Learn

Welcome to the world of Reverse Proxy! Today, I will be your guide on creating a Reverse Proxy as a Service (RPaaS) in Google Workspace. We’ll then apply contextual awareness to “guide” employees to steer traffic to Netskope using RPaaS if they are not originating from a Netskope IP address. This is similar to what we do with Microsoft Azure AD RPaaS and conditional access policies; the contextual awareness is Google’s implementation of conditional access.   There are requirements needed for licensing as well as caveats which warrant mentioning. You will need to be licensed for Protect your business with Context-Aware Access - Google Workspace Admin Help . There are a limited number of applications at this point which context awareness works with or for, see pic below.   For SAML apps, policy evaluation occurs on sign-in to the app. Third party SAML apps that use Google as the identity provider. A third party identity provider (IdP) can also be used (third party IdP federat

I am excited to start a series of posts covering Netskope for Mobile. This kick-off note will provide an overview of Netskope's capabilities on mobile platforms. In the upcoming posts, I will delve into greater detail on enabling Netskope for both corporate and BYOD devices, enforcing data perimeter on mobile, navigating SSL Inspection and certificate pinning challenges, and many other topics.   Why Netskope on Mobile? While there are significant differences in capabilities, user experience, ownership models, and even weight and portability, mobile devices are similar to desktops in that they can be used to browse the internet, access personal and corporate applications, and move data around. Consequently, our information security policies, tools, and procedures are expected to cover both desktop and mobile use cases. Based on my observations, many organizations have significant gaps in their security posture between corporate desktops and mobile platforms, and Netskope can defini

Users are provisioned in three different methods within the tenant-manually adding them, Netskope Tools Directory Importer, or via System for Cross-domain Identity Management (SCIM).  SCIM is an open standard designed to manage user identity information.  It is possible to use all three methods to provision users to the tenant.  However, it is recommended that only one method be used to avoid confusion.   As more and more resources migrate to the cloud, it makes sense to use an Identity Provider (IDP) which resides in the cloud as well.  SCIM provides a defined schema for representing users and groups, and a RESTful API to run CRUD operations on those user and group resources.   This guide provides administrators the ability to migrate from the Netskope Tools Director Importer to SCIM, regardless of the service provider such as Okta or Ping.   Netskope Tools Directory Importer Netskope Tools Directory Importer is installed, running, and on the latest

I hope this will just be a pointer to the resource...Is there a repository with more details about what the signatures are.  Or a way to see what caused the match?   Some of the descriptions are quite vague, and it's hard to determine if an exception should be created.eg: Sig 20019  "MALWARE-CNC User-Agent known malicious user agent - test"

How do you feed the Netskope SSPM Alerts to SaaS Application Administrators?   The Netskope Cloud provides a wide range of innovative and competitive products, among which one of the most important offerings should be Netskope SSPM. SSPM stands for SaaS Security Posture Management and is used to continuously monitor cloud-delivered Software-as-a-Service applications. This service monitors the SaaS applications' configuration to ensure that they are configured securely and in compliance with regulations. Security administrators can set policies and receive alerts for SaaS application instances that do not adhere to the required policy.   Typically, SaaS application administrators are not part of the company's core security team. Instead, the security team receives the SSPM alerts for all the SaaS applications. These alerts must be forwarded to the respective SaaS application owners so that they can work on remediation. In some cases, the security team might be hesitant to gran

Netskope Administration for Departing Users   When a user announces their departure from the organization, it's crucial to implement stringent controls and checks to protect corporate data and resources. The user's account should immediately be placed into a "Leaving Users" group within their Identity Provider or Directory Services. This move should trigger a set of pre-configured policies for these accounts.   Critical Policies to be Enabled Restricted Activities: This policy limits certain user activities to prevent potential loss of data: Unable to Delete Files: Prevents the user from unintentionally or maliciously deleting crucial company information. Unable to Share Files to Any Non-Corporate User: Ensures sensitive company data isn't shared externally. Unable to Download from Salesforce: Ensure customer and prospect data from being downloaded. Restricted Instances: This policy confines the user's interaction with certain instances: Unable to Upload any files to Non-

