secure HTTPS at the beginning of each URL.

Table: Trusted Web Browser Download Links

Installing a trusted web browser is typically a straightforward process. The following are general steps to install Google Chrome, which is currently the most popular browser, on a Windows-based system.

Most web browser installations follow a similar process:
Step 1. Download the installation file.
Step 2. If prompted, click Run or Save.

If you choose Save, start installation with either of these methods:
- Double-click the download.
- Click Open File.

Step 3. You might be asked, “Do you want to allow this app to make changes to your device?” Click Yes. In Windows 10 or 11, a Chrome window opens up when everything is complete.
If you have used a different browser, such as Microsoft Edge or Safari, you can import your settings into Chrome.
Keep the following points in mind when downloading web browsers or any other apps over the Internet:
- Websites that have a URL that begins with HTTPS are considered secure and trusted. Remember that Hypertext Transfer Protocol Secure (HTTPS) is a secure extension to the HTTP protocol. HTTPS uses secure port 443, while HTTP uses unsecured port 80.
- If you receive an “Untrusted Certificate” pop-up message when accessing a website, it means that your current browser doesn’t know whether the website is authentic or fake. Invalid or fake SSL/TLS certificates often indicate that a malicious website is present.


Note: Be sure to download programs and files from trusted sources, or sources that you know are legitimate (for example, Microsoft.com, Google.com, Mozzila.org, Apple.com, and so on).

Hashing
Hashing verifies that the contents of files are unaltered. A hash is often created on a file before it is downloaded; then another hash is created after the download. The two values are compared to make sure the contents are the same. When downloading files—particularly upgrades, patches, and updates—be sure to check and verify the hash values.
Hashing is also important if you store a browser installation file for a later installation because you want to ensure that the installation file has not been tampered with. You can do this by creating a Secure Hash Algorithm (SHA) hash of the executable installation file and storing it for later use. When it is time to install from the executable installation file, you can run hashing to verify the signature of the file. The details of hashing are beyond the scope of A+. To learn more, visit https://csrc.nist.gov/projects/Hash-Functions.

Untrusted Sources
The previous section on hashing provided an example of using an SHA hash to verify the integrity of a stored browser executable file. If the hash signature matches, the installation file is trusted. If the hash does not match, it is said to be untrusted. This is a perfect example of an untrusted source. You should always download installations from trusted sources and then protect them with file hashing, to detect any malicious activity or tampering.

Extensions and Plug-ins
Extensions and plug-ins are used to customize web browsers. They add features and functionality and allow you to customize and personalize your web browser. Extensions typically represent source code, while plug-ins are executables. Extensions add functionality to a web browser as a whole, while plug-ins add extra features to particular web pages. Although good (trusted) extensions and plug-ins add functionality and features, bad (untrusted) ones can cause great harm to your system. They can use up system resources, insert ads, redirect web searches, and even collect your personal data.
You can view the extensions that are installed in Microsoft Edge by entering edge://extensions in the address bar. To view extensions installed to Google Chrome, enter chrome://extensions in the address bar. From these locations, you can also enable or disable extensions or search for others.

Note: Microsoft Edge and Google Chrome now primarily use extensions and have nearly eliminated using plug-ins. However, Mozilla Firefox still uses both extensions and plug-ins.

Password Managers
A password manager is an application that stores passwords that you use for various websites or services. Password managers are often local programs that run within the operating system. They can also be provided by open source third-party companies such as KeePass or commercial providers such as 1Pssword and Roboform. Commercial managers involve a nominal cost, but they are often more manageable for less experienced users.
Credential Manager is the password manager for Windows and Microsoft Edge. Google Chrome and Mozilla Firefox use built-in credential managers. macOS uses Keychain as its password manager. These tools store web credentials and OS credentials.

Secure Connection/Sites—Valid Certificates
Using a secure Internet connection and connecting to websites that use valid certificates is critical to ensuring the health and safety of your data and your system. Several technologies help you stay as safe as possible when traversing the world through a web browser. For the purposes of A+ certification, the next sections focus on TLS and HTTPS.

Transport Layer Security (TLS)
TLS is the most widely adopted protocol used to encrypt communications between web apps and web servers and ultimately protect sensitive data in motion (transit). TLS 1.2 is widely used; 1.3 is the latest version, but it is listed as experimental at the time of this writing. To see the various TLS versions in Windows, access Internet Options Advanced, as shown in Figure below. These TLS settings apply to both Google Chrome and Microsoft Edge.


Internet Options TLS Versions

Hypertext Transfer Protocol Secure (HTTPS)
As previously mentioned, websites that have a URL that begins with HTTPS are considered secure and trusted. This is important here as well. Remember that Hypertext Transfer Protocol Secure (HTTPS) is a secure extension to the HTTP protocol, which is not trusted. If you do not see a padlock in your browser’s URL address bar, you are not using HTTPS and the web page is not safe. You should immediately close your session.
Speaking of the padlock in your browser, right-clicking the padlock enables you to view certificate information about your connection. You can see whether the certificate is valid, determine whether the connection is secure, and view details about the connection protocol in use.

Settings
Securing browsers with the appropriate settings helps you avoid many system security problems, including spyware, ransomware, and other malicious activities. It is important to configure your client web browsers for ease of use and to ensure that your customers are aware of security threats that loom on the Internet.

Pop-up Blocker
Pop-up blockers prevent pop-ups from appearing when users visit a website. Most popular browsers, such as Microsoft Edge and Google Chrome, have pop-up blocker capabilities built in and block pop-ups by default. However, in some cases, you might actually want to allow pop-ups.
To configure pop-ups and redirect settings in Microsoft Edge, perform the following steps:
Step 1. Tap Settings.
Step 2. Select Site Permissions.
Step 3. Select Pop-ups and Redirects.
Step 4. Toggle Pop-ups and Redirects off to block pop-ups, or toggle it on to allow pop-ups on your device.

To configure pop-ups and redirect settings in Google Chrome, perform the following steps:
Step 1. Open Chrome.
Step 2. At the top right, click More (three vertical dots) Settings.
Step 3. Click Privacy and Security Site Settings.
Step 4. Click Pop-ups and Redirects.
Step 5. Choose the option you want as your default setting.

Clearing Browsing Data
Clearing browser data involves using an extension to the browser that allows you to remove browser data such as history, cache, and cookies from a browser toolbar. From the toolbar, you have an option to clear all browser data or selectively remove various information or data types for clearing. Clearing cached files and images (described next) can help fix problems you might have with accessing web pages. Clearing cookies, for example, can help with privacy concerns. Remember that clearing browsing data removes all website-based temporary files stored on the local system, such as browsing history, cookies, passwords, and cache.
 

To clear browser data in Microsoft Edge, select Settings and then click More Settings Privacy, Search, and Services. Under Clear Browsing Data, select Choose What to Clear.
To clear browser data in Google Chrome, follow these steps:
Step 1. On your computer, open Chrome.
Step 2. At the top right, click More.
Step 3. Click More Tools. Clear the browsing data.
Step 4. Choose a time range, such as Last Hour or All Time.
Step 5. Select the types of information you want to remove.
Step 6. Click Clear Data.

Clearing the Cache
When web pages are accessed, the information is stored in the cache. This process occurs so that if the data is needed again, it can rapidly be accessed from local storage. This caching process means fewer trips to the Internet to access the same information. Clearing the cache is sometimes necessary if the latest copy of the web page is required. This is often the case during web page development or if you need to access the same website but use different credentials or logon information. Clearing the browser cache removes images and forms, which prevents you from using old forms and ultimately protects your personal information. This is similar to the previously mentioned action of clearing browser data, but it primarily has to do with images and forms.

Private Browsing Mode
Private browsing mode is a feature of web browsers that does not store web browsing data or information. In fact, when you close private browsing mode, all browsing data and information is removed or destroyed. In Microsoft Edge, private browsing is called InPrivate browsing; in Google Chrome, it is called Incognito mode. To enter InPrivate mode on Microsoft Edge, click the three dots in the upper-right corner of the window and then select New InPrivate Window. The screen turns dark when you enter InPrivate browsing, as shown in Figure below.

In the Safari app on a Mac computer, you can choose File New Private Window to use private browsing.

For the A+ exam, you should know how to initiate private browsing in Edge and Chrome.


InPrivate Browsing in Microsoft Edge

Sign-in/Browser Data Synchronization
Because most people access data on various devices, including desktops, laptops, and smart devices, it is extremely important for data to be synced across all devices so that the same information is available. In the old technology days, this involved copying a file to media and then copying that file to each device to have an up-to-date copy. These days, browser data synchronization is a cloud service that almost all browser vendors offer for sharing settings and information across all devices. As long as you sign in with a valid user account, your data is synced across all your devices.

Note: Be sure to keep work data and personal data separate. In some instances, a browser data sync might be against company policy (for example, if you sync your personal device to a work system). Always check your company policy before you comingle personal settings and data with company settings and data.

Ad Blockers
An ad blocker is a tool that integrates with a web browser and uses filtering to block specific advertisements. Ad blockers assist with online privacy and help to avoid spyware-infected ads. Implementing ad blockers is considered good security practice. In fact, the NSA and Cybersecurity and Infrastructure Security Agency recently released important guidance recommending the use of ad blockers as an important security measure.

To adjust ad blocker settings in Google Chrome, do the following after you open the Chrome browser:
Step 1. At the top right, click More (three vertical dots) Settings.
Step 2. Click Privacy and Security Site Settings.
Step 3. Click Additional content settings Ads.

Figure below displays ad blocker settings in Google Chrome.


Ad Blocker Settings in Google Chrome

Many (if not most) third-party ad-blocking programs are offered for free. For example, AdBlock is a free add-on to Microsoft Edge that blocks pop-ups, video promotions, and other distracting ads.