Blogs

Explore the forefront of cybersecurity through the Netskope Community Blog, where industry experts share their technical knowledge and insights. Stay ahead with in-depth analyses, best practices, and cutting-edge strategies for navigating the complex

  • 39 Topics
  • 12 Replies

39 Topics

jonbartlett
Netskope Employee
jonbartlettNetskope Employee
published in Blogs

Okta + Netskope = Zero Trust

A common use case using Netskope One SSE and Okta is to extend your zero trust perimeter using Okta Network zones and the Netskope NewEdge network. This will create an additional obstacle for an attacker to use compromised credentials and is recommended by Okta as a defense against credential stuffing attacks. The Netskope One client checks the device posture or compliance in real time via Device Classification to ensure that only Corporate managed devices are allowed to connect to Okta. The following Okta authentication policy rule scenarios are presented below: (these would also apply when using tunnels)Prerequisites for all policy scenarios Scenario: Restrict access to application(s) for users that originate from Netskope NewEdge Scenario: Restrict access from Netskope NewEdge in the United States  Scenario: Restrict access to originate from Netskope NewEdge and the user’s client IP originates in the United States Scenario: Restrict access for Administrators to originate from Netsk

3550
jonbartlett
Netskope Employee
3 months ago
R
Netskope Employee
ruthreshmNetskope Employee
posted in Blogs

Borderless WAN Hub Deployment & Configuration

Borderless WAN Hub Deployment & Configuration [Note] : The below setup is suitable with Meraki/Juniper Infrastructure BWAN Orchestrator tenant creation requires request to be opened with respective account representative (this document contains reference images from the test tenant portal)  Step1: BWAN Hub Deployment [with Model: NSG-1500] This device needs two ports configured on a Network - GE1 and GE2  GE1 port will be uplink to Meraki/Direct ISP and Wired connectivity Public IP: The public IP of the WAN interface must be explicitly configured in the Hub. This is the IP to which the Client will initiate the tunnel.  GE2 port will be Wireless connectivity GE1 - Port Configuration 1. Login to BWAN Orchestrator Portal  Login to BWAN Orchestrator Portal GE2 port will be Wireless connectivity GE1 - Port Configuration GE1 - Port Configuration : Activation Steps1. Login to BWAN Orchestrator Portal  2. Go to Dashboard > Manage and click (+)plus: sign to create Gateways 3. Select the

0
R
Netskope Employee
25 days ago
Kmaheshwari
Netskope Employee
KmaheshwariNetskope Employee
posted in Blogs

Netskope App for ServiceNow: Direct Integration with NextGen SWG

OverviewThe Netskope App for ServiceNow provides an end-to-end configuration management integration with capabilities to create ServiceNow Security Incident Response (SIR) data based on Netskope alerts. Administrators can also manage Netskope applications based on ServiceNow Configuration Item (CI) data. URL category and hash list can also be updated back to the configured tenant. Below is a general overview of how an administrator can configure a given set of Netskope NextGen SWG policies and how to best utilize the data shared for URLs from within ServiceNow. In case you missed it, check out our previous article, Netskope App for ServiceNow, which provides a non-technical overview of the latest Netskope App for ServiceNow. RequirementsNetskope Tenant  ServiceNow Instance with Admin access Setup StepsFor the basic setup please refer to the  https://docs.netskope.com/en/netskope-help/integrations-439794/solution-guides/servic[…]-integration-solution-guide/servicenow-with-netskope-secop

0
Kmaheshwari
Netskope Employee
2 months ago
Kmaheshwari
Netskope Employee
KmaheshwariNetskope Employee
posted in Blogs

New Netskope App for ServiceNow Security Incident Response

Enterprise security teams today face immense pressure from everyday incident response scenarios to the increased volume of alerts generated by disparate legacy security tools that limit both IT and security teams. What’s more, Security Operations (SecOps) and Incident Response (IR) teams lack the ability to do more than Block or Allow with their legacy secure web gateways. This friction limits how effective security teams can respond to a user request. That’s why together with ServiceNow, the new Netskope app for ServiceNow Security Incident Response (SIR) can provide greater incident management automation, reduce alert fatigue and overall operational costs to joint Netskope + ServiceNow customers.  The new Netskope App for ServiceNow SIR is now exclusively available at the ServiceNow Store.  The new Netskope App for ServiceNow modernizes threat and data protection workflows for SecOps and IR teams by offering more productive security outcomes for administrators, such as real-time user

