Skip to main content
  • EN

Blogs

Explore the forefront of cybersecurity through the Netskope Community Blog, where industry experts share their technical knowledge and insights. Stay ahead with in-depth analyses, best practices, and cutting-edge strategies for navigating the complex

  • 42 Topics
  • 16 Replies
42 Topics
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
published in Blogs
Okta + Netskope = Zero Trust

A common use case using Netskope One SSE and Okta is to extend your zero trust perimeter using Okta Network zones and the Netskope NewEdge network. This will create an additional obstacle for an attacker to use compromised credentials and is recommended by Okta as a defense against credential stuffing attacks. The Netskope One client checks the device posture or compliance in real time via Device Classification to ensure that only Corporate managed devices are allowed to connect to Okta. The following Okta authentication policy rule scenarios are presented below: (these would also apply when using tunnels)Prerequisites for all policy scenarios Scenario: Restrict access to application(s) for users that originate from Netskope NewEdge Scenario: Restrict access from Netskope NewEdge in the United States  Scenario: Restrict access to originate from Netskope NewEdge and the user’s client IP originates in the United States Scenario: Restrict access for Administrators to originate from Netsk

5200
Gary-Jenkins
Netskope Employee
4 months ago
D
Netskope Employee
DiogenesNetskope Employee
posted in Blogs
Deploy Netskope Client for Mac using Jumpcloud MDM

In this article, we will cover how to silent deploy the Netskope Client on Mac devices using IDP enrollment mode with Jumpcloud MDM. Prerequisite: SAML Forward Proxy integration with Jumpcloud as an IDP must be configured prior to deploying the Netskope Client. Configuration Steps 1 - Install Netskope CertificatesDownload both certificates from the Netskope Tenant on Settings > Manage > Certificates > Signing CA:  Jumpcloud allows you to choose only one certificate per policy. Follow the steps off the link Create a Mac or iOS Install Certificate Policy  and create two certificate policies on Jumpcloud. One for the Netskope Root Certificate and one for the Netskope Intermediate Certificate: Approve System Extension and Network ExtensionCreate a new Jumpcloud policy following the steps of the link Create Mac System Extension Policy  to Approve the System Extension and use the following details on the policy: Team ID: 24W52P9M7W Bundle IDs: com.netskope.client.Netskope-Client.Net

3
G
8 days ago
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Blogs
Add user and group via scim API

This one is more for my tech partners than for customers. If you tie your idp into your Netskope tenant you would never do this. This is really just for a lab environment. This will create users and groups that you can then use in policy.  Create API token for scimGo to Settings > Tools > REST API v2 > New Token  Create an API token that has the two scim endpoints added.  With the token copied and stored somewhere. Go to API Documentation.  Add the token to the Authorize In the scim section use the apis to view and create the users/groups.  Adding a userStart by adding the user. Be sure to change the userNamePOST /api/v2/scim/Users{  "schemas": [    "urn:ietf:params:scim:schemas:core:2.0:User"  ],  "userName": "taylorkelce",  "name": {    "familyName": "kelce",    "givenName": "taylor"  },  "active": true,  "emails": [    {      "value": "taylor@eras.tour",      "primary": true    }  ],  "externalId": "User-Ext_id",  "meta": {    "resourceType": "User"  }} Search for your user

1
P
18 days ago
T
Netskope Employee
twillisNetskope Employee
posted in Blogs
Netskope Client Integration with OneLogin

This article is going to cover how to leverage Onelogin for Netskope Client Authentication via SAML, as well as how to use SCIM Provisioning with Onelogin. SCIM Provisioning Netskope supports provisioning of users and user groups authenticated via OneLogin. The Netskope SCIM app supports the following:Push New Users: New users created through Onelogin will also be created in Netskope Push Groups: Groups created through Onelogin will also be created in Netskope Push Profile Updates: Updates made to the users profile through Onelogin will also be pushed to Netskope Push User Deletion: Deleting a user in Onelogin will also delete the user in Netskope Push User Suspension: By default a user suspended in Onelogin will be deleted in Netskope, If the provisioning configuration in the Netskope Onelogin App is set to Suspend. If you would like suspended users to continue to exist in Netskope, set the provisioning configuration in the Netskope Onelogin app to Do Nothing.  Netskope Configuratio

