Skip to main content

Inside Netskope

Netskope, a global cybersecurity leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data.

  • 56 Topics
  • 37 Replies
57 Topics
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope
Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Gen AIBlog

In today’s fast paced life we are being inundated with advances in technology which sometimes outpace our ability to process and keep up with. In this article we are going to: Discover the use of Generative AI within our organization; Influence Real-time Policy creation to promote user adherence and behavior to policies; Guide Generative AI Vendor/Application requirements; Build reports and dashboards that help identify and prioritize security risks; and,. Help us build a better product through self-reporting within the platform. *augmented with the assistance of Generative AI The use of Generative AI has become extremely pervasive and grown at a rate that has left a lot of us wondering where it came from and how we got along without it in the past. A great example of this are the bullet points listed above. I got to thinking about using Gen AI to augment the bullet points and a title slide for a presentation on uncovering the insights of Gen AI. I realized the irony of the situation.

6761
M
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope
Inside Netskope: Session 02 Recap - Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Generative AI

In case you missed the second webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on how to Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Generative AI can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Are there any templates for allowing access to controlled AI tools like corporate Copilot and Copilot Designer while blocking outside AI tools? A: We recommend taking the client and start to interact with the copilot to see if you're able to pick up some of those activities with the predefined connectors and potentially even developing a custom connector. We are currently working on the consumer version of the Copilot for O365 and then eventually the professional version. Q: How can AI in Netskope help business to grow? A: We can analyze the traffic we are seeing with

2120
S
Netskope Employee
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Inside Netskope
Dropbox

It is necessary to install the Dropbox desktop application, download the executable from the official website, at the time of installation it does not finish the installation. In the Steering Configuration EXCEPTIONS option, the application is bypassed but it still does not allow the installation, how can I remedy it?

1372
Rohit_Bhaskar
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Sanitized HAR File Detection using NetskopeBlog

What are HAR files and why detect them? HAR stands for ‘HTTP Archive’ format and it is a file used to store the interactions between a particular Website and the Browser. These files are used to troubleshoot issues that a particular user might be facing with a website and the issues could be related to performance, page elements, cookies, HTTP headers, page rendering, etc. Large organization’s support and technical teams use the HAR files in order to understand what kind of issues the user should have faced when they inspect the HAR file related to the transaction. HAR files can be used for debugging as they present a clear picture of the transaction between the Browser and the Web server. This also presents a gaping hole as HAR files also record sensitive transactional information like cookies, authentication tokens, etc. It has become crucial to make sure the HAR files are not mishandled. There are sanitization tools available to make sure that all sensitive information for a particu

3870
ukrishna
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope
Recap: Inside Netskope Session 01 - Coaching Users into Compliance

In case you missed the first webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on how to coach users into compliance can be found below. Feel free to comment and continue the discussion! Watch on-demand Q: What is the Block restriction action for those that have not been able to complete the training in time? A: We take a gradual approach to the notification system, so there are different levels of restriction. Once the completion deadline has passed, users receive a similar message but they do not have the option to provide justification to do the training later. Their only option is to complete the training now or ignore the message which will follow them on all applications other than the required ones (Okta, LearnUpon, and Slack). Q: What has been the user experience/feedback from the users as you've deployed this notification s

2700
M
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope
Security posture for Workday application at NetskopeBlog

Workday is a cloud-based software platform that provides a suite of enterprise applications for human resources (HR), finance, and planning. It is designed to help organizations manage their workforce, streamline business processes, and gain insights into their operations. Workday is a critical application which hosts sensitive information. Netskope is currently monitoring and securing access to Workday internally with a breadth of products that are developed and maintained by the development and QA teams. These capabilities include areas such as inline protection, API-enabled protection, SaaS security posture management (SSPM), and Cloud Firewall, to name a few. In this guide, we will provide a perspective of how Netskope’s products and capabilities are used internally for securing enterprise data. Real-time Protection We are restricting access to the Workday app for Netskope employees through client enforcement in IDP, whereby access to Workday would be granted only if users are conn

5360
M
Netskope Employee
P
Netskope Employee
pburtonNetskope Employee
posted in Inside Netskope
Empowering Security Awareness: Leveraging Netskope Advanced Analytics Real-Time Coaching