0
Kmaheshwari
Netskope Employee
2 months ago
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Blogs

Add user and group via scim API

This one is more for my tech partners than for customers. If you tie your idp into your Netskope tenant you would never do this. This is really just for a lab environment. This will create users and groups that you can then use in policy.  Create API token for scimGo to Settings > Tools > REST API v2 > New Token  Create an API token that has the two scim endpoints added.  With the token copied and stored somewhere. Go to API Documentation.  Add the token to the Authorize In the scim section use the apis to view and create the users/groups.  Adding a userStart by adding the user. Be sure to change the userNamePOST /api/v2/scim/Users{  "schemas": [    "urn:ietf:params:scim:schemas:core:2.0:User"  ],  "userName": "taylorkelce",  "name": {    "familyName": "kelce",    "givenName": "taylor"  },  "active": true,  "emails": [    {      "value": "taylor@eras.tour",      "primary": true    }  ],  "externalId": "User-Ext_id",  "meta": {    "resourceType": "User"  }} Search for your user

0
Gary-Jenkins
Netskope Employee
3 months ago
NathanCatania
NathanCataniaNew Member
published in Blogs

A Guide to Deploy Netskope Cloud Exchange

In this article, we will cover how to deploy Netskope Cloud Exchange: A platform that facilitates the sharing of information between your different security vendors.   What is Cloud Exchange? Cloud Exchange (CE) is a platform that facilitates the exchange of information between your security and operations platforms.   What can Cloud Exchange do? Cloud Exchange is comprised of 5 key modules. You don’t have to use every module: only the ones that make sense based on the vendors in your current environment.   Threat Exchange The Cloud Threat Exchange (CTE) module automates the sharing of threat indicators between security platforms in your environment.   Ticket Orchestrator The Cloud Ticket Orchestrator (CTO) module automatically creates tickets and notifications in 3rd-party ITSM & collaboration systems (eg: ServiceNow, JIRA, Slack) to streamline incident response.   Risk Exchange The Cloud Risk Exchange (CRE) module facilitates normalization of both user a

20007
A
Netskope Employee
4 months ago
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Blogs

Illumio Netskope Cloud Threat Exchange Integration

I am super excited about this integration. This is our first one that dynamically controls role based  access to private apps.  This document explains how to install, configure, and use the Illumio plugin with the Cloud Threat Exchange (CTE) module of the Netskope Cloud Exchange platform. The Illumio plugin retrieves Workload Labels from the Illumio Zero Trust Segmentation platform (ZTS) and dynamically adjusts access via Netskope’s Private Apps as part of Zero Trust Network Access (ZTNA). These workloads will be hosted in your data center behind a Netskope NPA Publisher. Workload labels like Production, QA, or Quarantine will be brought into Netskope where policies can be applied based off of User Group membership. For example, only users that are part of your AD group QA would have access to workloads with a QA label or no users would be able to get to a Quarantine labeled workload.  PrerequisitesTo complete the plugin configuration, you’ll need:A Netskope Tenant (or multiple, for ex

0
Gary-Jenkins
Netskope Employee
4 months ago
B
Netskope Employee
borisgekhtmanNetskope Employee
posted in Blogs

Netskope for Mobile - Rollout Approach

There are many things that characterize good security hygiene. One obvious aspect is clearly defined trust boundaries and secure connectivity requirements. Allowing an unmanaged and untrusted device to be directly plugged into a trusted network would significantly violate one of the core tenets of the Zero Trust principle.   The truth is, enabling secure connectivity on mobile devices cannot be done in an ad-hoc manner, it must follow a best practice approach in order to be successful. While many internet security and remote access solutions offer a self-service workflow (e.g., go to the App/Play Store, download the client, authenticate, and connect), this can lead to potential risks. Sensitive data could end up on an untrusted and unmanaged device, which could get lost, stolen, or be used for unauthorized access and data exfiltration. This poses a real risk for both internal and SAAS applications, and it raises doubts about the effectiveness of the data protection perimeter. &nbs

0
B
Netskope Employee
11 months ago
M
Netskope Employee
mitchellNetskope Employee
posted in Blogs

Using the Netskope Client on Android with certificate pinned applications

Overview This is a short write-up on different approaches and nuances of Netskope Android client (NSClient) deployments, as it differs from, for example, the deployment of the Netskope iOS Client.This post will cover a rather easy and common deployment of steering and protecting certain app traffic to Netskope. This is similar to how iOS enables per-app VPN deployment. If you are interested is the high-level overview of our mobile capabilities, you might want to check out the following blog post:  Netskope's capabilities on mobile platforms - The Netskope Community The mentioned functionalities and configuration of the Netskope Android client are described in the documentation center: https://docs.netskope.com/en/netskope-client-supported-os-and-platform.html.   When you start deploying the NSClient with a Mobile Device Management (MDM) solution such as VMware Workspace and Microsoft Intune, the NSClient will be installed under the work profile. This is a neat feature in And

0
M
Netskope Employee
1 year ago
Kmaheshwari
Netskope Employee
KmaheshwariNetskope Employee
posted in Blogs

Netskope Private Access and Cloud Exchange running in Azure

Netskope Private Access and Cloud Exchange running in Azure Overview Using Netskope’s Private Access (NPA) can help secure workloads in Azure like deploying Netskope’s Cloud Exchange there. In this solutions guide NPA is used to front end a Cloud Exchange server that doesn’t have direct inbound internet access.    Requirements Netskope tenant with a NPA license Azure account Setup Steps Netskope  Configure a Netskope Publisher in your Tenant   Azure Deploy Virtual Machine Netskope Publisher   Cloud Exchange Setting up Cloud Exchange in Azure Deploy Virtual Machine Ubuntu Server Add Access to Cloud Exchange via NPA Setup Cloud Exchange on Ubuntu Server   Verify Netskope Tenant sees your publisher Check your client for the NPA tunnel Try to access cloud exchange on your private IP Configure a Netskope Publisher in your Tenant Go to your Netskope Tenant > Settings > Security Cloud Platform > Publishers Click New Publisher    

0
Kmaheshwari
Netskope Employee
1 year ago
B
Netskope Employee
borisgekhtmanNetskope Employee
posted in Blogs

Netskope's Capabilities on Mobile Platforms

I am excited to start a series of posts covering Netskope for Mobile. This kick-off note will provide an overview of Netskope's capabilities on mobile platforms. In the upcoming posts, I will delve into greater detail on enabling Netskope for both corporate and BYOD devices, enforcing data perimeter on mobile, navigating SSL Inspection and certificate pinning challenges, and many other topics.   Why Netskope on Mobile? While there are significant differences in capabilities, user experience, ownership models, and even weight and portability, mobile devices are similar to desktops in that they can be used to browse the internet, access personal and corporate applications, and move data around. Consequently, our information security policies, tools, and procedures are expected to cover both desktop and mobile use cases. Based on my observations, many organizations have significant gaps in their security posture between corporate desktops and mobile platforms, and Netskope can defini

0
B
Netskope Employee
1 year ago
mferguson
mfergusonNew Member
posted in Blogs

Netskope Administration for Departing Users

Netskope Administration for Departing Users   When a user announces their departure from the organization, it's crucial to implement stringent controls and checks to protect corporate data and resources. The user's account should immediately be placed into a "Leaving Users" group within their Identity Provider or Directory Services. This move should trigger a set of pre-configured policies for these accounts.   Critical Policies to be Enabled Restricted Activities: This policy limits certain user activities to prevent potential loss of data: Unable to Delete Files: Prevents the user from unintentionally or maliciously deleting crucial company information. Unable to Share Files to Any Non-Corporate User: Ensures sensitive company data isn't shared externally. Unable to Download from Salesforce: Ensure customer and prospect data from being downloaded. Restricted Instances: This policy confines the user's interaction with certain instances: Unable to Upload any files to Non-