Netskope Administration for Contractors & Third Parties   Contractors and third parties often require access to company resources to fulfill their tasks, yet they exist outside the organization's direct control and may not be fully aligned with the company's security culture or protocols. The necessity for elevated or different security protocols for contractors and third parties stems from the unique risks these roles introduce.  This document will outline some approaches within Netskope to protect business assets from contractors and third parties.   Deployment Modes   Forward Proxy (Netskope Client Installed)   For contractors or third parties given a managed corporate device with a Netskope Client installed, we recommend using Netskope's Forward Proxy Mode. This mode offers granular control over web traffic and cloud app usage, ensuring secure access and data protection.   Pros: Large Scope Access Control: Forward proxies can be used to limit acce

Netskope Administration for Developers   While it is necessary to provide adequate security measures in your environment, it's important to be aware of the unique needs of your developers and coders. Their work often involves accessing and interacting with various applications like GitHub, which may lead to issues if proxy services interfere with their work. Here are some recommendations:   Bypass SSL Inspection for Specific Applications   While not generally recommended, it may be beneficial to bypass SSL Inspection for applications such as GitHub, which developers frequently use. This ensures that developers' traffic is not interfered with during their code creation. Instead, opt to utilize Netskope's API-enabled protection to provide visibility and partial control over the data inside GitHub. Remember that GitHub traffic would be inspected if accessed by anyone outside of the Developers User Group.   Deployment Modes   To cater to developers' needs, you have

Hybrid work changes the way people use applications. In this video, learn about how Netskope Cloud Firewall delivers the protection you need everywhere your business operates.  

Securing administrative access to the Netskope tenant is an important security control.  When Single Sign-On (SSO) is not an appropriate choice for some administrators, Multi-Factor Authentication (MFA) should be used.   Docs.netskope.com describes the process for enabling MFA for local Netskope admins who are not managed via SSO.  The default authenticator is Google Authenticator, but other ones can be used.   https://docs.netskope.com/en/multi-factor-authentication-for-netskope-admins.html   This article describes how to set up Microsoft Authenticator.   1) Enable MFA on tenant     2) Next time the tenant admin logs into Netskope tenant   3) Tenant admin presented with authenticator setup (note Google Authenticator default)   4) Admin opens Microsoft Authenticator app on device   5) Add Work or school account   6) Scan QR code from Microsoft Authenticator   7) Use Authenticator code when prompted to login to Netsk

Organizations are grappling with the decision to allow or block ChatGPT given the risk of leaking sensitive data. In this video, Bob Gilbert, VP of Security Cloud GTM Strategy and Chief Evangelist, demos how Netskope solutions can help your organization enable safe usage of tools like ChatGPT with active user coaching and data protection.  

On May 3rd 2023 Google Registry announced the release of eight new top-level domains (TLD). Two of these domains share the same naming conventions as common file names which are .zip and .mov. These TLDs could pose an increased risk to organizations through the use of social engineering attacks. For example https://github.com/kubernetes/kubernetes/archive/refs/tags/@v1.27.1.zip looks likes a legitimate domain to a GibHub repo to download a .zip file for kubernetes, however the link actually takes you to the domain of v1.27.1.zip.    How does Netskope mitigate the threat from these domains?   The Netskope platform can help prevent phishing attacks through the use of deep learning for phishing website detection and remote browser isolation which work across all top-level domains.   Figure 1: Testing RBI with m365install.zip domain    How can Netskope help provide insight into domain usage in an organization’s environment?    Even with controls in

With the growing popularity and use of ChatGPT, it is increasingly important to also monitor and secure private details and company confidential information from being shared with ChatGPT.  As the Customer Zer0 team (CISO group), we have implemented some DLP rules for ChatGPT. Please note that currently, Netskope does not yet have a predefined connector for ChatGPT. We would hence need to create a custom connector so that DLP rules can be applied instead of an outright block to the webapp. We want our users to continue to use ChatGPT with discretion in an enterprise environment. This custom connector can be built from HAR logs.  Here’s what we have in place: Realtime policy   The Netskope chatgpt custom DLP profile contains the ‘netskope’ keyword.  Results and end-user experience In this example, DLP source code classifier is getting triggered, and hence the question is not being posted to ChatGPT.    PII and PCI data being blocked from getting poste

In this demo, learn about basic Advanced Analytics concepts and start building a dashboard from Explore.     Do you want to see demos of other Advanced Analytics use cases?  Leave a comment and let us know.

Netskope experts Parag Thakore and Muhammad Abid will discuss how the enterprise architecture is at a crossroads, and how it must evolve to converge network and security at every edge. They’ll talk about how Netskope SASE makes no sacrifices on network performance or security protection and helps organizations to consolidate products, reduce costs, and simplify operations. What you’ll learn:How Netskope SASE delivers consistent performance and security for any user, app, device, cloud or site. How Borderless SD-WAN addresses multiple use cases with a single lightweight software. How to implement a truly converged platform that simplifies operations and reduces costs. Get answers to all of your toughest questions on SASE and future-state architecture. 

The Netskope SMTP Proxy can be used as a service to scan outgoing emails over SMTP for DLP violations. In this solution, an email initiated by the user is received by a cloud email service such as MS O365 Exchange or Gmail. The email is then passed through the Netskope SMTP Proxy integrated into your SMTP workflow. Netskope SMTP Proxy verifies the contents of the email against Real-time Protection policies and acts on DLP violations based on the policy configuration. The email is then passed on to an upstream MTA which looks up the DNS of the destination email service and sends  the email to the recipient's server.   As the Customer Zer0 team (CISO group), we implement SMTP proxy for our Gmail corporate instance and have been implementing DLP rules to monitor and control the movement of sensitive and confidential internal only emails to non-Netskope email addresses.    Netskope Configuration Workflow Ensure SMTP proxy is configured on your Netskope tenant: https://

Steps That Should be Taken by the Security Group, Business Continuity, and Finance Teams   Introduction On Friday, March 10, 2023 news broke that SVB was in trouble.  With this news, activities started within our organization to understand our direct exposure. As with any event what we have learned over time is that fraudsters are quick. This rang true with Silicon Valley Bank (SVB). At that point cybersecurity, third-party risk, and business continuity were not included.   When these situations arise, it’s important to ask questions like, what if your company was hit with a bank fraud event like SVB Bank? Are you prepared? Do you know what steps to take before, during and after the event? In this document we want to share a few things we learned from the SVB event and how those learnings could help you in your business.    Our first step when the news broke was to look inward. The financial and accounting teams looked at how SVB Bank impacted us directly. Whil

How do you create a "shadow" group that is only located in the tenant, not reliant on an IDP? Add the group to the SCIM database directly using Postman or similar method and/or tool. The use case in this instance is to create a group that is specific only to the tenant and "hidden" from the sight of others who are not Netskope tenant admins. A good example of this is creating a group which contains users who should be in an "offboarding" group, but are also members of the team who manages the IDP, i.e. Okta, that is set to provision users and groups to the tenant. This will only apply to users who are provisioned to the tenant via SCIM from an IDP such as Okta. It cannot and should not be used when users are provisioned to the tenant using the Netskope Directory Importer or manually added to the tenant. A high level overview of meeting this use case are: Download and install the Postman application; Import a Postman Collection for Netskope SCIM; Create a "shadow" group using Pos

In this session, you’ll hear about key use cases to implement protections that stop threats, protect data and identify sources of risk. Our Product Management and Customer Experience team will cover the latest platform updates from Release 100, 101, and 102. Key product updates include: Extended DLP capabilities to on-prem email via Netskope SMTP Proxy Expanded CASB coverage with new API functionality for Zoom Team Chat, Atlassian (JIRA/Confluence), and ServiceNow, as well as Security Posture Management (SSPM) coverage for Microsoft SharePoint, Exchange Online, and Salesforce Increased context awareness with UEBA for User Confidence Index (UCI) and improved app request workflow in Cloud Confidence Index (CCI) Enhanced threat protection with digital rights enforcement in Netskope RBI and defense against C2 attacker traffic via Netskope Intrusion Prevention Improved the Netskope Client user experience with optimal gateway selection improvements and Linux OS support  

On March 29, 2023, a number of security companies were warned about harmful activity that was traced back to a legitimate binary file from the communication technology firm 3CX. The file, called 3CXDesktopApp, is a popular video-conferencing software that can be downloaded on different platforms. Several analyses have attributed the threat campaign to state-sponsored threat actors, and security firms have observed malicious activity in both Windows and Mac environments. On Thursday, March 30th, 3CX confirmed that multiple versions of its desktop app for Windows and macOS were affected by a supply chain attack. The version numbers include 18.12.407 and 18.12.416 for Windows and 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 for macOS. This post will describe how to use Netskope to identify possible indicators of use (IOUs) of the 3CX desktop app, indicators of compromise (IOCs), and how to mitigate any further malicious activity.  Indicators of Use If you are uncertain about the u

Salesforce is an enterprise cloud computing company that provides business software on a subscription basis. The company provides on-demand customer relationship management (CRM) solutions such as Sales Cloud, Service Cloud, Data Cloud, Collaboration Cloud, and Custom Cloud. As the Customer Zero team (CISO group), we are currently monitoring and securing access to Salesforce internally with a breadth of products that are developed and maintained by the development and QA teams. These capabilities include areas such as client enforcement, inline protection, API-enabled protection, SaaS security posture management (SSPM), and Cloud Firewall, to name a few. In this guide, we will provide a perspective of how Netskope’s products and capabilities are used internally for securing enterprise data.  Real-time Protection We are restricting access to the Salesforce app for Netskope employees through client enforcement, whereby access to Salesforce would be granted only if users are connect

Are you planning for a Shift Left approach for your security architecture? This document provides practical guidance on “Shift Left”, its approach and applicability  towards enterprise wide security architecture and governance, covering both the corporate and product lifecycle. In this document we will talk about the Common Architecture Criteria (CAC) as a framework to apply at the architecture, design, and implementation layers such that Shift Left helps drive a concise and consistent approach across onboarding third-party applications or developing and deploying internal applications early on throughout the lifecycle that provides multiple benefits such as architecture optimization, operational efficiency,  faster delivery, and more. Shift Left principle: The Shift Left principle advocates identifying and shifting tasks as early as possible into the lifecycle, which in turn helps for better planning and execution translating into better quality and workflow optimizations. T

The Netskope Threat Exchange module within Cloud Exchange is our open source solution to IoC sharing between security tools. Once configured, Threat Exchange can store and share thousands of IoC’s from tools such as Netskope, CrowdStrike, Microsoft Defender, ThreatConnect and many others, alongside the capability of adding IoC’s via Cloud Exchange’s API. The large amount of data pulled can be overwhelming, so we wanted to share some best practices for Threat Exchange that you can follow and use within your own environment. Refine Your Business Rules. Your business rules are one of the most important aspects of your Threat Exchange instance since they are used for your sharing configurations. Unless you want everything being shared over to your set of configured tools, you will need to refine your business rules to the specific items you want to send. You can leverage fields found within the IoC’s you pull. For example, some plugins will allow you to pull severity information from t

PostgreSQL is the world’s most advanced enterprise-class open source database management system that is developed by the PostgreSQL Global Development Group. It is a powerful and highly-extensible object-relational SQL (Structured Query Language) database system popular for its reliability, feature robustness, and high performance. It is known to be highly scalable, both in the amount of data it can store and manage and in the number of concurrent users it can accommodate.   How does it work? PostgreSQL uses a client-server model where the client and the server can reside on different hosts in a networked environment. The server program manages the database files, accepts connections to the database from client applications. It can handle multiple concurrent connections from clients by “forking” a new process for each connection. It executes database requests from clients and sends the results back to the clients. Remote clients can connect over the network or internet to the serv

Netskope Alerts via Slack Messages Prerequisites: Slack channel with a webhook.https://slack.com/help/articles/115005265063-Incoming-webhooks-for-Slack Cloud Exchange version 3.2 and above. Netskope Tenant added to Cloud Exchange. Procedure: Step 1. Netskope ITSM (CTO) Plugin Setup (skip to step 2 if already setup): Login to Cloud Exchange as a user with admin privileges. Navigate to Settings > Plugins.     Click on the Netskope ITSM (CTO) plugin.   Name the configuration and set the tenant field to the Netskope tenant you want to receive alerts from. Click Next.   Navigate to Ticket Orchestrator and click on Alerts. Make sure the section is being populated with alert data from the configured tenant.   Step 2. Notifier Plugin for Slack Webhook (CTO) Setup: Navigate to Settings > Plugins.     Click on the Notifier (CTO) plugin.   Name the configuration and set the sync interval. The default of 60 minutes is recommended, but for