Browser extensions are software too: A security checklist for business PCs
Browser extensions are treated as convenient add-ons rather than what they actually are: software installed on a business computer with significant access to network traffic, browsing data, and, in some cases, stored credentials. The Cybersecurity and Infrastructure Security Agency (CISA) has explicitly noted that browser extensions can carry high privilege levels and introduce substantial security concerns. For businesses that haven’t reviewed their extension landscape recently, this checklist covers the areas that are often overlooked.
Understand what permissions extensions actually request
When a browser extension is installed, it requests a set of permissions that define what it can access. Many users click through these prompts without reading them, but the permissions matter significantly. An extension with access to all data on all websites can observe every page a user visits, read form inputs, capture credentials, and intercept communications between the browser and web services. This level of access is not unusual for legitimate tools such as ad blockers and password managers, but it is also the level of access a malicious extension needs to do serious damage.
As part of any audit, open the browser’s extension management page and review the stated permissions for each installed extension. Extensions that request broader permissions than their stated function requires warrant closer scrutiny. A PDF viewer that requests access to read and change all data on all websites, for example, is asking for significantly more access than PDF viewers should need.
Identify extensions that are abandoned or no longer maintained
Software that is no longer actively maintained does not receive security updates. An extension that was secure when installed may develop unpatched vulnerabilities over time if its developer stops updating it. Worse, CISA and security researchers have documented cases where abandoned extensions are sold to new owners who convert them into adware or spyware, taking advantage of the existing install base and previously granted permissions.
Check the last update date for each extension installed on business devices. Extensions that have not been updated in a year or more, particularly those from developers who appear to have stopped maintaining them, should be evaluated for removal. You can usually find the last-updated date on the browser’s extension page or in the extension’s web store listing.
Watch for extensions with legitimate covers and hidden behavior
Not all problematic extensions are obviously malicious. Some legitimate ad blockers have been known to accept payments from advertisers to ensure those advertisers’ content bypasses the blocker, undermining the tool’s purpose. Others collect browsing data for commercial purposes that are disclosed deep in a terms-of-service document rather than clearly communicated during installation.
When evaluating extensions for business use, give preference to tools with a clear commercial model and a reputable developer, where the business relationship between developer and user is transparent. Free extensions with large install bases and no obvious revenue model are worth extra scrutiny: the data access they hold may itself be the product.
Build an allowlist and remove everything outside it
The most effective organizational control over browser extensions is an allowlist: a defined set of approved extensions that employees may install, managed through browser enterprise policy. Extensions outside the allowlist are blocked from installation. This approach is supported by Chrome, Edge, and Firefox through their respective enterprise management frameworks, and it is the control CISA recommends as the foundation of browser security management.
Building the allowlist requires reviewing which extensions current employees use, evaluating each for business justification and permission scope, and removing those that don’t meet the criteria. The process takes time but eliminates the need to reactively investigate individual extension incidents after the fact.
Schedule regular audits and enforce removal procedures
Browser extensions accumulate over time, particularly on devices where employees have administrator rights. A quarterly review of installed extensions across managed devices catches new installations that haven’t gone through the approval process, identifies newly abandoned extensions, and provides an opportunity to remove tools that are no longer actively used.
The removal process for extensions that don’t meet the allowlist standard should be documented and consistently applied. Extensions that hold sensitive permissions should be removed promptly rather than left in place pending review. Once an extension has collected data, removing it cannot undo that collection, so speed matters when a problematic tool is identified.
Managing browser extension risks across your organization requires the right policies and controls. Our team can help you assess your current exposure and implement security measures that fit your environment. Get in touch to get started.
A browser extension with permission to read and change all your data on every website has roughly the same access to your activity as the browser itself. For individual users, that might be an acceptable tradeoff for a useful tool. For a business PC, it is an access level that deserves the same scrutiny as any other privileged software. This guide covers browser security best practices recommended by the Cybersecurity and Infrastructure Security Agency (CISA), including how to audit installed extensions, evaluate their permissions, and keep them under control.
Most businesses carefully manage which software gets installed on company computers. Fewer apply the same discipline to browser extensions, even though extensions often carry permissions that rival those of traditional installed applications. The Cybersecurity and Infrastructure Security Agency’s (CISA) guidance on web browser security calls out extensions specifically as a source of elevated risk. This checklist translates that concern into practical steps.
An uninterruptible power supply (UPS) is the kind of equipment that gets purchased, installed, and then forgotten about until something goes wrong. The problem with that approach is that UPS batteries degrade, their runtimes shrink, and the workloads connected to them grow over time, often without anyone updating the protection strategy to match. A regular UPS audit closes those gaps before an actual power event turns them into downtime.
An uninterruptible power supply (UPS) is one of those IT investments that looks fine on paper until a real power event tests it. However, over time, UPS batteries age and lose capacity. Workloads grow and exceed original runtime estimates. Units get supplemented with additional equipment but never re-evaluated for load. A periodic UPS audit catches these issues while there is still time to correct them.
Most small and mid-size businesses have at least one UPS (uninterruptible power supply) protecting their servers and network gear. Fewer have a clear picture of whether those units are still adequately sized, whether the batteries are still functional, or whether the equipment they’re protecting has grown beyond the unit’s rated capacity. This guide covers the key areas to check and what to do about what you find.
For businesses reconsidering their phone infrastructure, the VoIP vs. VoLTE question comes up regularly. Both technologies deliver digital voice calls at lower cost than legacy systems. Where they differ is in the network they rely on, how they perform in different environments, and what kind of mobility they support. Working through those three criteria narrows the field considerably.
VoIP and VoLTE are both modern alternatives to traditional circuit-switched phone systems, but they operate over different networks and suit different working environments. Understanding those differences is the starting point for building a communication setup that actually matches your organization’s needs rather than simply following a trend.
For businesses choosing a phone system, the question is no longer simply how to make and receive calls. It’s where those calls should live: on an internet-based VoIP system or a cellular network using VoLTE. Each has its advantages, and the right fit depends on your team’s needs.
Microsoft Bookings replaces the scheduling email chain with a self-service booking page tied to your real-time calendar availability. Clients choose their own time, receive automatic confirmations, and can reschedule or cancel without involving your staff. For businesses with appointment-based services, the efficiency gains are immediate and measurable.