Skip to main content

- - Articles Overview
Learn
Product Release Notes
Groups
Events
Support

EN

Netskope Homemade: Season 2

1 month ago

Home
Learn
Inside Netskope

Inside Netskope

Netskope, a global cybersecurity leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data.

58 Topics
37 Replies

When you subscribe we will email you when there is a new topic in this category

58 Topics

stevanNetskope Employee

published in Inside Netskope

Netskope Endpoint SD-WAN: The Unsung Hero for Tracking Netskope Client BypassesBlog

Netskope products serve the purpose of security AND as tools to troubleshoot with. Tools that are often overlooked by everyone, including us!In this article, we are going to cover one of our newest products acquired through the purchase and partnership of Infiot’s Borderless WAN (BWAN). BWAN is the technology commonly known as Software Defined Wide Area Networking (SD-WAN). We will answer the questions of:How does the Netskope Endpoint SD-WAN Client become a tool to be used? How am I able to use the Netskope Endpoint SD-WAN Client for displaying bypasses in the Netskope Endpoint SD-WAN console?As a little background information, “Netskope BWAN extends the concept of network segmentation beyond traditional network perimeters, catering to the needs of a modern workforce that operates from varying locations and uses a multitude of devices. Netskope BWAN ensures network segmentation for any device by encapsulating each session in a secure and encrypted tunnel. This segmentation extends

madhurasridharNetskope Employee

published in Inside Netskope

Register Now! Inside Netskope: Off-boarding User Monitoring Protections in Practice

Off-boarding User Monitoring Protections in Practice Wednesday, January 158am PST | 4pm GMT | 5pm CETRegister now! Get a glimpse into some of the off-boarding protections that our internal security team has developed to aid them in monitoring users who transition from Netskope. In this webinar we’ll touch on:Who gets monitored and why How we use policies to collect data and maintain security posture How we use automation to start collecting data almost instantly

ukrishnaNetskope Employee

published in Inside Netskope

Inside Netskope: Session 08 Recap—Protecting Lost/Stolen Managed Devices with Netskope ClientInside Netskope

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on protecting lost/stolen managed devices with Netskope Client can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Can a client be flagged as stolen via API?A: The client cannot be directly flagged as stolen via API, but you can use APIs to move users or devices between groups. This will have to be done within the Groups section and not with the client directly. Q: How to setup monitoring and tracking of stolen devices? Also, can we pinpoint the location of the lost/stolen device?A: If the device comes back online and connects back to the tenant, we can get all of the location data (wifi connected to, geographic location, etc.). Regarding how to setup monitoring and tracking, the presentation covers quite a few use

ukrishnaNetskope Employee

published in Inside Netskope

Register Now! Inside Netskope: Protecting Lost/Stolen Managed Devices with Netskope Client

Protecting Lost/Stolen Managed Devices with Netskope Client Thursday, November 148am PST | 4pm GMT | 5pm CETRegister now! Join our security engineers as we discuss the possible settings and changes which can be made in the Netskope tenant to accommodate a lost/stolen corporate managed device. Learn how to: Modify settings in the tenant proactively for lost/stolen device cases in the future Effectively deal with lost/stolen devices by setting up protective measures against device misuse Minimize data loss in case of lost/stolen device cases by blocking data movement from the device

rakeshgNetskope Employee

published in Inside Netskope

Inside Netskope: Session 07 Recap—Automation of IOC Hunting and Continuous Monitoring using Cloud Threat ExchangeInside Netskope

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Automation of IOC Hunting and Continuous Monitoring using Cloud Threat Exchange can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Are new IOCs hunted against historic data? Or, only on new events after IOC is known?A: Yes, that's the beauty of this workflow is that it's not just updating tools with new IOCs but it's looking to determine whether we've seen that IOC before. Once we know that it is an indicator of compromise, it looks back to see if anything has happened and alerts an analyst immediately as soon as it finds something. Q: Can you integrate Cortex XDR with Netskope? If so, how?A: Yes, via Cloud Exchange. Check out this doc for more information. Q: Do you have SentinelOne Integration?A: Absolutely!