0
mferguson
1 year ago
mferguson
mfergusonNew Member
posted in Blogs

Netskope Administration for Contractors & Third Parties

Netskope Administration for Contractors & Third Parties   Contractors and third parties often require access to company resources to fulfill their tasks, yet they exist outside the organization's direct control and may not be fully aligned with the company's security culture or protocols. The necessity for elevated or different security protocols for contractors and third parties stems from the unique risks these roles introduce.  This document will outline some approaches within Netskope to protect business assets from contractors and third parties.   Deployment Modes   Forward Proxy (Netskope Client Installed)   For contractors or third parties given a managed corporate device with a Netskope Client installed, we recommend using Netskope's Forward Proxy Mode. This mode offers granular control over web traffic and cloud app usage, ensuring secure access and data protection.   Pros: Large Scope Access Control: Forward proxies can be used to limit acce

0
mferguson
1 year ago
mferguson
mfergusonNew Member
posted in Blogs

Netskope Administration for Developers

Netskope Administration for Developers   While it is necessary to provide adequate security measures in your environment, it's important to be aware of the unique needs of your developers and coders. Their work often involves accessing and interacting with various applications like GitHub, which may lead to issues if proxy services interfere with their work. Here are some recommendations:   Bypass SSL Inspection for Specific Applications   While not generally recommended, it may be beneficial to bypass SSL Inspection for applications such as GitHub, which developers frequently use. This ensures that developers' traffic is not interfered with during their code creation. Instead, opt to utilize Netskope's API-enabled protection to provide visibility and partial control over the data inside GitHub. Remember that GitHub traffic would be inspected if accessed by anyone outside of the Developers User Group.   Deployment Modes   To cater to developers' needs, you have

0
mferguson
1 year ago
D
Netskope Employee
DiogenesNetskope Employee
posted in Blogs

Deploy Netskope Client for Mac using Jumpcloud MDM

In this article, we will cover how to silent deploy the Netskope Client on Mac devices using IDP enrollment mode with Jumpcloud MDM. Prerequisite: SAML Forward Proxy integration with Jumpcloud as an IDP must be configured prior to deploying the Netskope Client. Configuration Steps 1 - Install Netskope CertificatesDownload both certificates from the Netskope Tenant on Settings > Manage > Certificates > Signing CA:  Jumpcloud allows you to choose only one certificate per policy. Follow the steps off the link Create a Mac or iOS Install Certificate Policy  and create two certificate policies on Jumpcloud. One for the Netskope Root Certificate and one for the Netskope Intermediate Certificate: Approve System Extension and Network ExtensionCreate a new Jumpcloud policy following the steps of the link Create Mac System Extension Policy  to Approve the System Extension and use the following details on the policy: Team ID: 24W52P9M7W Bundle IDs: com.netskope.client.Netskope-Client.Net

0
D
Netskope Employee
1 year ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
posted in Blogs

How to use the Universal Connector to govern suspicious cloud services

Recently I stumbled upon an interesting campaign carried out by a threat actor dubbed Dark Pink and characterized by the exploitation of a legitimate cloud service, GitHub, to host the malicious payload. GitHub is a well-known service, categorized as "Development Tools" and "Technology" within the Next Gen SWG, and for which a dedicated connector allows to enforce granular security policies in terms of adaptive access control, DLP and threat protection.    However, it is common for threat actors to abuse even less-known cloud services for malicious purposes such as malware distribution, command and control and data exfiltration, and the above campaign is no exception. As a matter of fact in the above mentioned case, the attackers exploited an additional less-known cloud service, textbin[.]net, to deliver the malicious payload.   Netskope customers are protected out-of-the-box from the malicious exploitation of textbin[.]net as this service is already classified as "Secur

0
ppasseri
Netskope Employee
1 year ago
S
Netskope Employee
scarlileNetskope Employee
asked in Blogs

Enabling Multi-Factor-Authentication for Netskope Admins - How to set up Microsoft Authenticator

Securing administrative access to the Netskope tenant is an important security control.  When Single Sign-On (SSO) is not an appropriate choice for some administrators, Multi-Factor Authentication (MFA) should be used.   Docs.netskope.com describes the process for enabling MFA for local Netskope admins who are not managed via SSO.  The default authenticator is Google Authenticator, but other ones can be used.   https://docs.netskope.com/en/multi-factor-authentication-for-netskope-admins.html   This article describes how to set up Microsoft Authenticator.   1) Enable MFA on tenant     2) Next time the tenant admin logs into Netskope tenant   3) Tenant admin presented with authenticator setup (note Google Authenticator default)   4) Admin opens Microsoft Authenticator app on device   5) Add Work or school account   6) Scan QR code from Microsoft Authenticator   7) Use Authenticator code when prompted to login to Netsk

2
S
Netskope Employee
1 year ago
B
Bharath-MuraliNew Member III
posted in Blogs

Introducing the new "Notification Portal" !!!

This new “Notification portal” provides customers an early access, easy to consume view into product changes coming in the next Release and changes being released as part of dynamic updates that are not part of the regular release cycle. These changes can affect enforcement outcomes and an early access view gives customers sufficient time to plan for config optimisations.   The Portal provides a view of:-   -Future/Upcoming Release (For Example You can see changes coming in R100 on the portal now.)-Weekly Changes (These are changes pushed as part of dynamic updates on a weekly cadence.)-Current Release (For reference in case the user has missed changes in the current release.)-Previous Release (For historical reference.) Customer must use their Netskope Support account to access this portal.   In the current version notification portal provides the ability to view product updates/changes to App Connector, App Category and CCI. The portal also provides the abili

0
B
1 year ago
B
Netskope Employee
borisgekhtmanNetskope Employee
posted in Blogs

Netskope Private Access for Windows Autopilot

Solution Overview   Windows Autopilot Overview   Traditionally IT administrators spend a lot of time on building and customizing OS images, compatibility testing with various device makes and models etc. Every device typically goes through a re-imaging process with additional pre and post validation to make sure it is ready for use in the field. This process implies major cost and time effort. Windows Autopilot is a collection of Microsoft technologies working in concert that help to simplify and streamline the bulk deployment, setup, and configuration of Windows 10/11 devices in organization to ensure they are provisioned and locked down according to corporate standards. Autopilot also can be used for device reset, repurpose and recovery.    The following diagram shows a process overview of a typical device procurement and onboarding lifecycle:   Windows Autopilot enables customers to: Recognize company owned devices and associate them with appropriate enrol

0
B
Netskope Employee
1 year ago
S
sbrownNew Member
posted in Blogs

Managing Netskope Publishers in AWS using Terraform

Introduction   In my previous post I introduced the Netskope Provider for Terraform and showed you how it can be used to deploy publishers and applications inside of a Netskope tenant. While I think this capability on it's own is extremely exciting, I know we can do better. When looking at creating automation for Netskope, our goal was always to ensure a new publisher including the underlying infrastructure could be managed in the same configuration. In fact this concept is one of the primary reasons that we choose to use Terraform as our initial entry into Infrastructure as Code(IaC). In this post I will expand upon what we introduced previously by walking you through how to use the Terraform Module for automating Netskope Publishers running in Amazon EC2. This should be fun!   What is a module?   For those that are new to Terraform let me start by explaining what a module is. The definition of a module is something along the lines of 1 or more .tf configuration files i

