Skip to main content
  • EN

Inside Netskope

Netskope, a global cybersecurity leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data.

  • 58 Topics
  • 37 Replies
58 Topics
J
Netskope Employee
jlanningNetskope Employee
posted in Inside Netskope
Threat Hunting 3CX Desktop App Supply Chain Attack

On March 29, 2023, a number of security companies were warned about harmful activity that was traced back to a legitimate binary file from the communication technology firm 3CX. The file, called 3CXDesktopApp, is a popular video-conferencing software that can be downloaded on different platforms. Several analyses have attributed the threat campaign to state-sponsored threat actors, and security firms have observed malicious activity in both Windows and Mac environments. On Thursday, March 30th, 3CX confirmed that multiple versions of its desktop app for Windows and macOS were affected by a supply chain attack. The version numbers include 18.12.407 and 18.12.416 for Windows and 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 for macOS. This post will describe how to use Netskope to identify possible indicators of use (IOUs) of the 3CX desktop app, indicators of compromise (IOCs), and how to mitigate any further malicious activity.  Indicators of Use If you are uncertain about the u

730
J
Netskope Employee
1 year ago
M
Netskope Employee
madhurasridharNetskope Employee
posted in Inside Netskope
Security posture for Salesforce application at Netskope

Salesforce is an enterprise cloud computing company that provides business software on a subscription basis. The company provides on-demand customer relationship management (CRM) solutions such as Sales Cloud, Service Cloud, Data Cloud, Collaboration Cloud, and Custom Cloud. As the Customer Zero team (CISO group), we are currently monitoring and securing access to Salesforce internally with a breadth of products that are developed and maintained by the development and QA teams. These capabilities include areas such as client enforcement, inline protection, API-enabled protection, SaaS security posture management (SSPM), and Cloud Firewall, to name a few. In this guide, we will provide a perspective of how Netskope’s products and capabilities are used internally for securing enterprise data.  Real-time Protection We are restricting access to the Salesforce app for Netskope employees through client enforcement, whereby access to Salesforce would be granted only if users are connect

1470
M
Netskope Employee
1 year ago
kmithilesh
Netskope Employee
kmithileshNetskope Employee
posted in Inside Netskope
A Shift Left Approach for Enterprise Security Architecture

Are you planning for a Shift Left approach for your security architecture? This document provides practical guidance on “Shift Left”, its approach and applicability  towards enterprise wide security architecture and governance, covering both the corporate and product lifecycle. In this document we will talk about the Common Architecture Criteria (CAC) as a framework to apply at the architecture, design, and implementation layers such that Shift Left helps drive a concise and consistent approach across onboarding third-party applications or developing and deploying internal applications early on throughout the lifecycle that provides multiple benefits such as architecture optimization, operational efficiency,  faster delivery, and more. Shift Left principle: The Shift Left principle advocates identifying and shifting tasks as early as possible into the lifecycle, which in turn helps for better planning and execution translating into better quality and workflow optimizations. T

1270
kmithilesh
Netskope Employee
1 year ago
jramirez
Netskope Employee
jramirezNetskope Employee
posted in Inside Netskope
Threat Exchange Best Practices

The Netskope Threat Exchange module within Cloud Exchange is our open source solution to IoC sharing between security tools. Once configured, Threat Exchange can store and share thousands of IoC’s from tools such as Netskope, CrowdStrike, Microsoft Defender, ThreatConnect and many others, alongside the capability of adding IoC’s via Cloud Exchange’s API. The large amount of data pulled can be overwhelming, so we wanted to share some best practices for Threat Exchange that you can follow and use within your own environment. Refine Your Business Rules. Your business rules are one of the most important aspects of your Threat Exchange instance since they are used for your sharing configurations. Unless you want everything being shared over to your set of configured tools, you will need to refine your business rules to the specific items you want to send. You can leverage fields found within the IoC’s you pull. For example, some plugins will allow you to pull severity information from t

1150
jramirez
Netskope Employee
1 year ago
mharsh
Netskope Employee
mharshNetskope Employee
posted in Inside Netskope
PostgreSQL vulnerabilities and their preventions

PostgreSQL is the world’s most advanced enterprise-class open source database management system that is developed by the PostgreSQL Global Development Group. It is a powerful and highly-extensible object-relational SQL (Structured Query Language) database system popular for its reliability, feature robustness, and high performance. It is known to be highly scalable, both in the amount of data it can store and manage and in the number of concurrent users it can accommodate.   How does it work? PostgreSQL uses a client-server model where the client and the server can reside on different hosts in a networked environment. The server program manages the database files, accepts connections to the database from client applications. It can handle multiple concurrent connections from clients by “forking” a new process for each connection. It executes database requests from clients and sends the results back to the clients. Remote clients can connect over the network or internet to the serv

5790
mharsh
Netskope Employee
1 year ago
jramirez
Netskope Employee
jramirezNetskope Employee
posted in Inside Netskope
Netskope Alerts via Slack Messages

Netskope Alerts via Slack Messages Prerequisites: Slack channel with a webhook.https://slack.com/help/articles/115005265063-Incoming-webhooks-for-Slack Cloud Exchange version 3.2 and above. Netskope Tenant added to Cloud Exchange. Procedure: Step 1. Netskope ITSM (CTO) Plugin Setup (skip to step 2 if already setup): Login to Cloud Exchange as a user with admin privileges. Navigate to Settings > Plugins.     Click on the Netskope ITSM (CTO) plugin.   Name the configuration and set the tenant field to the Netskope tenant you want to receive alerts from. Click Next.   Navigate to Ticket Orchestrator and click on Alerts. Make sure the section is being populated with alert data from the configured tenant.   Step 2. Notifier Plugin for Slack Webhook (CTO) Setup: Navigate to Settings > Plugins.     Click on the Notifier (CTO) plugin.   Name the configuration and set the sync interval. The default of 60 minutes is recommended, but for

2890
jramirez
Netskope Employee
1 year ago
ukrishna
Netskope Employee
ukrishnaNetskope Employee
posted in Inside Netskope
Effective Allowlisting with Netskope DLP

Are you facing excessive Netskope DLP alerts which are false positives? The Netskope DLP solution provides a wide range of capabilities for detecting data theft and data mishandling. While setting up these policies, one of the common difficulties a security team faces is applying proper allowlisting mechanisms to reduce the amount of false positives. Luckily, the Netskope DLP solution has native effective ways that help allowlist certain applications, instances, users, and activities. Here are a some of those approaches to consider:   Exclude certain external domains from within API data protection policy: This option helps analysts to exclude permitted vendors and partners from a particular API protection DLP policy. For example, an organization may be allowed to share sensitive financial information with its financial consulting firm. So the PCI DLP policy could exclude that particular domain/site for the “External Share” policy. The list of applications supporting this feature

5070
ukrishna
Netskope Employee
1 year ago
A
Netskope Employee
AFunkhouserNetskope Employee
posted in Inside Netskope
The Threat Hunt Process

Requirements  Transaction Streaming SKU    What is Threat Hunting?  Threat hunting is the process of using the scientific method to proactively and iteratively search through an organization's environment to identify threats that have evaded detection. One of the goals of threat hunting is to enrich and automate detection that is unique to an organization's environment. Additionally your team builds knowledge of your organization's environment, understanding the gaps and further enriching your security solutions. This document is to help you understand the basic process of threat hunting using data logged with Netskope. We have included an example of a threat hunt.    The Hunting Loop    Figure 1: The Hunting Loop   Hypothesis  A threat hunt starts with a hypothesis that should be realistic for your environment. We recommend reviewing research articles on the threats you want to hunt to assist with hypothesis generation and avoid hunti

2940
A
Netskope Employee
2 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings