Using the Dell KACE Secure Browser

This document explains how to use the Dell KACE Secure Browsers. Dell provides a secured version of common web browsers, such as Mozilla Firefox.

Go to the www.AppDeploy.com web site to find more information on Secure Browsers, including videos and guided tours, a dedicated Secure Browser forum, FAQs, or to report issues and request new features.

About Secure Browsers

Secure Browsers features include the ability to:

•	Run fully contained from areas normally written to during browser activity.

•	Optionally restrict the sites which the browser may access.

•	Easily reset the browser to its initial state, clearing all activity from a browser session.

•	Control which programs and processes may be initiated by the browser.

•	Allow simultaneous execution of different browser versions.

•	Remote management when used with the Dell KACE K1000 System Management Appliance.

•	Generate custom MSI files for deployment from the K1000 System Management Appliance or for manual installation on another computer.

System software requirements

Secure Browsers are supported on the following platforms:

•	Microsoft Windows® 7, Vista, and XP (x86) SP2 and SP3.

Supported browsers

Dell currently provides the following Secure Browser:

•	Mozilla Firefox 3.6 with Adobe Flash and Reader Plug-ins

Installing and Uninstalling Secure Browsers

Download the Secure Browser from the Dell KACE Support Download page.

To install a Secure Browser:

1.	Double-click the Installation File.

2.	Click Next to start the installation.

3.	Read and accept the Licensing agreement and then click Next.

4.	Choose the directory where you want to install the browser and then click Next.

5.	Click Install.

Progress is shown and when the installation completes, the installation details message displays.

6.	Click Finish.

The Secure Browser icon appears on your desktop.

To uninstall a Secure Browser:

1.	Open the Control Panel and click Add or Remove Programs.

2.	Select Secure Browser (Firefox) and click Remove.

A confirmation dialog appears.

3.	Click Yes to remove.

Using Secure Browser

Click the Secure Browser icon to launch the browser. The browser operates in the same manner as unsecured Firefox. However, you can make the browser even more secure by setting up Network Access and Process Control as described in Configuring the Secure Browser, on page 5.

A browser window appears with the translucent wrapper that has the Secure Browser toolbar across the top. The toolbar only displays when the browser is down-sized, that is in non-full screen mode.

Toggle screen modes using the F11 key.

The Secure Browser toolbar is not visible when the window is maximized or if the window is too large for it to be visible.

Clearing files and installed plug-ins

Reset clears programs you choose to download or that are downloaded automatically by web sites you visit while browsing. Reset also removes all plug-ins and extensions, such as toolbars or content viewers, and cookies, and then reverts browser files that were modified back to their original state. When you revisit sites that require you to log in and you must re-enter your credentials.

Typically, you remove all downloads to get rid of unwanted or malicious files or programs. However, you can also clear the programs to improve system performance if the amount of space the downloads use becomes too large.

Exclude clearing your Favorites and Home Page from a reset by enabling the Save Favorites during Reset and Save Home Page during Reset options on the Settings tab.

To clear downloads:

1.	Click the Trashcan icon at the top left of the Secure Browser toolbar.

The Reset Browser dialog appears.

2.	Click Reset to delete all files and programs that were downloaded.

All downloaded content is deleted. The Secure Browser restarts.

When the Secure Browser restarts and the Import Wizard appears do NOT import the settings from another browser if you want to save your Favorites and Home Page.

Viewing activity

The Summary tab of the Dell KACE Secure Browser Configuration window allows you to review activity since the last time you reset the browser or since it was installed, if it has never been reset.

To open the Summary:

•	Click the Configuration icon .

The Dell KACE Secure Browser Configuration window appears.

The following information displays:

Process Started/Contained	Shows the number of processes that started and the Secure Browser allowed to run.
Processes Blocked	Shows the number of times that the Secure Browser prevented a process you blocked from opening and running.
Network Access Blocked	Shows the number of times that the Secure Browser prevented either a process or user from accessing a web site or network location you blocked.
Suspicious Processes	Shows the number of time an unknown process attempted to start. Note that the Secure Browser prompts the user each time a process that is not in the Process Control list is about to start, the user can: • Allow: Starts process and automatically adds it to Process Control as allowed. • Allow this time: Starts process and leaves it as suspicious, user is prompted each time is about to start. • Deny: Blocks process and adds it to Process Control as blocked.
File Actions Contained	Shows the number of times files written at the host system locations were kept contained by the Secure Browser.
Registry Actions Contained	Shows the number of times that the Secure Browser prevented a downloaded program or process from making a change to the registry.

Configuring the Secure Browser

In order to configure and view these settings, the user must have Administrator privileges or permission to modify configuration settings. From the configuration menu you can view and set the following additional features in the Secure Browser for:

•	Saving your Favorites and Home Page

•	Restricting access to web sites

•	Controlling which programs the Secure Browser can launch

To open the configuration menu:

•	Click the Configuration icon .

Saving your Favorites and Home Page

You can exclude pages you marked as a Favorite or designated as your Home Page from resets. When you reset the browser, it returns it to the original state by removing programs, plug-ins, cookies and other items added by sites you visit while browsing.

These options are enabled by default.

To save Favorites and your Home Page:

1.	Click the Configuration icon and then click Settings.

The Secure Browser Options appear.

2.	Click the option to enable or disable it.

3.	Click Save.

Restricting access to web sites

The Network Access feature controls which sites are accessible from the Secure Browser. You manage access by specifying the URL and the Secure Browser action:

•	Allow: Identifies sites that the browser permits user and process to access. When you set up this option, that is allow one or more sites, the Secure Browser automatically blocks all other sites. Restricts users and processes to allowed sites only.

•	Block: Identifies restricted sites that the browser prevents processes and users from accessing. When you set up blocked sites only, the Secure Browser permits users and process to access all other sites, that is sites that are not explicitly blocked.

To set up access control:

1.	Click the Configuration icon and then click Network Access.

The Network Access options appear.

2.	Click Enable Network Access Control.

3.	To manually add an address:

a.	Enter the URL.

b.	Choose one of the following options:

Allow	Grants access to this site. Automatically restricts users and processes to authorized sites only.
Block	Denies access to this site, but allow access to all other sites that are not explicitly blocked.

Dell recommends creating a list with one type, either Allow or Block. Secure Browser supports lists that contain both types, however when you specify one or more sites as allowed, all other sites are automatically blocked.

c.	Click Add.

The address appears in the access list.

4.	To automatically create a list of addresses you want to allow by opening the sites in the Secure Browser:

a.	Click Start Recording.

b.	Switch to the Secure Browser window and open all the sites you want to allow.

c.	When you are done, go back to the Configuration window and click Stop Recording.

The addresses appear in the access list with a green check.

Controlling which programs the Secure Browser can launch

Use the Process Control tab of the Configuration window to control whether or not individual processes and programs can launch from within the browser session.

You must also add any program that uses a hook from within the browser session, if you want to allow users to access web sites or HTML pages from the application. For example some programs launch the browser to a support site, a help systems, or other site. This applies even if the page is local, that is on the computer.

1.	Click the Configuration Icon and then the Process Control tab.

The Process Control options appear.

2.	Click … to browse to the program file that you want to add or enter the absolute path to the program file.

The Open window appears pointing to the C folder within the Secure Browser.

3.	Click Open to select the program.

The path to the file appears in the program field.

4.	Click either Allow or Block.

5.	Click Add.

6.	Click Save.

The program appears in the list. The program is also added to the Secure Browser directory.

Managing Secure Browsers from K1000 System Management appliance

This section explains the K1000 appliance integration features. A Secure Browser can run as a standalone component managed by the administrator or user with elevated privileges on the local machine or it may be remotely deployed and managed by a K1000 System Management appliance.

Exporting the Isolation Configuration file

The Isolation Configuration file allows K1000 System Management appliance to centrally manage Secure Browser Network Access and Process Control settings. The configuration file is periodically pushed from the appliance to the Secure Browser clients.

Dell recommends setting up the Secure Browser on a provisioned network node, with the proper access permissions then exporting the configuration for use in the K1000 Administrative Portal.

To generate a configuration file:

1.	Click the Configuration icon and then click Advanced.

The Advanced options appear.

2.	Click Export.

The Secure Browser network and process configuration settings display in XML format.

3.	Click Copy and then Close.

4.	Log in to the K1000 Administrative Portal.

5.	Go to the Security > Secure Browsers page.

6.	On the Choose Actions menu, click Edit Default Settings for Secure Browsers.

7.	Scroll Down to the Isolation Configuration XML field and paste the data that you exported from the Secure Browser.

8.	Click Save.

All Secure Browsers integrated with the K1000 System Management appliance will now have the same Network Access and Process Control settings.

Generating a Customized Secure Browser Package

This feature allows you to make an exact copy of the Secure Browser instance that you can upload to the K1000 appliance for deployment or install directly onto another computer. The new package includes all the information (History, Favorites, cookies, etc.) from the Secure Browser.

On a Windows 7 computers, you must use elevated privileges to generate the MSI. Use the Run as administrator option to open the Secure Browser.

To generate a customized MSI package:

1.	Click the Configuration icon and then click Advanced.

The Advanced options appear.

2.	Click Generate.

On a Windows 7 computer if the permissions menu appears, close the browser and reopen it using the Run as administrator option.

The Generate Custom Deployment Package dialog appears.

3.	In Original Secure Browser MSI file, enter the path to the original Secure Browser MSI setup.

If the Secure Browser was deployed from the K1000 appliance, the installer is located in the K1000 Agent installation folder.

4.	In Deployed Secure Browser Directory, enter the path. By default, the field contains the path to where the Secure Browser is installed.

5.	In New Secure Browser MSI file, enter the path and name of the new customized Secure Browser package, including the file extension (MSI).

6.	Specify the MSI File Properties.

7.	Click Create.

The new Secure Browser installer is created and saved to the location you specified.