WC-B-06Level 1 · Signal
Installs unvetted browser extensions
A risky Behavior signal from the browser inventory (SSE, extension inventory): this person installed an unreviewed browser extension, or one that can read every page.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.PS-05
- MITRE ATT&CK
-
- T1176
The definition, in detail
Definition
It sees every form, token and document the browser does.
Example
A paralegal adds a coupon extension that can read and change data on all sites; it runs in the same browser profile as the contract repository.
How it is measured
- Source
- Web, CASB & DLP
- Subject
- Person
- Event
- Extension inventory
- Risk domain
- Web, cloud and SaaS
- Provenance
- Framework research
How it is used
Programs count "Installs unvetted browser extensions" per person from Web, CASB & DLP and read it beside the other Web, cloud and SaaS signals; it feeds 0 cohorts, 0 sequences and 1 breach scenario.
A "installs unvetted browser extensions" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0102Installs personal cloud backup tools on enterprise devices
- I.0109Shares cloud documents with public links
- I.0110Sets cloud file sharing to overly permissive levels
- I.0112Misconfigures cloud storage with public access
- I.0113Authorizes persistent access to third-party applications
- I.0114Grants OAuth access to untrusted vendors
- I.0115Installs unvetted browser extensions
- I.0118Ignores browser warnings about insecure websites
- I.0119Uses non-encrypted HTTP for sensitive web access
- I.0120Uses unsupported browsers for sensitive enterprise tasks
- I.0121Uses outdated browsers to access enterprise web apps
- I.0122Accesses self-hosted tools with expired SSL certificates
- I.0123Accesses enterprise web apps from high-risk geolocations
- I.0124Uses anonymity tools to bypass security controls
- I.0156Accesses unapproved cloud storage services
- I.0157Uploads sensitive data to personal cloud storage
- I.0158Visits newly registered or suspicious domains
- I.0159Installs vulnerable browser extensions
- I.0160Circumvents corporate proxy or VPN
- I.0161Attempts to access blocked or blacklisted websites
- I.0162Visits confirmed malicious websites
- I.0163Visits websites that trigger policy warnings
- I.0165Spends excessive time on social media websites
- I.0166Visits websites in risky categories
- I.0167Attempts to visit restricted websites but is blocked
- I.0168Uses non-business SaaS platforms excessively
- I.0169Transfers high volumes of files to cloud applications
- I.0171Uses multiple cloud services with overlapping functionality
- I.0180Downloads documents from unrecognized cloud platforms
- I.0384Violates security contract clauses
- I.0386Grants excessive access privileges
- I.0387Uses unmonitored API integrations
- I.0388Uses unapproved cloud providers
- I.0389Disposes sensitive data improperly
- I.0390Employs unverified subcontractors
- I.0391Operates domain on watchlist
- I.0394Supplies or operates vulnerable software or platforms
- I.0396Faces financial or legal instability
- I.0397Skips insider background screening
- I.0398Exhibits unusual access patterns
- I.0399Uses shared or generic credentials
- I.0402Delays breach notification
- I.0403Transfers data without logging
- I.0404Uses weak encryption standards
- I.0405Shares data with unapproved subprocessors
Continue exploring
"Installs unvetted browser extensions" (WC-B-06), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/wc-b-06-installs-unvetted-browser-extensions
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.