McAfee upgraded its Mvision Unified Cloud Edge secure access service edge (SASE) platform with remote browser isolation (RBI) and data-loss prevention (DLP) incident management capabilities today at its Mpower virtual event.

Also at the event, McAfee launched a new extended detection and response platform as well as a cloud native application protection platform.

The addition of RBI and improved DLP build on the company's emerging SASE play, which it announced alongside the acquisition of Light Point in February. In fact, McAfee got its RBI technology from Light Point, and bought that company specifically to beef up its SASE.

According to Ash Kulkarni, CPO at McAfee, the shift to remote work has changed the threat landscape and forced enterprises to think differently about how they protect their applications and data wherever it resides.

"As your employees, as your partners, as your contractors are largely working remotely, they are at unprecedented risk," he said. "What this means is we need to take a comprehensive and differentiated approach to helping our customers be protected against threats and to also protect their data from exfiltration."

The capabilities announced today attempt to directly address these challenges by providing a last line of defense against malicious code with RBI while making it easier for customers to secure their data and remediate vulnerabilities before they're exploited.

"Remote browser isolation is a great way to build an impermeable moat around your device by executing all the web logic in the cloud," Kulkarni said.

RBI works by rendering webpages remotely and then sending a pixel-per-pixel rendering of the page to the user. This "means that your client gets the experience that they are using, or accessing, the site as they normally would, but because there's no content that's coming to their browser, they are always entirely protected."

However, the key to RBI is only to use it when absolutely necessary, he explained. Traditionally the RBI would be configured with static policies defining when it should and shouldn't be used.

The problem with this is "you never know what percentage of the websites that your users access are going to fall into that category, that are going to trigger that rule or not," he said. Because of this, "you often end up either sending too many of these URLs to the remote browser engine ... or you sent too few and that leaves you vulnerable."

To address these challenges, McAfee took a different approach. The vendor's RBI integrates directly into its Unified Cloud Edge platform, thus enabling it to be invoked anytime McAfee's threat intelligence or malware engine flags a page.

"Only then if the site is still unable to be conclusively determined as good or bad, does that URL automatically go through the remote browser isolation engine," Kulkarni said. "This means that users get the optimal experience at all times and still stay completely protected from ransomware."

Alongside the beta launch of its RBI, McAfee also rolled out DLP improvements. These aim to make it easier for enterprises to classify data as sensitive and improve incident tracking — two of the biggest challenges facing DLP programs, according to Kulkarni.

"When something happens on an endpoint, that typically shows up in a different console than if the alert gets triggered in the cloud," he said. "That makes it extremely challenging for an analyst to, first and foremost, triage all of these incidents correctly, and second appropriately train the user community so they don't cause these kind of events."

McAfee's new DLP incident management console attempts to resolve these challenges by providing customers with the tools to investigate and remediate the issues as they crop up.

McAfee's enhanced DLP incident management capabilities will be generally available next month, while users will be able to test out the company's RBI in beta later this year.