Description

The concept of Security by Isolation aims to reduce the impact of cyberattacks by physically separating a user's system, OS, browser, or email from their local machine or the enterprise server. As a result, even if the security of one of the systems is compromised, the impact does not percolate to the rest of the infrastructure.

The principle of Security by Isolation has been around for decades. The earliest example of the isolation concept was Virtual Desktop Infrastructures (VDI). The VDI hosts a desktop operating system within a virtual machine (VM) running on a centralized server. Users access the remote desktop through a login portal. Any risky website access or malicious download happens on the remote desktop and not the central server.

Since then, security isolation technologies have gone through many iterations. Today, the focus is on isolating the user's endpoint from the web, which represents a vast attack surface. The browser often acts as the entry point for cyber adversaries to inject malware, steal data, or disrupt services. Air-gapped systems, network segmentation, and virtual private networks are few examples of solutions that leverage the concept of security by isolation. However, operational complexity and poor user experience drove the emergence of web isolation platforms.

Web isolation platforms can be classified based on the type of application being isolated – Browser, Email, Document, and cloud-based application. Although browser and Remote Browser Isolation (RBI) are the most popular web isolation platforms, other types such as email, document, and application isolation are beginning to witness significant demand.