0
T
Netskope Employee
19 days ago
M
Netskope Employee
mgulledgeNetskope Employee
posted in Blogs
Achieving High Availability for Azure Workloads using Netskope Borderless WAN and BGP

OverviewThis article encompasses a detailed step by step guide for configuring and deploying Netskopes Borderless SD WAN in Azure and achieving High Availability and Load Sharing with the Azure Route Server.  Use CaseThe use case for this scenario is having always-on connectivity for your Azure Workloads to Netskopes Next GEN Secure Web Gateway for workstation internet access.  With this use case, workstations deployed within a single VNET or across multiple VNETs can have secure connectivity to the Netskope platform. BGP is utilized to provide resiliency, symmetry and load sharing across Netskope Borderless WAN Gateways in the Azure cloud. ArchitectureIn the above architecture I have 2 Network Virtual Appliances that are the Netskope SASE Gateways. Each Gateway VM is performing an EBGP peering relationship with the Azure Route Server. The Netskope Gateways are each advertising a default route that will later be used to perform ECMP and High Availability for the workloads inside your V

0
M
Netskope Employee
1 month ago
M
Netskope Employee
mgulledgeNetskope Employee
asked in Blogs
Achieving High Availability for Azure Workloads using Netskope Borderless WAN and BGP

OverviewThis article encompasses a detailed step by step guide for configuring and deploying Netskopes Borderless SD WAN in Azure and achieving High Availability and Load Sharing with the Azure Route Server.  Use CaseThe use case for this scenario is having always-on connectivity for your Azure Workloads to Netskopes Next GEN Secure Web Gateway for workstation internet access.  With this use case, workstations deployed within a single VNET or across multiple VNETs can have secure connectivity to the Netskope platform. BGP is utilized to provide resiliency, symmetry and load sharing across Netskope Borderless WAN Gateways in the Azure cloud. ArchitectureIn the above architecture I have 2 Network Virtual Appliances that are the Netskope SASE Gateways. Each Gateway VM is performing an EBGP peering relationship with the Azure Route Server. The Netskope Gateways are each advertising a default route that will later be used to perform ECMP and High Availability for the workloads inside your V

0
M
Netskope Employee
1 month ago
R
Netskope Employee
ruthreshmNetskope Employee
posted in Blogs
Borderless WAN Hub Deployment & Configuration

Borderless WAN Hub Deployment & Configuration [Note] : The below setup is suitable with Meraki/Juniper Infrastructure BWAN Orchestrator tenant creation requires request to be opened with respective account representative (this document contains reference images from the test tenant portal)  Step1: BWAN Hub Deployment [with Model: NSG-1500] This device needs two ports configured on a Network - GE1 and GE2  GE1 port will be uplink to Meraki/Direct ISP and Wired connectivity Public IP: The public IP of the WAN interface must be explicitly configured in the Hub. This is the IP to which the Client will initiate the tunnel.  GE2 port will be Wireless connectivity GE1 - Port Configuration 1. Login to BWAN Orchestrator Portal  Login to BWAN Orchestrator Portal GE2 port will be Wireless connectivity GE1 - Port Configuration GE1 - Port Configuration : Activation Steps1. Login to BWAN Orchestrator Portal  2. Go to Dashboard > Manage and click (+)plus: sign to create Gateways 3. Select the

0
R
Netskope Employee
2 months ago
Kmaheshwari
Netskope Employee
KmaheshwariNetskope Employee
posted in Blogs
Netskope App for ServiceNow: Direct Integration with NextGen SWG

OverviewThe Netskope App for ServiceNow provides an end-to-end configuration management integration with capabilities to create ServiceNow Security Incident Response (SIR) data based on Netskope alerts. Administrators can also manage Netskope applications based on ServiceNow Configuration Item (CI) data. URL category and hash list can also be updated back to the configured tenant. Below is a general overview of how an administrator can configure a given set of Netskope NextGen SWG policies and how to best utilize the data shared for URLs from within ServiceNow. In case you missed it, check out our previous article, Netskope App for ServiceNow, which provides a non-technical overview of the latest Netskope App for ServiceNow. RequirementsNetskope Tenant  ServiceNow Instance with Admin access Setup StepsFor the basic setup please refer to the  https://docs.netskope.com/en/netskope-help/integrations-439794/solution-guides/servic[…]-integration-solution-guide/servicenow-with-netskope-secop

