On April 28, Microsoft issued an advisory on a “remote code execution vulnerability” (CVE-2014-1776), which affects Internet Explorer versions 6-11. This allows remote code to run on users’ machines if they visit a malicious website with an affected browser.
If your users are accessing enterprise cloud apps with these same browsers, they may be putting your others users, corporate network, or your business-critical data at risk.
For the duration of this vulnerability, we recommend having your users access your enterprise cloud apps from an alternative browser than IE. You can set this up as a real-time policy for any enterprise cloud app in the Netskope Active Platform:
Here are steps to set this up:
– Select “Customize Templates” in Settings
– Change the “Block” coaching page text to “We have blocked use of Internet Explorer while vulnerabilities are remediated” (or if you have a way to say that in less-tortured English, we’re all ears!)
– Open up the Policy wizard in Policies
– In the first tab, select “Devices,” then “Browsers,” and select IE
– Navigate directly to the “Action” tab and select “Block”
– Select “Save” and name your policy
– Select “Apply Changes” at the top left
Even though you’ll be coaching your users, it’s always a good idea to take a belt-and-suspenders approach and send a notice to your users via your company’s most effective means.
You can delete this policy once vulnerabilities have been remediated. You can also easily create a report to show IE users.
If you would like a complimentary assessment of which enterprise cloud apps are running in your environment and with what browsers users are accessing those apps, please reach out to us at [email protected].