In today’s rapidly evolving threat landscape, user awareness plays a pivotal role in safeguarding organizations against cyber risks. Employees and end-users are often the first line of defense, making it essential to educate and empower them with the knowledge and skills necessary to identify and mitigate potential security threats. Netskope understands the significance of user awareness in maintaining a robust cybersecurity posture. By combining cutting edge technologies and user-centric approaches, Netskope equips organizations with the tools to effectively monitor, analyze, and guide user behaviors in real time. This blog will delve into the importance of security user awareness, explore Netskope’s User and Entity Behavior Analytics (UEBA) capabilities, and highlight the value of its real-time coaching feature in promoting secure behaviors and enhancing overall security resilience. By embracing security user awareness and leveraging Netskope’s innovative solutions, organizations can

1770
P
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
posted in Inside Netskope
Sharing Indicators of Compromise (IoC) with Netskope’s Cloud Threat Exchange (CTE)

“You can’t defend against threats that you are not aware of” What is IoC and Why share it? IoC stands for Indicators of Compromise and as the name suggests, it points to technical identifiers or behavioral patterns which help to identify if a particular system or network or artifact has been compromised. Anything which helps to identify a particular malicious activity could be an IoC, ranging from an executable, hash, IP Address, URL, etc. As the quote above implies, organizations cannot safeguard themselves from threats and attacks they are unaware of. Utilizing heuristics can narrow the divide between familiar and unfamiliar threats, but pinpointing specific criteria significantly accelerates the process and demands fewer computational resources. That’s where a robust and strong IoC sharing program comes into lay. Through the efficient and effective exchange of IoCs among security telemetry tools, each tool acquires IoC data from others, contributing to enhanced detection capabilitie

3960
ukrishna
Netskope Employee
R
Netskope Employee
rbutlerNetskope Employee
posted in Inside Netskope
Remote Browser Isolation on Demand for the SOC

As a company, we have deployed and continue to utilize Remote Browser Isolation to browse unknown or questionable sites based on web categories in a ‘safely allow’ posture instead of an outright block. When one of our analysts requested the purchase of a remote browser service to conduct investigations into sites that didn't fall into the web categories that we already send to RBI, we decided to develop a process to isolate any desired sites using our existing product, incurring no additional cost for the company. The security team is often asked to investigate suspicious web sites, whether they are phishing, malvertising, or others. Netskope uses our Remote Browser Isolation solution for uncategorized, no content, parked domains, proxies and anonymizers, and known threat websites. For sites outside of those categories that require a safe way to investigate a web site we have created a solution for this. How to set it up Step 1 The approach we took was to create a custom URL list. To k

1740
R
Netskope Employee
L
Netskope Employee
Lokesh_BalajiNetskope Employee
posted in Inside Netskope
Automating URL List Management for Remote Browser Isolation (RBI)

Welcome to a project aimed at enhancing the ease of an analyst's experience. In this venture, I've taken automation to the forefront by simplifying how we add URLs to RBI_url list. This list is specifically meant for Remote Browser Isolation (RBI), ensuring that some questionable/suspicious sites can be accessed securely for investigation purposes. At the heart of this effort is a Slack bot I've designed. This bot comes with the right permissions and a simple command. With this command, users can mention the URLs to be included in the RBI URL list. This whole process starts when the bot communicates with the Tines platform, where the real magic happens. Using the Tines platform, we have simplified this process through automation by which these URLs are added to the RBI URL list seamlessly and securely. This automation eliminates the need to manually navigate to the tenant to upload URLs, streamlining and expediting the task. Requirements: Slack app (to get urls from the user and send i

2250
L
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
posted in Inside Netskope
Onboarding Multiple Subscriptions for Azure CSPM

What is CSPM and Why CSPM? CSPM stands for Cloud Security Posture Management, it is a process to monitor cloud resources that belong to an organization for any potential security misconfigurations or risks which can lead to financial or data loss. The CSPM process scans the public cloud infrastructure continuously to check for violations against a set of predefined rules. The rules are tuned/muted by each organization as per their compliance and security needs. Netskope CSPM also offers a set of comprehensive rules which can be used by customers to improve their compliance and security posture of public cloud. Netskope offers CSPM solutions for Microsoft Azure, Google Cloud Platform and Amazon Web Services at the time of writing this post. Storage scans can also help with DLP and Malware violations. This post explains in an efficient and expeditious method on how to onboard multiple Azure subscriptions into Netskope CSPM. Making use of Azure Management Groups Individual Azure subscript