ukrishnaNetskope Employee

published in Inside Netskope

Netskope Client & Stolen Managed DevicesBlog

Netskope Client & Managed DevicesNetskope offers multiple steering mechanisms and the Netskope Client is the most recommended option due to its operating nature and the available feature list. The Netskope Client is a lightweight application which can be installed on a managed device and it can be used to steer traffic from the device to Netskope Security Cloud. It provides real-time visibility of the managed devices accessing the cloud and web from any location. The Client uses Forward Proxy Steering mechanism where the Client creates an SSL tunnel from the end device and terminates it at the Netskope forward proxy in the Cloud.So when the mode of steering is Netskope Client, all managed devices are expected to have the Netskope Client installed. In the context of this blog, a device is classified as managed if it has the Netskope Client installed. In this post, let us discuss the possible settings and changes which can be made in the Netskope tenant to accommodate a Lost/Stolen m

rakeshgNetskope Employee

published in Inside Netskope

Register Now! Inside Netskope: Automation of IOC Hunting and Continuous Monitoring using Cloud Threat Exchange

Automation of IOC Hunting and Continuous Monitoring using Cloud Threat Exchange Thursday, October 38am PDT | 4pm BST | 5pm CESTRegister now! Join our security engineers as we demonstrate how the Cloud Threat Exchange tool is implemented within Netskope to streamline the automated integration of IOCs with a ticketing system and perform continuous monitoring. Key Topics:Cloud Threat Exchange Integration with multiple security tools and technologies such as Netskope, SIEM, EDR, etc. Automation of IOC ingestion from ticketing platforms such as Jira into Github repo The plugin to Ingest IOC's from Github to Cloud Exchange And real-time monitoring of these IOCs (continuous monitoring)

ukrishnaNetskope Employee

published in Inside Netskope

Inside Netskope: Session 06 Recap - Effective Allowlisting with Netskope DLPInside Netskope

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Effective Allowlisting with Netskope DLP can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Is advanced DLP techniques a new licensing?A: Exact Data Match and Fingerprinting are both included in the Advanced DLP license, so you only need ADLP to use these features. Q: Can you share some of the most prevalent DLP use cases that you've encountered? This will help us close any gaps that we may have overlooked.A: DLP policies are rarely a "set and forget". It's always a continuous learning and adjusting as our technology adjusts, as document formatting changes, etc. The only consistent is change, so we always go back and tune them as needed. Common use cases for Inline DLP include:1.) Block encrypted zip files with

stevanNetskope Employee

posted in Inside Netskope

Netskope Client Enforcement: A Security Practitioner's Perspective

Background Q. How do you enforce Netskope Client adherence without impacting SAML flows after authentication?A. Netskope Client Enforcement. Netskope Client Enforcement is used to “enforce” the compliance of having a Netskope client enabled and connected to a tenant for accessing SaaS applications using Identity Providers (IdP) such as Okta. This includes IdP or Service Provider initiated connections, i.e. logging into Okta to access a SaaS application or logging into the SaaS application directly. Netskope Client Enforcement should be differentiated from other methods of steering real-time traffic to the Netskope tenant for the processing of policies; policies such as Next-Generation Software Web Gateway (NG-SWG), Data Loss Prevention (DLP), Netskope Private Access (NPA), User Enhanced Behavior Analytics (UEBA), Cloud FireWall (CFW), and so on, all of which are designed to protect an organization. Netskope Client Enforcement also enables end users to protect corporate resources th

madhurasridharNetskope Employee

published in Inside Netskope

Best Practices for password protection using Netskope DLPBlog

The Data Loss Prevention product at Netskope offers a wide variety of options to customize and deploy rules that can be used in Realtime, API protection, SMTP proxy and Endpoint policies. The granular level of detailing helps information security engineers to fine tune the rule as much as possible to avoid false positives and false negatives. The same approach applies for password protection too. Passwords act as the first line of defense against unauthorized access. Strong password protection is essential for safeguarding company data, maintaining compliance, and preventing unauthorized access. In the customer zero program at Netskope, our team has been extensively working on training the DLP rules, analyzing the false positive incidents, ensuring that the DLP rules cover different types of passwords (common, contextual, secure and so on) by actively collaborating with the relevant product teams. After some intensive training and testing, here’s the recommended DLP rule for password p

ukrishnaNetskope Employee

published in Inside Netskope

Register Now! Inside Netskope: Effective Allowlisting with Netskope DLPBlog

Effective Allowlisting with Netskope DLP Wednesday, August 218am PDT | 4pm BST | 5pm CESTRegister Now! If DLP is not utilized in the right manner, the Admin is in for a nightmare with the number of alerts they would receive every single day. Netskope’s DLP has an extensive suite of offerings, with respect to detection of content and object types, to help eliminate this risk. Join us to understand how our internal security team uses Netskope DLP to effectively allowlist and minimize false positives. Learn how to: Create effective DLP policies per your organization's situation Build processes to identify DLP exceptions within your organization Utilize different techniques to Allowlist the DLP exceptions Use Netskope’s Cloud Exchange for Allowlisting

madhurasridharNetskope Employee

published in Inside Netskope

How to get to an excellent posture score for a SaaS app with Netskope Security Posture ManagementBlog

A best practices recommendation guide from Netskope’s Customer Zero teamIt brings the Customer Zero team great joy in connecting with the security community with some best practices of how we do what we do at Netskope to protect critical applications and data. In this blog post, let us look at how we have achieved to bring the security posture score of some SaaS apps to an excellent level with regard to Netskope’s Security Posture Management product offering. SSPM performs continuous evaluation of connected SaaS applications for security posture, and ensures that these applications are configured securely and in compliance with regulatory requirements such as GDPR, ISO, NIST, CSA and so on. Step 1 - Set up the SSPM policiesThe Netskope Security administrators can set up policies under Security Posture based on the configurations and settings to assess. The product comes with a predefined set of policies which can be used as a baseline to start the process as well. Step 2: Establish co

madhurasridharNetskope Employee

published in Inside Netskope

Inside Netskope: Session 05 Recap - Using Layered Protections for SaaS Applications

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Using Layered Protections for SaaS Applications can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Do you have any book or links for reading materials needed to perform at my duties professionally?A: In relation to this topic specifically, we have a corresponding Community post for the three products we discussed during the presentation that talk about how we use layered protections for SaaS Applications as well as recommendations.Security posture for Workday application at Netskope Security posture for Github application at Netskope Security posture for Salesforce application at NetskopeDocs.Netskope is also a great place to get additional information and use cases. Q: Can Netskope be applied together with SI

madhurasridharNetskope Employee

posted in Inside Netskope

Security posture for Github application at Netskope

GitHub is a web-based platform that provides hosting for software development projects utilizing the Git version control system. It serves as a collaborative platform for developers to work together on code, track changes, manage projects, and host their code repositories. GitHub allows developers to create and maintain repositories, which are containers for code and related resources. These repositories can be either public, allowing anyone to view and contribute to the code, or private, restricting access to a selected group of individuals or organizations.   There are some security challenges that we as the Customer Zero team are trying to address for Github. The premise behind the security posture is considering sensitive data movement, malicious repositories, code injection and leakage, ensuring appropriate access controls and permissions. We are currently monitoring and securing access to Github internally with a breadth of products that are developed and maintained by the d

stevanNetskope Employee

published in Inside Netskope

Salesforce Reverse Proxy Using Okta as the IDP

A Security Practitioner's PerspectiveThis article will walk you through the setting up of Reverse Proxy(RProxy) for Salesforce (SFDC) using Okta as the Identity Provider (IDP). There are RProxy limitations which should be noted as it will greatly affect its use within the organization and subsequent effective use within Real-Time Policies (RTP). For example, RProxy might appear to function correctly but activities with desktop applications might be restricted or bypass RProxy altogether.Since RProxy is meant to provide another real time steering method for machines or devices which do not have the Netskope client enabled, it is imperative to understand its limitations and plan accordingly.Additionally, RProxy should be implemented as the last method of deploying other real time access methods since it sits between the IDP and the application. The exception to this is implementing RProxy as a Service (RPaaS). RPaaS is an application that sits in an SaaS service that also has a built in

madhurasridharNetskope Employee

posted in Inside Netskope

Register Now! Inside Netskope: Layered Protections for Salesforce and other SaaS Applications

