Netskope Global Technical Success (GTS)
Cloud Storage Access: Monitoring and Restriction Strategies
Netskope Cloud Version - 123
Objective
This document aims to analyze and implement effective measures for monitoring and controlling cloud storage access. It provides a structured approach to implementing policy controls that regulate data access and sharing. These measures will help enforce security policies, mitigate risks, and optimize cloud storage usage.
Prerequisites
- Netskope CASB Inline/SWG license
- Netskope Advanced Analytics license
Procedure
Analyze Cloud Storage Access Using Advanced Analytics
With Advanced Analytics, administrators can gain insights into cloud storage traffic patterns, including:
- CCL scores for each application to assess risk levels.
- Instances identified within the cloud environment.
- Activities performed on each application for better visibility.
- Total bytes uploaded and downloaded by applications.
- Top applications by data usage to monitor bandwidth consumption.
- Additional insights to optimize cloud storage access and security.
Check out the attached sample Cloud Storage Dashboard customized for this use case. You can import it into your tenant to explore the insights in detail.
Check out the below document to know how to Import a Dashboard :
https://community.netskope.com/video-library-20/imports-and-exports-of-dashboards-5804
Structuring a Cloud Storage Policy
Based on the report from the dashboard, 23 cloud storage applications were detected in my tenant. Among them, 32% have low or poor CCL scores, indicating potential security risks.
The analysis shows that users are sending and receiving files across multiple applications, along with other identified activities. My sanctioned cloud storage applications are Office 365 OneDrive and Google Drive, but I also observed users accessing personal instances of these services.
To address this, I have designed a cloud storage policy as follows:
- Full control is granted only for sanctioned instances.
- Limited or blocked access is enforced on unsanctioned cloud storage applications and personal instances to prevent unauthorized access.
Rule 1 - App instance based policy
Check out the community document below for step-by-step guidance on creating instance-based policies
Rule 2 - A custom category-based policy that allows limited access to permitted personal instances and includes additional URLs categorized as cloud storage, serving as backend URLs for other corporate applications.
Certain applications generate traffic to cloud storage-related URLs in the background. For example, when a user attaches a screenshot in Google Gmail, the request is sent to a URL under "googleusercontent.com," which comes under cloud-storage category even though the application itself is recognized as "Google Gmail."
To manage this effectively, administrators should review the Advanced Analytics report to identify which applications initiate cloud storage-related requests . Once these applications are identified, the admin must create a CCI tag for all the required applications, combining it with the "Cloud Storage" category. This ensures that other applications remain unaffected.
The attached Advanced Analytical dashboard includes a data table displaying the cloud storage domains accessed by each application. For example, Google Gmail and Google Chat are initiating cloud storage access to googleusercontent.com.
Note: The data retention period for transaction logs must be considered. Schedule the report to run daily and evaluate it for at least one week to identify any new applications and domains that may appear.
- How to Create a CCI Tag: cLink]
I have applied the CCI Tag to these applications as shown:
Realtime Policy
Rule 3: Category based policy to block all the other Cloud Storage Applications
Note:The Cloud Storage category is sensitive, as many applications have backend URLs that fall under this category. Therefore, it is strongly advised not to set the action to "Block" in the initial phase. Instead, configure the action as "Alert" and monitor activity for a few days or weeks.
The dashboard includes a section displaying all applications that initiate cloud storage access with Alert/Block actions. By monitoring this section, you can identify any necessary applications that need to be allowed and add them to the CCI tag created in Rule 2.
Realtime Policy
Final policy order:
Verification
Author Notes
- It is also important to implement DLP controls to stop Data Exfiltration.
Terms and Conditions
- All documented information undergoes testing and verification to ensure accuracy.
- In the future, it is possible that the application's functionality may be altered by the vendor. If any such changes are brought to our attention, we will promptly update the documentation to reflect them.
Notes
- This article is authored by Netskope Global Technical Success (GTS).
- For any further inquiries related to this article, please contact Netskope GTS by submitting a support case with 'Case Type – How To Questions'.