Silo for Safe Access: A more secure web browser for some use cases

The web browser has become a key component in the corporate security landscape as many core business applications are now web-based. But browsers are troublesome to secure, and browser and web application use is difficult to monitor in a meaningful way. While individual web applications may offer some level of auditing, getting a holistic view of auditing for critical business apps is a pipe dream for most.

Tim Ferrill

Silo for Safe Access from Authentic8 is a secure browser alternative that is intended to eliminate many of the risks inherent in accessing web-based business applications, while also bringing additional capabilities that IT security shops may not have available. Many of the security benefits Silo offers are rooted in the architecture: It’s a sandboxed browser running in a temporary session hosted in the cloud. Because it is isolated in this way, both the network and code are highly constrained; content such as files can be more easily protected and scanned, and auditing activity in web applications becomes a real possibility.

The two primary use cases Authentic8 has for Silo for Safe Access are accessing trusted web applications from untrusted devices (such as a home or public computer) and accessing untrusted web content from trusted devices. In either case the isolation Silo provides helps protect critical business infrastructure from malicious code. Authentic8 also offers Silo for Research, which is targeted at cybersecurity and investigative teams.

Getting started with Silo

Silo offers installation on Windows, Mac, Ubuntu and iOS. There’s no support for Android or Chrome OS currently, even through the web client. Enterprise customers can install Silo across the organization through traditional software deployment methods. Users can be created manually through CSV import or using an Active Directory sync tool. Once created, users can log in initially by simply typing their email address and configuring a PIN. Device registration with SMS-based two-factor authentication (2FA) can be configured if desired.

User logins involve the user’s email address and their PIN, which is entered on a rotating keypad to prevent compromise by keyloggers or shoulder surfing. Silo’s native authentication is limited to a PIN and an SMS-based verification code, which isn’t a deal breaker, but I’d prefer more flexibility, particularly around 2FA.

Tim Ferrill

Authentication into Silo can be configured through a single sign-on (SSO) provider like Okta or OneLogin using the Security Assertion Markup Language (SAML), which is recommended for both security and convenience. Silo does not currently support user provisioning through System for Cross-domain Identity Management (SCIM), which would allow your SSO provider to automatically create user accounts. Depending on your corporate identity strategy and the size of your Silo deployment, this could be a significant shortcoming, but Authentic8 tells me SCIM is a priority for them.

Using Silo as a browser takes some getting used to, which is to be expected. The iOS version is particularly rough as it takes a split second for a touch or swipe to register with the remote browser instance. The printing and downloading user experience has a different feel because these are key areas Silo helps secure. Office documents are converted to PDF for your own protection, which isn’t optimal but in many cases is a necessary evil (although it would be great if Silo were to implement one of the many HTML-based document editors for this). Accessibility tools like screen readers are unfortunately a non-starter as these tools read the HTML Document Object Model (DOM) while Silo presents only a rendered representation of the browser and web content.

Enhancing corporate security with Silo

A key component in making Silo work for your business is requiring it for access to critical business applications, and fortunately there are a handful of ways to handle this. First, Silo offers integrated SSO to business apps using password vaulting, so a Silo administrator could create the user’s account and never actually share the account password with them, meaning they’d have to use Silo to authenticate.

There are a couple problems with this method (and with password vaulting in the enterprise in general). Managing application accounts and passwords becomes a manual process for administrators, and a user could change their password within the business app and use the account outside of Silo.

A second method is to use Silo’s integration with your corporate firewall or proxy server to force users to open Silo to access certain URLs. This requires routing users outside of your corporate network back through the firewall using a VPN or similar solution.

Finally, third-party SSO solutions can often help ensure application access is limited to certain IP address pools. The SSO option requires you have an SSO provider but is also dependent on the business application supporting an appropriate SSO protocol.

Tim Ferrill

Silo’s sandboxed architecture isn’t the only security capability it brings to the table. Since Silo is a controlled environment, administrators can manage content filtering within the admin console, preventing users from accessing sites that are either inappropriate for business purposes or blocking ads.

Perhaps Silo’s best trick is the control it gives over interacting with files. Silo provides administrators the ability to configure access to temporary and cloud storage, as well access to the client computer. The option to upload or download files to the local device can be enabled, disabled or enabled only for trusted devices. File transfers to/from Silo Cloud Storage to web applications can also be enabled or disabled, as can the ability to copy and paste into or out of the Silo instance. File transfers can be audited (either internally with Silo or using existing infrastructure) to increase visibility of what files are being moved in and out of Silo and your protected business apps.

Tim Ferrill

The other major benefit to funneling access to critical business applications through Silo is the ability to log and audit a variety of elements, including uploads and downloads, user sessions, URLs accessed (including query strings and HTTP header detail), language translation, and more. Log files can be downloaded in CSV or JSON format with optional encryption or accessed via API to leverage SIEM tools. Silo doesn’t offer any way to view audit logs in the admin console, which would be handy for initial troubleshooting rather than having to download logs.

Silo has value for the right use cases

I have a few minor complaints about Silo. Ironically, the main complaint is that Silo offers limited flexibility in terms of authentication options (only PIN and SMS-based 2FA) without leveraging an identity management (IDM) solution. This makes an IDM critical for Silo customers, but as user provisioning requires the use of the API rather than standards, there are some technical hurdles to using the IDM to its full potential. IDM users will also need to authenticate once to access Silo and a second time to access business applications within Silo–not a deal breaker, but definitely a pain point.

Silo is priced per user at $180 annually with the ability to add user or shared storage for $10/GB. Subscriptions include basic support and all features with premium support and volume discounts available.

Ultimately, Silo is an invaluable tool, but for relatively niche use cases. Many businesses with applications requiring enhanced security will have already invested in a remote access solution that meets their requirements, but Silo’s ability to easily provide an isolated, disposable browsing environment is a step above the protection offered by a corporate VPN or virtual desktop.