Layered Protections for Salesforce and other SaaS Applications Wednesday, July 109am PDT | 5pm BST | 6pm CESTRegister Now! Join us to hear from our Customer Zero team on how a Netskope Admin can use different Netskope products to create a layered protection plan for critical SaaS applications like Salesforce, Github and Workday. Learn more about:Client Enforcement Realtime Protection policies API protection policies Security Posture Management Endpoint DLP protection User Behavior Analytics

erwingdavidNew Member

asked in Inside Netskope

syslogs on fowarder

can i send syslog to a forwarder who is on premise?

ukrishnaNetskope Employee

published in Inside Netskope

Making Netskope Cloud Exchange Highly AvailableBlog

The Netskope Cloud ExchangeNetskope offers an interesting solution to solve this use case and that is the Netskope Cloud Exchange (also referred to as Netskope CE). It is a free offering from Netskope with which organizations can share their IoC information between their security tools using the Threat Exchange, use the Log Shipper to import transaction logs from Netskope, use the Ticket Orchestrator to relay alerts to ticketing services and use the Risk Exchange to exchange risk scores between multiple sources. It can be installed and run in a Linux Docker environment by each customer on their own. You can read more about Netskope Cloud Exchange here. As mentioned above, there are four main modules offered with the Netskope Cloud Exchange: the Log Shipper, Ticket Orchestration, Threat Exchange, and Risk Exchange. All the modules are hosted and run in a single docker environment. Make sure you go through the system requirements once before you provision your infrastructure for the Clou

ukrishnaNetskope Employee

published in Inside Netskope

Access Control based on OS & Browser Versions using HTTP HeadersBlog

Why control access based on versions?In recent times, it’s well known that there are multiple vulnerabilities cropping up every single day for different applications and operating systems. Applications and operating systems creators are trying their best continuously to patch these vulnerabilities with newer and updated versions of their softwares. In an enterprise defensive setup, making sure that all applications and operating systems are up to date has become more important than ever. The two main entities which need to be monitored for updates aggressively should be Browsers and Operating Systems as a lot of internet access for users traverses via Browsers and every user would be on a machine which has to run an Operating System. There are several tools which help an organization to force-update their browsers and operating systems within a specific time & date. The forced-update method is an effective solution but is kind of an aggressive route as it might lead to unintentiona

ukrishnaNetskope Employee

published in Inside Netskope

Inside Netskope: Session 04 Recap - Using the Netskope Client to Enforce Browser Updates

In case you missed the fourth webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Using the Netskope Client to Enforce Browser Updates can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: What about other browsers such as brave or duckduckgo? Do you guys lay down the law and block those for your org?A: There's a sizable list of supported browsers. If you hit your real-time policy and select "criteria" > select browers, you can see all the browsers that are currently supported. Q: Is this a subscription service?A: If you are a Netskope customer and utilize SWG with real-time policies, there's no additional fees for this. Q: Can you make it any website, not just specific GitHub or something?A: Yes, we can do this for any website. Q: Would it be possible to add enterprise browsers like

ukrishnaNetskope Employee

published in Inside Netskope

Register Now! Inside Netskope: Using the Netskope Client to Enforce Browser Updates

Using the Netskope Client to Enforce Browser Updates Thursday, May 308am PDT | 4pm BST | 5pm CESTRegister now Join us to hear from our Customer Zero team on how a Netskope Admin can use the Netskope Client to “enforce” users to update their browsers to the latest version and help improve the overall security posture of an organization.Learn how to:Understand HTTP Headers Define device and browser posture with HTTP Headers Create HTTP Header Profiles Create Real-time policies to passively remind users based on device posture