Learn

We just published another blog related to application risk from OAuth applications: Who Do You Trust? Challenges with OAuth Application Identity . This follows up on several other recent blogs related to OAuth: Who Do You Trust? OAuth Client Application Trends   New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)    In this blog, we discuss some of the challenges that aren't addressed by the OAuth protocol, specifically the challenges in identifying an OAuth application that a user is trusting with access to data or other resources.   The scenario is: A user or administrator or an organization is prompted whether to trust an application -- you see an application title (created by the developer) -- is it real or is it fake?    Unlike the more-established field of malware that utilize DNS, we have nothing akin to DNS registrars, passive DNS databases, certificate authorities, so it makes the task of identification and att

We just published A Real-World Look at AWS Best Practices: Networking, part 6 of our AWS Best Practices series, looking closer at networking configurations with NACLs and Security Groups with respect to inbound access from the Internet to RDP and SSH, as well as the use of Default Security Groups (not recommended).   In reviewing anonymized customer, we found opportunities to improve security: Use More Secure Remote Access: Replace security groups that allow inbound Internet access to remote admin ports with more secure methods to remotely administer EC2 instances. 4% of the security groups in use allow inbound Internet access for SSH or RDP.  Do Not Use Default Security Groups: Ensure that default security groups do not allow any traffic and are not used. 609 default security groups (1% of all security groups) are being used and allow traffic of some kind. Some additional, relevant material you may want to also read: It’s All About Access: Remote Access Statisti

Open forum for anyone who has completed the Netskope Security Cloud Introductory Online Technical Training.   Feel free to ask questions, provide feedback or help out your peers with anything you can contribute.

The Ragnarok ransomware gang had been around since 2019, and suddenly ceased operations today, posting a universal decrypter and instructions on how do use it. What does this mean for the risk of ransomware? Not much. This week, we published a blog post about BlackMatter, a newcomer to the ransomware space. This is just the normal revolving door of ransomware operators, all following the same ransomware-as-a-service business model, using the same tactics, and trying to put controls in place so their affiliates don't target anyone that results in too much attention for the operators.   Netskope protects against ransomware using a multi-layered approach that includes signatures, machine learning, static heuristics, and sandbox analysis to prevent ransomware from making its way onto any of your endpoints. One of the most common ransomware delivery tactics we are actively blocking is ransomware delivered as next-stage payloads by malicious Microsoft Office Documents. Our Office Docum

In part 5 of our continuing series on AWS Best Practices, we cover real-world stats on storage, specifically public access on buckets and encryption of EBS volumes: https://www.netskope.com/blog/a-real-world-look-at-aws-best-practices-storage   One of the challenges is having a clean process to provision, secure, and continually monitor whether data storage such an S3 bucket should be public or private.   How does your organization manage this? - do you use tagging, resource groups, or accounts to identify whether buckets are expected to be private or public? - do you enforce that a bucket is completely public/private by using bucket level ACLs/policies rather than object-level? - do you have additional audit checks on the above?   Additionally, how do you look upon encryption at rest? Is it solely for compliance, so AWS keys are sufficient or do you use CMKs of your own for real data privacy?   Would love to hear comments on how customers are managing this crucial

I have read somewhere that completing Netskope Cloud Introductory Online Technical Training and Netskope Security Cloud Hands On Training will get me a Netskope Could Security Specialist. I've completed both training but still haven't received anything regarding the specialist certification. Can someone help me how can I grab Cloud Security Specialist certification?

We just published the first three parts of a multi-blog series on new phishing attacks that can exploit OAuth 2.0 authorization flows: https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authorization-flows-part-1 https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authentication-flows-part-2 https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authentication-flows-part-3   We believe there will be an increasing trend in phishing and other attacks that abuse the OAuth protocol itself in order to gain advantages such as: obtaining OAuth session tokens which bypass MFA and are practically permanent, as well as take advantage of quirks such as being able to spoof other applications easily.   This is based upon a Def Con 29 presentation given on August 7, 2021. Currently, there is more exposure for Microsoft O365/Azure users due to their implementation of the device authorization grant flow. However, much of the material applies to a

We recently published a blog, Operationalizing IP Allow Lists for Cloud Environments, talking about the process and phases for effective implementation of IP allow lists. IP allow lists have traditionally been difficult to maintain without getting quickly out of date. We'd love to hear about your experiences. Do you use IP allows lists? For what, in which contexts? What do you use to mitigate compromised credentials? MFA? IP allow lists? other? Does Netskope's proxy architecture help you implement more effective IP allow lists? Was the blog post helpful or too high-level? Would it be useful to have more prescriptive examples (code) ?

We recently published Who Do You Trust? OAuth Client Application Trends which looks at real-world trust of applications by users using Google Identity for authentication and approval. It highlights some of the common applications and permissions being requested.   Some questions for you: Are you aware of which OAuth client applications are being trusted by your users? Do you have good visibility into this data? Are you locking down your environment in any way e.g. not allowing users to grant consent or approve apps? What would help you understand and manage risk from oauth client applications?

Continuing our blog series on AWS Best Practices, we've published two additional blogs looking at real-world AWS environments and practices around IAM policies and password policies, along with easy steps you can take to reduce. Our findings include: - 4% of IAM policies grant full admin privileges - 47%-67% of IAM users are using inline or directly attached policies - 73% of account password policies have password length < 14 characters - 80% of IAM user accounts have a password reuse setting < 24 times   Here are some concrete steps that can be taken to reduce risk related to IAM Policies and Password Policies: Create IAM Policies and roles with only the minimum privileges necessary.  Inline policies should be replaced with managed roles that are centrally managed. IAM Policies should be attached to groups or roles, instead of users. Customize your AWS Password Policy and do not use the default. Increase the password length to at least 14, and set the pass

Open forum for anyone who has attended a Netskope Cloud Security Workshop session.   Feel free to ask questions, provide feedback or help out your peers with anything you can contribute.

Open forum for anyone who has attended a Netskope Security Cloud Hands On Labs session.   Feel free to ask questions, provide feedback or help out your peers with anything you can contribute.

In this webinar, you will hear from our Product Management, Technical Customer Success, and Product Marketing teams to get insight into our recent product releases and how you can put them into practice.  Learn about HTTP/2, the latest deployment options, enhancements to threat protection, new data protection features, the latest additions to policy and much more across Netskope products including; NG-SWG, NPA, Cloud Security, Steering, DLP and Threat.  We would love to get your feedback on what topics you'd be interested in learning about on our upcoming customer webinars. Please comment below with topic suggestions!  See below for a download of the webinar slides.

Open forum for anyone who has attended a Netskope Security Cloud Implementation & Integration class.   Feel free to ask questions, provide feedback or help out your peers with anything you can contribute.

We want to help ensure you are maximizing your investment and fully unlocking the potential of your deployment.  Key Topics: Brief recap of the latest Netskope platform functionality New updates to API-enabled Protection for O365 OneDrive, SharePoint, and MS Teams Tips, best practices, and a hands on tutorial covering tagging apps and app instances   Let us know your thoughts on the topics discussed below! Netskope Community Team

In this webinar, we introduce Email DLP, highlighting new research in the latest Cloud and Threat Report, as well as sharing the latest advancements in our Microsoft partnership to enhance your security. Key topics: How Netskope provides 4-in-1 DLP across SaaS, IaaS, web and email environments. The top threat and data loss vectors highlighted in the February 2021 Netskope Cloud and Threat Report. How Netskope and Microsoft integrate their solutions to enhance the security strategy of joint customers.Let us know your thoughts or questions you may have on these topics in the comments below!

Our latest blog post shares stats that show the amount of malware delivered via cloud apps continues to increase. Cybercriminals are deliberately abusing popular cloud apps for malware delivery to exploit trust and blend in. https://www.netskope.com/blog/cloud-and-threat-report-cloudy-with-a-chance-of-malware   Netskope can scan downloads for malicious content whether they originate from a cloud app or traditional web infrastructure. To ensure that your users are protected, create a "Threat Protection Profile" policy that scans all categories and all activities and blocks malicious content.  This policy covers all cloud and web activities to ensure complete protection, no matter which delivery method an attacker targeting your users chooses.      Every malware alert will contain the field "traffic_type" which indicates whether the alert is from a "CloudApp" or the "Web".  You can search SkopeIT for all cloud malware alerts: traffic_type = 'CloudApp' and (

In our latest blog, we explore IAM best practices and AWS and highlight two findings:   The majority of organizations don't enforce access key rotation for their IAM users. The majority of organizations aren't deleting inactive IAM accounts. We access keys that were nearly a decade old and many IAM accounts that hadn't been used in over a year, exposing a lot of risk surface that can likely be locked down.  How can you identify these old access keys and inactive IAM accounts? We have two Security Assessment rules that can help:   Remove/disable inactive user accounts within 90 days   Remote access: Ensure access keys unused for 90 days or greater are disabled   Once the rules have run, you will see the results in your compliance report.   Oops, I have a couple of  users in this AWS account that require some cleanup! I'll just follow the remediation guidance to ensure those two rules are marked green next time around. 

Today's network professionals are challenged with providing their users fast and direct access to their apps and data paired with the security controls the business requires. In this Straight Talk video, Netskope Senior Vice President, Joe DePalo discusses how Netskope delivers world-class security and data protection without performance tradeoffs.  

The blog post shares the details of our analysis:  https://www.netskope.com/blog/a-real-world-look-at-aws-best-practices-root-accounts   The Netskope Security Cloud makes it easy for you to check if your users are following these best practices, following the CIS AWS Foundations Benchmark. You can find and enable the four rules by searching for "Root" under the CIS AWS Foundations Benchmark profile.    If you have already enabled the CIS AWS Foundations Benchmark profile, you can view the results across your company.  Search "root" under the "Rule Name" filter to identify the four rules and check your results.