Ensure Use of Only Fully Supported Browsers and Email Clients
Description
Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor.
Implementation Checklist
Tool Recommendations
Email security platform with anti-phishing, safe attachments, safe links, and automated investigation/response
Microsoft · Per-user subscription (P1/P2)
Advanced email security with targeted attack protection, BEC defense, impostor detection, and URL defense
Proofpoint · Per-user subscription
Cloud email security with threat protection, continuity, archiving, and security awareness training integration
Mimecast · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Browser-Based Exploit Kit Delivery
ConfidentialityOutdated or unsupported browsers contain known vulnerabilities that exploit kits target to deliver malware through malicious advertisements, compromised websites, or watering hole attacks without requiring any user interaction beyond visiting a page.
Email Client Vulnerability Exploitation for Initial Access
IntegrityUnsupported email clients with known rendering or parsing vulnerabilities are exploited to execute malicious code when users preview or open specially crafted emails, bypassing attachment-based security controls.
Session Hijacking via Outdated Browser TLS Implementation
ConfidentialityOutdated browsers supporting deprecated TLS versions or weak cipher suites allow man-in-the-middle attackers to intercept and decrypt sensitive web sessions, including banking, email, and enterprise application traffic.
Vulnerabilities (When Safeguard Absent)
Unsupported Browser Versions in Production Use
Enterprise assets run end-of-life browser versions that no longer receive security patches from vendors, accumulating exploitable vulnerabilities with each new disclosure while remaining the primary interface to web applications.
No Browser Version Enforcement Policy
The organization has no technical controls (GPO, MDM, or configuration management) to enforce minimum browser versions or prevent the use of unsupported browsers, allowing users to operate with dangerously outdated software.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Email security configuration (SPF, DKIM, DMARC records) | Verified quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |