NORIKO BOUFFARD: Welcome to "Chrome On Air,"
live webinars from Chrome Enterprise.
You're watching best practices for enterprise browser
and extension management.
My name is new Noriko Bouffard and I'm a browser specialist
on the Chrome Enterprise team.
Let's get started.
We'll dive into the browser usage in the enterprise.
Then we'll walk through how to best manage
your browsers from the cloud.
And finally, we'll look at some tips on extension management.
So let's set the stage.
First off, why are enterprises choosing
to move to a modern browser?
The way we work is changing and the evolving role
of the web in enterprises has a large part to play in this.
More and more work is done on the web today
thanks to industry trends moving away
from native client apps towards HTML5 standard web apps.
In that context, the browser has become
a core part of the business critical application stack.
And as you can see from these statistics shown here,
both IT admins and IT workers are seeing this shift
firsthand.
In many cases, it's about making your enterprise
users more productive.
That's also where management comes in.
Admins configure the browser to work optimally
for their environments, from having the right printers
and printing defaults configured automatically
to installing the right video conferencing
extension for their provider.
But it's more than just productivity.
With the rise of cloud-based enterprise applications,
more and more enterprise data is flowing through the browser.
That data needs to be secured, and mitigating security risks
is a top priority for enterprises.
For some enterprises, the need to manage their browser
comes from a compliance or regulatory perspective.
Enterprises operating in heavily regulated markets
will often lock down specific features for the browser
to reduce risk or enforce business needs.
With the bulk of enterprise user activities shifting to the web,
the browser needs to play an active role in an enterprise's
security strategy.
And that's why the need to manage the browser
has been increasing.
It's a great way to achieve your enterprise's productivity,
compliance, and security goals.
Chrome supports a very rich set of browser policies.
As an administrator, you have access
to hundreds of browser policies that
allow you to configure almost every aspect of Chrome.
Here are some examples where enterprises often
rely on browser policies to achieve their business goals--
deploying presets to make the browser more integrated
in your enterprise, controlling updates,
ensuring that the browser is up to date
and protected from vulnerabilities,
and managing extensions.
Enterprise admins want to be able to manage extensions
or simply need to control what types of permissions
an extension can request.
Additionally, some enterprises have
expressed the need to install business-critical extensions.
We'll take a look at how Google approaches extensions
and recommended best practices later on in this presentation.
So, how are enterprises managing Chrome today?
One option is to use your platform's existing management
tools to set Chrome policies.
If you manage Windows devices, you
can set policies using group policy objects
to configure the browser.
We offer ADMX templates to make it easy to set policies
on Windows.
We also offer options that are appropriate for Mac and Linux.
The second option is for enterprises
that already have G Suite or have adopted Google Identity.
Those customers can use Google Admin console
to set their cloud policies.
When their users sign into Chrome,
Chrome fetches and applies these user policies.
But each of these approaches have
their own set of drawbacks.
In the case of existing platform management,
a simple policy change that needs
to be applied across Windows, Mac, and Linux
might take three different administrators
to use different tools and will each have their own deployment
cycle.
It can be a fair amount of extra work just to set a policy.
And in the case of user profiles,
the administrator needs to ensure
that all of their end users have Google accounts
and sign into Chrome if they want to be sure
that the policies are enforced.
So that option doesn't apply to many enterprises today.
To solve these challenges, we released the Chrome Browser
Cloud Management last year, which provides an easier way
to manage Chrome deployments of any size
centrally from the cloud across Windows, Mac, and Linux
from the same console where an enterprise can
manage other Google services, including Chrome OS devices.
The good news is that it's easy to implement.
Your end users do not need Google accounts to receive
policies and there is no need for your end users
to sign into the browser.
You can set policies across platforms in one place.
You'll also gain deeper insights into your deployment.
With this new capability, administrators can immediately
see information about the policies that are set,
the current versions of the browsers, which extensions are
installed, and more all in one place.
The first demo we'll look at is browser enrollment.
Enrolling browsers into Chrome Browser Cloud Management
is very easy.
Once your administrator account is created,
you can sign into the Google Admin console,
navigate to the browser management pages,
and create organizational unit structure.
Once your structure is created, you
can retrieve an enrollment token for the organizational unit
that you would like to enroll browsers into.
With that token, you will use your existing tools
to set one last platform policy on the devices running
the browsers that you will want to enroll.
Once that token is set, the browser
will enroll itself into the Google Admin console
and receive machine-level browser policies
from the cloud.
You can also choose to enable the optional cloud reporting
functionality, which will send some helpful information
about the state of your browser deployment
to the Admin console.
Here you'll see how to retrieve an enrollment
token from the console.
We'll start with an admin logged into the Admin console.
They'll first navigate to the browser list page
by locating the managed browser card in the Device Management
section.
Once in the management browser page,
they'll retrieve the enrollment token
for one of the organizational units that
has already been configured.
And from here, an admin can push that unique enrollment token
out to the specific OU.
It's not shown in this demo, but once the machine receives
the enrollment token, Chrome will
note that it is now managed by the admin console
and will enroll into the cloud.
It will see a new managed browser in this list.
Next, let's take a closer look at the sorting and filtering
options that are available on the browser of this page.
From the device list page, we can
use search and sorting to quickly get insight
into the state of your fleet.
We'll sort by browser version to find
Chrome browsers that haven't been updated in a while.
Those machines might be good candidates
for applying the relaunch notification policy to ensure
that Chrome stays up to date.
In this view, we'll go over some of the browser details
that you can obtain if you choose
to turn on the optional Cloud reporting feature.
Here you can see that the admin has clicked
into a specific machine and they have a lot of information
available to them about this machine.
You can see the extensions that are installed,
which policies are set on the specific browser,
and what plugins are installed.
Next you'll see to set a new browser
policy on an organizational unit with Chrome Browser Cloud
Management.
We'll navigate to the browser policy page.
A quick scan gives you a brief view
of the types of policies that you can set.
You can use the search box to find the Cloud reporting user
setting and turn it on for the whole organization.
Once set, this provides more insight
into your browser deployment.
Opting in is what adds a lot of the information that you've
seen in this demo so far, including the extensions list
page.
In our last demo, we'll take a look at the browser extension
list page.
This page is particularly handy if you
want to get an overview of the extensions
that your users have installed across your fleet.
Here we will navigate to the browser extensions list.
We can see how many times an extension has been installed
across your entire enterprise.
It's even possible to force install extensions
from this report view.
You can choose to force install by OU
or across your entire organization.
Chrome Browser Cloud Management gives new insights
into your fleet.
Deleting a browser results in the associated information
being deleted from the admin console storage system.
We provide a data takeout function
that allows you to have full visibility and control
of your data in the cloud.
So with all of that data that is available,
organizations are now empowered to make the decisions
on how to balance user productivity while also
mitigating security risks for their company.
A great example of using the insights from the Chrome
Browser Cloud console and applying them
to finding a balance between user productivity
and mitigating risk is by managing extensions.
There are two primary benefits of extensions for enterprises.
The first is customization.
Users can tailor Chrome's functionality and behavior
to fit their needs or enterprises can
enforce enterprise-wide browser behavior across these devices.
The second benefit is productivity.
Extensions can help users with their personal productivity
and enterprises can help develop custom extensions
or use third-party extensions that can enhance their users'
experience.
However, there are challenges with managing extensions.
Enterprises need to create a vetting process for extensions
that are requested by their end users
and workflow for IT admins to manage the extensions that
have been approved for their environments.
For those customers not yet using extension
reporting that we demoed earlier in the Chrome Browser Cloud
Management piece, it can be difficult to make
policy decisions without understanding
the possible impacts to users.
So, let's look to different approaches
to managing extensions.
There's the more traditional route,
which involves whitelisting and blacklisting extensions.
And then there's this enhanced management route,
which is what we'll be covering in more depth today.
By using traditional methods, enterprises
can face a lot of challenges when it
comes to extension management.
Whitelisting and blacklisting doesn't
account for when an extension is sold or updated.
It doesn't scale for large organizations and review
times can significantly hinder user productivity.
But let's look at how managing extensions by behavior
can enhance how extensions are managed
beyond the traditional method.
The benefit to this approach is that it scales.
It increases user productivity by giving
access to more extensions and better mitigates against risk
from changes to extensions after that first point in time
evaluation.
The paradigm here is that extensions are not
managed one extension at a time, but rather
the behavior extensions generally are managed.
Extension can have one or both types of behaviors
that are categorized in two ways, by device permission
and by site permission-- or, otherwise,
runtime host controls.
Let's look at the device permissions first.
An extension might want to have device permissions
to control your camera or to view someone's desktop.
In the initial vetting of an extension,
this could be approved.
But what happens if that extension updates
and asks for a new device permission like access
to your clipboard?
With the traditional approach, this would not be controlled.
But if you set device permissions
to not allow clipboard access, then this extension
will become disabled and will not run if it were to update.
This would minimize your risk to installed extensions that
may update with changes that would not be approved according
to your security policies.
The other category of risky behavior
is around what site permissions an extension can have.
There are extensions that can require access to all sites,
and this can be risky since this would mean access to all sites,
including precious corp sites, for those extensions that
have been whitelisted by traditional methods.
But by managing extensions by runtime host controls,
you can set a global policy to restrict all extensions
from running on those corp sites that are deemed sensitive.
By doing this, you have more confidence
in knowing that any installed extension will never
run on your corp sites unless you've given
explicit exemptions to do so.
And the benefit to users is that they
can install more extensions from the Chrome Web Store
without having to request or be blocked by more
restrictive blacklist policies.
Just as this graphic depicts, an extension
can be installed and run fine on sites outside of corp sites
but will not work or run on corp sites.
For many admins, this is a low-hanging fruit
to apply an extension policy that
will provide added security and gives way to opening up more
extensions to their end users.
Summarizing the benefits of managing extensions
by permissions-- the benefits are enterprises
are protected from extensions that change or are compromised
after first being approved, reducing exposure to risk.
At the same time, you have more confidence
that you can make more extensions
available to your users, providing a better user
experience and increased productivity.
Being able to protect your precious corp
sites with a global setting protects you
from all extensions versus having
to protect against one extension at a time.
The added benefits are the savings of time
for both your IT and security teams,
focusing their time managing extensions
that require exceptions for the business
and save them from having to review changes
or updates to extensions only on an as-needed basis
versus with every update or change.
If you're interested in getting started
in looking at managing extensions via permissions,
this is a good outline.
The first step is getting a handle
on what extensions are in your environment.
In the Chrome Browser Cloud Management
is a free and easy way to get started.
From that first audit, you can then create a policy
based on device and site permissions
that you will want to restrict and present these findings
to your stakeholders.
You'll next test these new policies
and establish an operational process for new extensions
or updates to extensions.
Finally, review the results from the test
and eventually roll out the new process to production.
So, what's next?
First head over to g.co/chromecloudmanagement
to sign up for Chrome Browser Cloud Management.
Second, test enhanced extension management for your enterprise.
And finally, check out all of the latest documentation
for step-by-step instructions on how to bring these best
practices to your organization.
Here's a good starting point for some great resources
to get you started.
The extension management whitepaper
goes into more depth about implementing
extension permission policies.
So, thank you for tuning in.
Please visit "Chrome On Air" with Google.com
more content from Chrome Enterprise experts.