2
S
1 year ago
A
Netskope Employee
AFunkhouserNetskope Employee
posted in Blogs

Threat Vulnerability Management: External Attack Surface Management

What is attack surface management?    Attack surface management (ASM) is the continued discovery, classification, and monitoring of an organization's external assets. It is crucial that teams leverage the hacker mindset to look for attack vectors into the organization when performing ASM in order to prioritize the most risk prone assets for remediation. To get the most out of an ASM program, teams should leverage tactics techniques and procedures (TTP) in use by threat actors. Not only is this good practice to develop the hacker mindset but also determine the hygiene of the current security implemented by the organization. Risk in ASM typically comes from three common areas which are vulnerabilities, misconfigurations, and weak/default credentials. The goals of attack surface management are identifying and gauging the risk, and reducing the attack surface. Attack surface management aims to find what assets are being exposed by the applications, networks, and devices in your e

0
A
Netskope Employee
2 years ago
S
sbrownNew Member
posted in Blogs

Introducing the Netskope Terraform Provider

Introduction   I am super excited to announce that the Netskope security cloud can now be managed as code. "How is this possible?", you might ask. The answer is by using the newly released Terraform provider for Netskope. This has been in the works for some time now and is the first time our SSE platform has been integrated directly into an Infrastructure as Code tool. This will allow customers and partners to automate deployment of Netskope resources using Terraform. By taking a "Netskope as Code" strategy customers will be able to easily create, modify, and delete infrastructure inside of the platform. This first release has support for our ZTNA solution (Netskope Private Access or NPA) and includes resources and data sources for Private Access Publishers and Applications. Get ready to supercharge your NPA deployment by creating a simple, repeatable automated configuration.   What is "Infrastructure as Code" and why Terraform   Infrastructure as Code (IaC) is

0
S
2 years ago
NathanCatania
NathanCataniaNew Member
posted in Blogs

How-to configure SSO with Okta for Netskope Cloud Exchange

  This article will cover how to configure Single-Sign-On (SSO) for the Netskope Cloud Exchange (CE) platform using Okta. This will allow you to manage administrator access to CE from purely within Okta, rather than configuring administrators on the platform manually. Cloud Exchange is different from the standard Netskope tenant you would have access to as a customer, and facilitates the exchange of information between your various security and operations platforms. For information on what Cloud Exchange is (including how to deploy it), please see here.   Create a new App Integration Log in to your Okta administrator console and from the left-side menubar, navigate to Applications > Applications.   Select Create App Integration. Select SAML 2.0 as the sign-in method and click Next. On the next screen, set the App name to be Netskope Cloud Exchange and provide an app logo if required. Click Next to proceed to the Configure SAML section.   Copy the Cloud Exc

0
NathanCatania
2 years ago
NathanCatania
NathanCataniaNew Member
posted in Blogs

How-to configure SSO with Azure AD for Netskope Cloud Exchange

  This article will cover how to configure Single-Sign-On (SSO) for the Netskope Cloud Exchange (CE) platform using Azure Active Directory (AAD). This will allow you to manage administrator access to CE from purely within AAD, rather than configuring administrators on the platform manually.   Cloud Exchange is different from the standard Netskope tenant you would have access to as a customer, and facilitates the exchange of information between your various security and operations platforms. For information on what Cloud Exchange is (including how to deploy it), please see here.   Create a new Enterprise Application Log into the Azure AD portal, and go to “Enterprise Applications”. You may need to search for this at the top of the portal. Click New application. Click Create your own application and name the application Netskope Cloud Exchange.   Select the 3rd option to create a non-gallery app: Integrate any other application you don’t find in the gallery.   Clic

0
NathanCatania
2 years ago
D
Netskope Employee
dvoletiNetskope Employee
posted in Blogs

Allow our Risk Management team the ability to tag our Corporate managed apps in the CCI UI

To edit (tag) a single app, hover over the app on the main page and click the Edit tag icon. To tag multiple apps, select the checkbox in the top left corner for each app. Click the Edit tags icon in the top right corner of the page.   Tip: To select all apps shown on the page, click the Select All icon beside the Edit tags icon. In the Edit Tags dialog box, there are two dropdown lists for tagging the chosen apps. The left dropdown list allows you to specify whether the app is sanctioned or unsanctioned. The right dropdown list allows you to specify whether the app is consumer, departmental, or enterprise level. To create a custom tag or to remove a tag, use the field below the dropdown lists.

0
D
Netskope Employee
2 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings