Blogs

Enterprise security teams today face immense pressure from everyday incident response scenarios to the increased volume of alerts generated by disparate legacy security tools that limit both IT and security teams. What’s more, Security Operations (SecOps) and Incident Response (IR) teams lack the ability to do more than Block or Allow with their legacy secure web gateways. This friction limits how effective security teams can respond to a user request. That’s why together with ServiceNow, the new Netskope app for ServiceNow Security Incident Response (SIR) can provide greater incident management automation, reduce alert fatigue and overall operational costs to joint Netskope + ServiceNow customers.  The new Netskope App for ServiceNow SIR is now exclusively available at the ServiceNow Store.  The new Netskope App for ServiceNow modernizes threat and data protection workflows for SecOps and IR teams by offering more productive security outcomes for administrators, such as real-time user

I am super excited about this integration. This is our first one that dynamically controls role based  access to private apps.  This document explains how to install, configure, and use the Illumio plugin with the Cloud Threat Exchange (CTE) module of the Netskope Cloud Exchange platform. The Illumio plugin retrieves Workload Labels from the Illumio Zero Trust Segmentation platform (ZTS) and dynamically adjusts access via Netskope’s Private Apps as part of Zero Trust Network Access (ZTNA). These workloads will be hosted in your data center behind a Netskope NPA Publisher. Workload labels like Production, QA, or Quarantine will be brought into Netskope where policies can be applied based off of User Group membership. For example, only users that are part of your AD group QA would have access to workloads with a QA label or no users would be able to get to a Quarantine labeled workload.  PrerequisitesTo complete the plugin configuration, you’ll need:A Netskope Tenant (or multiple, for ex

There are many things that characterize good security hygiene. One obvious aspect is clearly defined trust boundaries and secure connectivity requirements. Allowing an unmanaged and untrusted device to be directly plugged into a trusted network would significantly violate one of the core tenets of the Zero Trust principle.   The truth is, enabling secure connectivity on mobile devices cannot be done in an ad-hoc manner, it must follow a best practice approach in order to be successful. While many internet security and remote access solutions offer a self-service workflow (e.g., go to the App/Play Store, download the client, authenticate, and connect), this can lead to potential risks. Sensitive data could end up on an untrusted and unmanaged device, which could get lost, stolen, or be used for unauthorized access and data exfiltration. This poses a real risk for both internal and SAAS applications, and it raises doubts about the effectiveness of the data protection perimeter. &nbs

Overview This is a short write-up on different approaches and nuances of Netskope Android client (NSClient) deployments, as it differs from, for example, the deployment of the Netskope iOS Client.This post will cover a rather easy and common deployment of steering and protecting certain app traffic to Netskope. This is similar to how iOS enables per-app VPN deployment. If you are interested is the high-level overview of our mobile capabilities, you might want to check out the following blog post:  Netskope's capabilities on mobile platforms - The Netskope Community The mentioned functionalities and configuration of the Netskope Android client are described in the documentation center: https://docs.netskope.com/en/netskope-client-supported-os-and-platform.html.   When you start deploying the NSClient with a Mobile Device Management (MDM) solution such as VMware Workspace and Microsoft Intune, the NSClient will be installed under the work profile. This is a neat feature in And

Netskope Private Access and Cloud Exchange running in Azure Overview Using Netskope’s Private Access (NPA) can help secure workloads in Azure like deploying Netskope’s Cloud Exchange there. In this solutions guide NPA is used to front end a Cloud Exchange server that doesn’t have direct inbound internet access.    Requirements Netskope tenant with a NPA license Azure account Setup Steps Netskope  Configure a Netskope Publisher in your Tenant   Azure Deploy Virtual Machine Netskope Publisher   Cloud Exchange Setting up Cloud Exchange in Azure Deploy Virtual Machine Ubuntu Server Add Access to Cloud Exchange via NPA Setup Cloud Exchange on Ubuntu Server   Verify Netskope Tenant sees your publisher Check your client for the NPA tunnel Try to access cloud exchange on your private IP Configure a Netskope Publisher in your Tenant Go to your Netskope Tenant > Settings > Security Cloud Platform > Publishers Click New Publisher    

I am excited to start a series of posts covering Netskope for Mobile. This kick-off note will provide an overview of Netskope's capabilities on mobile platforms. In the upcoming posts, I will delve into greater detail on enabling Netskope for both corporate and BYOD devices, enforcing data perimeter on mobile, navigating SSL Inspection and certificate pinning challenges, and many other topics.   Why Netskope on Mobile? While there are significant differences in capabilities, user experience, ownership models, and even weight and portability, mobile devices are similar to desktops in that they can be used to browse the internet, access personal and corporate applications, and move data around. Consequently, our information security policies, tools, and procedures are expected to cover both desktop and mobile use cases. Based on my observations, many organizations have significant gaps in their security posture between corporate desktops and mobile platforms, and Netskope can defini

Netskope Administration for Departing Users   When a user announces their departure from the organization, it's crucial to implement stringent controls and checks to protect corporate data and resources. The user's account should immediately be placed into a "Leaving Users" group within their Identity Provider or Directory Services. This move should trigger a set of pre-configured policies for these accounts.   Critical Policies to be Enabled Restricted Activities: This policy limits certain user activities to prevent potential loss of data: Unable to Delete Files: Prevents the user from unintentionally or maliciously deleting crucial company information. Unable to Share Files to Any Non-Corporate User: Ensures sensitive company data isn't shared externally. Unable to Download from Salesforce: Ensure customer and prospect data from being downloaded. Restricted Instances: This policy confines the user's interaction with certain instances: Unable to Upload any files to Non-

Netskope Administration for Contractors & Third Parties   Contractors and third parties often require access to company resources to fulfill their tasks, yet they exist outside the organization's direct control and may not be fully aligned with the company's security culture or protocols. The necessity for elevated or different security protocols for contractors and third parties stems from the unique risks these roles introduce.  This document will outline some approaches within Netskope to protect business assets from contractors and third parties.   Deployment Modes   Forward Proxy (Netskope Client Installed)   For contractors or third parties given a managed corporate device with a Netskope Client installed, we recommend using Netskope's Forward Proxy Mode. This mode offers granular control over web traffic and cloud app usage, ensuring secure access and data protection.   Pros: Large Scope Access Control: Forward proxies can be used to limit acce

Netskope Administration for Developers   While it is necessary to provide adequate security measures in your environment, it's important to be aware of the unique needs of your developers and coders. Their work often involves accessing and interacting with various applications like GitHub, which may lead to issues if proxy services interfere with their work. Here are some recommendations:   Bypass SSL Inspection for Specific Applications   While not generally recommended, it may be beneficial to bypass SSL Inspection for applications such as GitHub, which developers frequently use. This ensures that developers' traffic is not interfered with during their code creation. Instead, opt to utilize Netskope's API-enabled protection to provide visibility and partial control over the data inside GitHub. Remember that GitHub traffic would be inspected if accessed by anyone outside of the Developers User Group.   Deployment Modes   To cater to developers' needs, you have

Securing administrative access to the Netskope tenant is an important security control.  When Single Sign-On (SSO) is not an appropriate choice for some administrators, Multi-Factor Authentication (MFA) should be used.   Docs.netskope.com describes the process for enabling MFA for local Netskope admins who are not managed via SSO.  The default authenticator is Google Authenticator, but other ones can be used.   https://docs.netskope.com/en/multi-factor-authentication-for-netskope-admins.html   This article describes how to set up Microsoft Authenticator.   1) Enable MFA on tenant     2) Next time the tenant admin logs into Netskope tenant   3) Tenant admin presented with authenticator setup (note Google Authenticator default)   4) Admin opens Microsoft Authenticator app on device   5) Add Work or school account   6) Scan QR code from Microsoft Authenticator   7) Use Authenticator code when prompted to login to Netsk

This new “Notification portal” provides customers an early access, easy to consume view into product changes coming in the next Release and changes being released as part of dynamic updates that are not part of the regular release cycle. These changes can affect enforcement outcomes and an early access view gives customers sufficient time to plan for config optimisations.   The Portal provides a view of:-   -Future/Upcoming Release (For Example You can see changes coming in R100 on the portal now.)-Weekly Changes (These are changes pushed as part of dynamic updates on a weekly cadence.)-Current Release (For reference in case the user has missed changes in the current release.)-Previous Release (For historical reference.) Customer must use their Netskope Support account to access this portal.   In the current version notification portal provides the ability to view product updates/changes to App Connector, App Category and CCI. The portal also provides the abili

Solution Overview   Windows Autopilot Overview   Traditionally IT administrators spend a lot of time on building and customizing OS images, compatibility testing with various device makes and models etc. Every device typically goes through a re-imaging process with additional pre and post validation to make sure it is ready for use in the field. This process implies major cost and time effort. Windows Autopilot is a collection of Microsoft technologies working in concert that help to simplify and streamline the bulk deployment, setup, and configuration of Windows 10/11 devices in organization to ensure they are provisioned and locked down according to corporate standards. Autopilot also can be used for device reset, repurpose and recovery.    The following diagram shows a process overview of a typical device procurement and onboarding lifecycle:   Windows Autopilot enables customers to: Recognize company owned devices and associate them with appropriate enrol

What is attack surface management?    Attack surface management (ASM) is the continued discovery, classification, and monitoring of an organization's external assets. It is crucial that teams leverage the hacker mindset to look for attack vectors into the organization when performing ASM in order to prioritize the most risk prone assets for remediation. To get the most out of an ASM program, teams should leverage tactics techniques and procedures (TTP) in use by threat actors. Not only is this good practice to develop the hacker mindset but also determine the hygiene of the current security implemented by the organization. Risk in ASM typically comes from three common areas which are vulnerabilities, misconfigurations, and weak/default credentials. The goals of attack surface management are identifying and gauging the risk, and reducing the attack surface. Attack surface management aims to find what assets are being exposed by the applications, networks, and devices in your e

Introduction   I am super excited to announce that the Netskope security cloud can now be managed as code. "How is this possible?", you might ask. The answer is by using the newly released Terraform provider for Netskope. This has been in the works for some time now and is the first time our SSE platform has been integrated directly into an Infrastructure as Code tool. This will allow customers and partners to automate deployment of Netskope resources using Terraform. By taking a "Netskope as Code" strategy customers will be able to easily create, modify, and delete infrastructure inside of the platform. This first release has support for our ZTNA solution (Netskope Private Access or NPA) and includes resources and data sources for Private Access Publishers and Applications. Get ready to supercharge your NPA deployment by creating a simple, repeatable automated configuration.   What is "Infrastructure as Code" and why Terraform   Infrastructure as Code (IaC) is

  This article will cover how to configure Single-Sign-On (SSO) for the Netskope Cloud Exchange (CE) platform using Okta. This will allow you to manage administrator access to CE from purely within Okta, rather than configuring administrators on the platform manually. Cloud Exchange is different from the standard Netskope tenant you would have access to as a customer, and facilitates the exchange of information between your various security and operations platforms. For information on what Cloud Exchange is (including how to deploy it), please see here.   Create a new App Integration Log in to your Okta administrator console and from the left-side menubar, navigate to Applications > Applications.   Select Create App Integration. Select SAML 2.0 as the sign-in method and click Next. On the next screen, set the App name to be Netskope Cloud Exchange and provide an app logo if required. Click Next to proceed to the Configure SAML section.   Copy the Cloud Exc

  This article will cover how to configure Single-Sign-On (SSO) for the Netskope Cloud Exchange (CE) platform using Azure Active Directory (AAD). This will allow you to manage administrator access to CE from purely within AAD, rather than configuring administrators on the platform manually.   Cloud Exchange is different from the standard Netskope tenant you would have access to as a customer, and facilitates the exchange of information between your various security and operations platforms. For information on what Cloud Exchange is (including how to deploy it), please see here.   Create a new Enterprise Application Log into the Azure AD portal, and go to “Enterprise Applications”. You may need to search for this at the top of the portal. Click New application. Click Create your own application and name the application Netskope Cloud Exchange.   Select the 3rd option to create a non-gallery app: Integrate any other application you don’t find in the gallery.   Clic

To edit (tag) a single app, hover over the app on the main page and click the Edit tag icon. To tag multiple apps, select the checkbox in the top left corner for each app. Click the Edit tags icon in the top right corner of the page.   Tip: To select all apps shown on the page, click the Select All icon beside the Edit tags icon. In the Edit Tags dialog box, there are two dropdown lists for tagging the chosen apps. The left dropdown list allows you to specify whether the app is sanctioned or unsanctioned. The right dropdown list allows you to specify whether the app is consumer, departmental, or enterprise level. To create a custom tag or to remove a tag, use the field below the dropdown lists.

CVE-2021-44228 (Log4Shell or LogJam) is a recently discovered zero-day vulnerability in the ubiquitous Apache Log4j Java-based logging library. It was reported by the Alibaba Cloud Security team as an unauthenticated RCE vulnerability in Log4j 2.0-beta9 up to 2.14.1 and could allow a complete system takeover on vulnerable systems. The bug has received the maximum CVSS score of 10, reflecting its importance and ease of exploitation.    This logging library is widely used in enterprise applications from Apple, Twitter, Amazon, Tesla, CloudFlare, and products including Apache Struts2, Apache Solr, Apache Druid, and Apache Flink for its rich feature set and ability to flexibly record log information. Even Ghidra, a popular reverse engineering tool from NSA, is vulnerable to this bug. Attackers can use the feature that is used to write error logs to construct special data request packets through this vulnerability and ultimately trigger the remote code execution.   Threat act

Check out our latest blog series on AWS Best Practices on Logging!   Although CloudTrail is a well-trodden subject for AWS Security, there were still a few interesting findings among a slice of our customer base:   Enable VPC flow logs: 81% of VPCs do not have VPC flow logging enabled, which will hinder incident response and investigations. Encrypt CloudTrail logs at rest: 91% of CloudTrail logs are not encrypted at rest. Encryption at rest supports data compliance controls and is easy to do. Ensure S3 bucket access logging is enabled for CloudTrail buckets: 41% of CloudTrail buckets do not have server access logging enabled. Logging should be enabled for all CloudTrail S3 buckets. Ensure CloudTrail logs are integrated with CloudWatch or a SIEM: 54% of CloudTrails are not integrated with CloudWatch. These should be reviewed to ensure they are integrated with a production log search service or SIEM.   If your AWS accounts fall into these c

Why create a brand new PPT meeting deck every time you host a User Group?! Check out our latest User Group PPT template attached below!       Every quarter our Community team will update this PPT to include the latest Netskope Community news & announcements, upcoming events, and product release information.   All you need to do is: Download the template Fill in your User Group information (leader head shots, updates, survey, etc.) Share at your next meeting   Last Updated: 9/15/2021

We just published another blog related to application risk from OAuth applications: Who Do You Trust? Challenges with OAuth Application Identity . This follows up on several other recent blogs related to OAuth: Who Do You Trust? OAuth Client Application Trends   New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)    In this blog, we discuss some of the challenges that aren't addressed by the OAuth protocol, specifically the challenges in identifying an OAuth application that a user is trusting with access to data or other resources.   The scenario is: A user or administrator or an organization is prompted whether to trust an application -- you see an application title (created by the developer) -- is it real or is it fake?    Unlike the more-established field of malware that utilize DNS, we have nothing akin to DNS registrars, passive DNS databases, certificate authorities, so it makes the task of identification and att

We just published A Real-World Look at AWS Best Practices: Networking, part 6 of our AWS Best Practices series, looking closer at networking configurations with NACLs and Security Groups with respect to inbound access from the Internet to RDP and SSH, as well as the use of Default Security Groups (not recommended).   In reviewing anonymized customer, we found opportunities to improve security: Use More Secure Remote Access: Replace security groups that allow inbound Internet access to remote admin ports with more secure methods to remotely administer EC2 instances. 4% of the security groups in use allow inbound Internet access for SSH or RDP.  Do Not Use Default Security Groups: Ensure that default security groups do not allow any traffic and are not used. 609 default security groups (1% of all security groups) are being used and allow traffic of some kind. Some additional, relevant material you may want to also read: It’s All About Access: Remote Access Statisti

The Ragnarok ransomware gang had been around since 2019, and suddenly ceased operations today, posting a universal decrypter and instructions on how do use it. What does this mean for the risk of ransomware? Not much. This week, we published a blog post about BlackMatter, a newcomer to the ransomware space. This is just the normal revolving door of ransomware operators, all following the same ransomware-as-a-service business model, using the same tactics, and trying to put controls in place so their affiliates don't target anyone that results in too much attention for the operators.   Netskope protects against ransomware using a multi-layered approach that includes signatures, machine learning, static heuristics, and sandbox analysis to prevent ransomware from making its way onto any of your endpoints. One of the most common ransomware delivery tactics we are actively blocking is ransomware delivered as next-stage payloads by malicious Microsoft Office Documents. Our Office Docum

In part 5 of our continuing series on AWS Best Practices, we cover real-world stats on storage, specifically public access on buckets and encryption of EBS volumes: https://www.netskope.com/blog/a-real-world-look-at-aws-best-practices-storage   One of the challenges is having a clean process to provision, secure, and continually monitor whether data storage such an S3 bucket should be public or private.   How does your organization manage this? - do you use tagging, resource groups, or accounts to identify whether buckets are expected to be private or public? - do you enforce that a bucket is completely public/private by using bucket level ACLs/policies rather than object-level? - do you have additional audit checks on the above?   Additionally, how do you look upon encryption at rest? Is it solely for compliance, so AWS keys are sufficient or do you use CMKs of your own for real data privacy?   Would love to hear comments on how customers are managing this crucial

We just published the first three parts of a multi-blog series on new phishing attacks that can exploit OAuth 2.0 authorization flows: https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authorization-flows-part-1 https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authentication-flows-part-2 https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authentication-flows-part-3   We believe there will be an increasing trend in phishing and other attacks that abuse the OAuth protocol itself in order to gain advantages such as: obtaining OAuth session tokens which bypass MFA and are practically permanent, as well as take advantage of quirks such as being able to spoof other applications easily.   This is based upon a Def Con 29 presentation given on August 7, 2021. Currently, there is more exposure for Microsoft O365/Azure users due to their implementation of the device authorization grant flow. However, much of the material applies to a