0
Kmaheshwari
Netskope Employee
4 months ago
Kmaheshwari
Netskope Employee
KmaheshwariNetskope Employee
posted in Blogs
New Netskope App for ServiceNow Security Incident Response

Enterprise security teams today face immense pressure from everyday incident response scenarios to the increased volume of alerts generated by disparate legacy security tools that limit both IT and security teams. What’s more, Security Operations (SecOps) and Incident Response (IR) teams lack the ability to do more than Block or Allow with their legacy secure web gateways. This friction limits how effective security teams can respond to a user request. That’s why together with ServiceNow, the new Netskope app for ServiceNow Security Incident Response (SIR) can provide greater incident management automation, reduce alert fatigue and overall operational costs to joint Netskope + ServiceNow customers.  The new Netskope App for ServiceNow SIR is now exclusively available at the ServiceNow Store.  The new Netskope App for ServiceNow modernizes threat and data protection workflows for SecOps and IR teams by offering more productive security outcomes for administrators, such as real-time user

0
Kmaheshwari
Netskope Employee
4 months ago
NathanCatania
NathanCataniaNew Member
published in Blogs
A Guide to Deploy Netskope Cloud Exchange

In this article, we will cover how to deploy Netskope Cloud Exchange: A platform that facilitates the sharing of information between your different security vendors.   What is Cloud Exchange? Cloud Exchange (CE) is a platform that facilitates the exchange of information between your security and operations platforms.   What can Cloud Exchange do? Cloud Exchange is comprised of 5 key modules. You don’t have to use every module: only the ones that make sense based on the vendors in your current environment.   Threat Exchange The Cloud Threat Exchange (CTE) module automates the sharing of threat indicators between security platforms in your environment.   Ticket Orchestrator The Cloud Ticket Orchestrator (CTO) module automatically creates tickets and notifications in 3rd-party ITSM & collaboration systems (eg: ServiceNow, JIRA, Slack) to streamline incident response.   Risk Exchange The Cloud Risk Exchange (CRE) module facilitates normalization of both user a

23937
A
Netskope Employee
6 months ago
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Blogs
Illumio Netskope Cloud Threat Exchange Integration

I am super excited about this integration. This is our first one that dynamically controls role based  access to private apps.  This document explains how to install, configure, and use the Illumio plugin with the Cloud Threat Exchange (CTE) module of the Netskope Cloud Exchange platform. The Illumio plugin retrieves Workload Labels from the Illumio Zero Trust Segmentation platform (ZTS) and dynamically adjusts access via Netskope’s Private Apps as part of Zero Trust Network Access (ZTNA). These workloads will be hosted in your data center behind a Netskope NPA Publisher. Workload labels like Production, QA, or Quarantine will be brought into Netskope where policies can be applied based off of User Group membership. For example, only users that are part of your AD group QA would have access to workloads with a QA label or no users would be able to get to a Quarantine labeled workload.  PrerequisitesTo complete the plugin configuration, you’ll need:A Netskope Tenant (or multiple, for ex

0
Gary-Jenkins
Netskope Employee
6 months ago
B
Netskope Employee
borisgekhtmanNetskope Employee
posted in Blogs
Netskope for Mobile - Rollout Approach

There are many things that characterize good security hygiene. One obvious aspect is clearly defined trust boundaries and secure connectivity requirements. Allowing an unmanaged and untrusted device to be directly plugged into a trusted network would significantly violate one of the core tenets of the Zero Trust principle.   The truth is, enabling secure connectivity on mobile devices cannot be done in an ad-hoc manner, it must follow a best practice approach in order to be successful. While many internet security and remote access solutions offer a self-service workflow (e.g., go to the App/Play Store, download the client, authenticate, and connect), this can lead to potential risks. Sensitive data could end up on an untrusted and unmanaged device, which could get lost, stolen, or be used for unauthorized access and data exfiltration. This poses a real risk for both internal and SAAS applications, and it raises doubts about the effectiveness of the data protection perimeter. &nbs

0
B
Netskope Employee
1 year ago