A few months ago, Checkpoint/ZoneAlarm launched ForceField, a “Virtualized Browser Security” solution. When you look at the product description, you can read:
“ZoneAlarm ForceField provides a protective layer around your browser, shielding you from drive-by downloads, browser exploits, phishing attempts, spyware and keyloggers. So your passwords, your confidential information, and your financial data remain protected“. ZoneAlarm then asserts that ”Nothing else protects you like ZoneAlarm ForceField“….
This seems very promising and could be a very good answer to the multiple browser security issues. But then comes the reality… maybe you’ve already read this excellent article from Infoworld that explains that Robert Grimes needed only 60 seconds to bypass ForceField protection. In fact, this is not really surprising; it was already the case when the same Grimes tested GreenBorder (bought by Google) a few years ago. This is not really surprising because it’s not the implementation of the “sandbox” technology which failed but the concept itself of using a sandbox to protect the web browser. Moreover, the experts at Checkpoint/ZoneAlarm themselves admit: for optimum security, you have to use an updated and secured underlying system !!! Where is the virtualization ? This type of product is just one more security layer you have to install and manage on the user workstation…
What’s the solution ? A REAL virtual browser, REALLY executing in a distinct environment, which doesn’t need an updated and secured underlying system to provide a ”stress-free Internet” experience.