1090
ukrishna
Netskope Employee
jramirez
Netskope Employee
jramirezNetskope Employee
posted in Inside Netskope
Netskope & Okta Can Help With Tracking Compliance Training

Security awareness compliance training refers to a specific training initiative created to educate employees, contractors, and other involved parties within a company regarding the significance of adhering to security measures, guidelines, and mandates. The fundamental aim of this training is to foster a mindset of security awareness and adherence across the entire organization. By doing so, it guarantees that all individuals comprehend their obligations in upholding the confidentiality of delicate data and countering security risks. However, not all users fulfill their training requirements punctually. At Netskope, over the past few years, we have persistently dispatched regular emails to users, urging them to finalize their training. Presently, we are exploring innovative and effective strategies to ensure timely completion of training by users. Using Netskope, Okta, an LMS with an API, and a SOAR solution, we have created a solution to track users with missing security training and

2170
jramirez
Netskope Employee
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope
Bypassing Zoom Traffic for Stability

Multiple users have reported issues with the stability of Zoom, as well as the performance of the application itself. Common complaints or issues relating to audio dropping, audio quality, and screen redraws or slowness painting the screen. Due to these issues, as seen traversing a proxy, it is recommended that Zoom traffic be bypassed and go directly to the destination, at least for real-time traffic. We do recommend using our Next Generation API Data Protection for Zoom. With its current release, audit events, standard user behavior analytics alerts in Skope IT, and DLP alerts may be seen in the tenant. Future improvements to API data protection includes, threat protection, inventory and dashboard remediation actions, and retroscan. Instructions The following instruction set allows you to bypass Zoom traffic using the Netskope Client’s real-time traffic steering method. Go to https://support.zoom.us/hc/en-us/articles/201362683-Zoom-network-firewall-or-proxy-server-settings and locate

10070
M
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope
Real-time Policy Recommendations

Steer It And You Can See It It goes without saying that if you cannot see data exfiltration then you cannot stop it from happening. CASB applications need to be steered in order to be seen, including SSL certificate pinned applications, destination locations, applications (CFW and CASB custom applications), and a few other bypass exceptions. For reference SSL certificate pinning is when a desktop or mobile application validates if the proposed server certificates match the hardcoded ones in the application. It's a security technique used to prevent man-in-the-middle attacks (MITM). We recognize some vendor ssl certificate pinned applications by default which need to be bypassed, Amazon Drive for example. So, in order for end users to use the application without errors resulting, we need to bypass the application traffic and allow it to go directly to the destination. In order for that to occur, we define the application and the hosts or domains to which it needs to communicate with. In

12900
S
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
posted in Inside Netskope
Endpoint DLP - Netskope Customer Zero Best Practices

Netskope Endpoint Data Loss Prevention (Endpoint DLP) provides data protection at the endpoint by utilizing Netskope cloud DLP capabilities. You can use Endpoint DLP to monitor and govern USB storage devices connected to your endpoint. Endpoint DLP is an optional add-on capability to the Netskope Client and does not require deploying and managing a separate client or agent on the endpoint. With Endpoint DLP, you can create Device Control and Content Control policies. Device Control policies enable granular control over which devices are allowed and which users can access them. Whereas, Content Control policies enable the full use of Netskope DLP profiles and rules to inspect and control data movement between an endpoint and a USB mass storage device. To avoid user interaction during deployment, please ensure that full disk access is enabled for all Mac OS systems for which the endpoint DLP service would be deployed. Within the Customer Zero team, we have deployed endpoint DLP policies

6590
M
Netskope Employee
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope
Google Workspace RProxy as a Service

Welcome to the world of Reverse Proxy! Today, I will be your guide on creating a Reverse Proxy as a Service (RPaaS) in Google Workspace. We’ll then apply contextual awareness to “guide” employees to steer traffic to Netskope using RPaaS if they are not originating from a Netskope IP address. This is similar to what we do with Microsoft Azure AD RPaaS and conditional access policies; the contextual awareness is Google’s implementation of conditional access. There are requirements needed for licensing as well as caveats which warrant mentioning. You will need to be licensed for Protect your business with Context-Aware Access - Google Workspace Admin Help . There are a limited number of applications at this point which context awareness works with or for, see pic below. For SAML apps, policy evaluation occurs on sign-in to the app. Third party SAML apps that use Google as the identity provider. A third party identity provider (IdP) can also be used (third party IdP federates to Google Clo

4740
S
Netskope Employee
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope
Netskope Tools Directory Importer to SCIM Migration Process

Users are provisioned in three different methods within the tenant-manually adding them, Netskope Tools Directory Importer, or via System for Cross-domain Identity Management (SCIM). SCIM is an open standard designed to manage user identity information. It is possible to use all three methods to provision users to the tenant. However, it is recommended that only one method be used to avoid confusion. As more and more resources migrate to the cloud, it makes sense to use an Identity Provider (IDP) which resides in the cloud as well. SCIM provides a defined schema for representing users and groups, and a RESTful API to run CRUD operations on those user and group resources. This guide provides administrators the ability to migrate from the Netskope Tools Director Importer to SCIM, regardless of the service provider such as Okta or Ping. Netskope Tools Directory Importer Netskope Tools Directory Importer is installed, running, and on the latest version of code. Users and groups confirmed t

6850
S
Netskope Employee
qyost
qyostExplorer III
asked in Inside Netskope
IPS Signatures - Detailed Descriptions?

I hope this will just be a pointer to the resource... Is there a repository with more details about what the signatures are. Or a way to see what caused the match? Some of the descriptions are quite vague, and it's hard to determine if an exception should be created. eg: Sig 20019 "MALWARE-CNC User-Agent known malicious user agent - test"

1810
S
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
posted in Inside Netskope
Using API for SSPM V2 Alerts

How do you feed the Netskope SSPM Alerts to SaaS Application Administrators? The Netskope Cloud provides a wide range of innovative and competitive products, among which one of the most important offerings should be Netskope SSPM. SSPM stands for SaaS Security Posture Management and is used to continuously monitor cloud-delivered Software-as-a-Service applications. This service monitors the SaaS applications' configuration to ensure that they are configured securely and in compliance with regulations. Security administrators can set policies and receive alerts for SaaS application instances that do not adhere to the required policy. Typically, SaaS application administrators are not part of the company's core security team. Instead, the security team receives the SSPM alerts for all the SaaS applications. These alerts must be forwarded to the respective SaaS application owners so that they can work on remediation. In some cases, the security team might be hesitant to grant SaaS applica

1560
ukrishna
Netskope Employee
A
Netskope Employee
AFunkhouserNetskope Employee
posted in Inside Netskope
Investigating .zip and .mov top-level domains

On May 3rd 2023 Google Registry announced the release of eight new top-level domains (TLD). Two of these domains share the same naming conventions as common file names which are .zip and .mov. These TLDs could pose an increased risk to organizations through the use of social engineering attacks. For example https://github.com/kubernetes/kubernetes/archive/refs/tags/@v1.27.1.zip looks likes a legitimate domain to a GibHub repo to download a .zip file for kubernetes, however the link actually takes you to the domain of v1.27.1.zip. How does Netskope mitigate the threat from these domains? The Netskope platform can help prevent phishing attacks through the use of deep learning for phishing website detection and remote browser isolation which work across all top-level domains. Figure 1: Testing RBI with m365install.zip domain How can Netskope help provide insight into domain usage in an organization’s environment? Even with controls in place to help mitigate this threat, using Netskope Adv

1050
A
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
asked in Inside Netskope
Netskope DLP use cases for ChatGPT

With the growing popularity and use of ChatGPT, it is increasingly important to also monitor and secure private details and company confidential information from being shared with ChatGPT. As the Customer Zer0 team (CISO group), we have implemented some DLP rules for ChatGPT. Please note that currently, Netskope does not yet have a predefined connector for ChatGPT. We would hence need to create a custom connector so that DLP rules can be applied instead of an outright block to the webapp. We want our users to continue to use ChatGPT with discretion in an enterprise environment. This custom connector can be built from HAR logs. Here’s what we have in place: Realtime policy The Netskope chatgpt custom DLP profile contains the ‘netskope’ keyword. Results and end-user experience In this example, DLP source code classifier is getting triggered, and hence the question is not being posted to ChatGPT. PII and PCI data being blocked from getting posted to ChatGPT. Let us know which use cases yo

7910
M
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
posted in Inside Netskope
Best Practices for Email Security with SMTP proxy

The Netskope SMTP Proxy can be used as a service to scan outgoing emails over SMTP for DLP violations. In this solution, an email initiated by the user is received by a cloud email service such as MS O365 Exchange or Gmail. The email is then passed through the Netskope SMTP Proxy integrated into your SMTP workflow. Netskope SMTP Proxy verifies the contents of the email against Real-time Protection policies and acts on DLP violations based on the policy configuration. The email is then passed on to an upstream MTA which looks up the DNS of the destination email service and sends the email to the recipient's server. As the Customer Zer0 team (CISO group), we implement SMTP proxy for our Gmail corporate instance and have been implementing DLP rules to monitor and control the movement of sensitive and confidential internal only emails to non-Netskope email addresses. Netskope Configuration Workflow Ensure SMTP proxy is configured on your Netskope tenant: https://docs.netskope.com/en/netsko

7420
M
Netskope Employee
J
Netskope Employee
James_RobinsonNetskope Employee
posted in Inside Netskope
SVB a BCP and Cyber Exposure

Steps That Should be Taken by the Security Group, Business Continuity, and Finance Teams Introduction On Friday, March 10, 2023 news broke that SVB was in trouble. With this news, activities started within our organization to understand our direct exposure. As with any event what we have learned over time is that fraudsters are quick. This rang true with Silicon Valley Bank (SVB). At that point cybersecurity, third-party risk, and business continuity were not included. When these situations arise, it’s important to ask questions like, what if your company was hit with a bank fraud event like SVB Bank? Are you prepared? Do you know what steps to take before, during and after the event? In this document we want to share a few things we learned from the SVB event and how those learnings could help you in your business. Our first step when the news broke was to look inward. The financial and accounting teams looked at how SVB Bank impacted us directly. While the teams were looking inward t

640
J
Netskope Employee
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope
Tenant Only "Shadow" Group

How do you create a "shadow" group that is only located in the tenant, not reliant on an IDP? Add the group to the SCIM database directly using Postman or similar method and/or tool. The use case in this instance is to create a group that is specific only to the tenant and "hidden" from the sight of others who are not Netskope tenant admins. A good example of this is creating a group which contains users who should be in an "offboarding" group, but are also members of the team who manages the IDP, i.e. Okta, that is set to provision users and groups to the tenant. This will only apply to users who are provisioned to the tenant via SCIM from an IDP such as Okta. It cannot and should not be used when users are provisioned to the tenant using the Netskope Directory Importer or manually added to the tenant. A high level overview of meeting this use case are: Download and install the Postman application; Import a Postman Collection for Netskope SCIM; Create a "shadow" group using Postman; A

1180
S
Netskope Employee
J
Netskope Employee
jlanningNetskope Employee
posted in Inside Netskope
Threat Hunting 3CX Desktop App Supply Chain Attack

On March 29, 2023, a number of security companies were warned about harmful activity that was traced back to a legitimate binary file from the communication technology firm 3CX. The file, called 3CXDesktopApp, is a popular video-conferencing software that can be downloaded on different platforms. Several analyses have attributed the threat campaign to state-sponsored threat actors, and security firms have observed malicious activity in both Windows and Mac environments. On Thursday, March 30th, 3CX confirmed that multiple versions of its desktop app for Windows and macOS were affected by a supply chain attack. The version numbers include 18.12.407 and 18.12.416 for Windows and 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 for macOS. This post will describe how to use Netskope to identify possible indicators of use (IOUs) of the 3CX desktop app, indicators of compromise (IOCs), and how to mitigate any further malicious activity. Indicators of Use If you are uncertain about the usage o

800
J
Netskope Employee

Most helpful members this week

Badge winners

Show all badges

Popular tags

Terms & ConditionsCookie settings

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings