Security Posture Management

In this article we show how to set up an automatic remediation workflow in Azure, leveraging the APIs available in Netskope’s Cloud Security Posture Management. We’ll show how a security rule can be automatically remediated in Azure, and we’ll show how that remediation can happen  either based on a time trigger or a HTTP trigger.   This workflow can be used for many types of violation, in this article we will be considering the use case where we want to remedy a violation where an Azure key Vault does not have purge protection enabled.   The source code is available at https://github.com/netskopeoss/CSPM-Azure-AutoRemediation Setting Up   Netskope SPM detects violations for key vaults where purge protection is disabled as a part of the rule: Ensure KeyVault is recoverable. In this solution there are two Azure function apps involved. The first is a FetcherForKeyVaultRecoverableHTTP used for getting a list of violating resources from Netskope SPM. The second is a

Netskope’s new graph-powered SaaS Security Posture Management (SSPM) engine can help security analysts investigate root causes and identify repeating patterns for all kinds of security misconfigurations. To help one get started with the SSPM and the powerful queries made available by the Netskope Governance Language (NGL), we’ve collated this post to show you some easy sample investigations you can perform with Azure AD / Microsoft 365 environments. To get to the Next Gen SSPM features and NGL from the Netskope main view, one needs to navigate to “API-enabled Protection -> Security Posture (Next Gen) -> Inventory” and click the icon on the right side of the filters toolbar. This opens up the NGL query tool which we will be using for the rest of the article.   The most basic use case for NGL would be to simply list resources by their type. Since NGL is a pattern matching language designed to identify which resources comply with a given criteria, we need to formulate our quer

Hi Guys,Does anyone know a site to check on Netskope Proxy status in Real Time ?

In this article we’ll demonstrate how you can implement automatic remediation for security posture violation findings discovered by Netskope Cloud Security Posture Management (CSPM).   Netskope CSPM continuously assesses public cloud deployments to mitigate risk, detect threats, scan and protect sensitive data and monitor for regulatory compliance. Netskope simplifies the discovery of security misconfigurations across your clouds. Netskope Auto-Remediation framework for GCP enables you to automatically mitigate the risk associated with these misconfigurations in your GCP cloud environment.   Netskope CSPM security assessment results for such security benchmark standards as NIST, CIS, PCI DSS, as well as for your custom rules are available via the View Security Assessment Violations Netskope API.   Netskope auto-Remediation solution for GCP deploys the set of GCP Cloud functions that query the above Netskope API on the scheduled intervals and mitigates supported violation

Is it fair to say that Netskope can be used to protect user activity when connected to public wifi?

Does the Netskope Agent update work with Nomad software cache 1E- Vendor?

Hi All,  I am looking for getting alerts from the Netskope tenant. So far I am seeing 2 API endpoints which gives me similar results.  https://docs.netskope.com/en/get-alerts-data.html https://docs.netskope.com/en/view-security-assessment-violations.htmlCan someone please help me understand the difference between them? And when should I use which endpoints?  I am very new here, let me know if I started the discussion at the wrong place. thanks!

The guides linked to below illustrate how to configure Netskope IPSec tunnels with your AWS environment for egress traffic filtering and monitoring. This integration provides unmatched visibility and real-time data and threat protection for the traffic leaving your AWS environment. Steering your AWS egress traffic to the Netskope cloud allows you to apply full capabilities of the Netskope platform, including cloud network firewall, web content filtering, data leakage and threat protection, third-party risk protection, etc. You can integrate your AWS environment with Netskope with the following methods: You can establish IPSec VPN tunnels with AWS Site-to-Site VPN between your AWS virtual private gateway, which is associated with a single Amazon Virtual Private Cloud (VPC) and Netskope Points of Presence (POPs). You must repeat this implementation for each Amazon VPC from which you’d like to steer traffic to the Netskope cloud. With this option, you can stream up to 250 Mbps of bandwidt

The Netskope CSPM and Storage Scan services are multi-account security solutions that provides visibility into resources, configurations, data protection, and malware on the AWS cloud. Implementing this solution, you can identify and remediate risky misconfigurations, identify sensitive data (DLP), and detect malware and ransomware.   The purpose of the AWS Implementation Guide is to enable every AWS Marketplace customer to seamlessly activate, deploy and configure the Netskope CSPM and Storage Scan in AWS Control Tower environment while taking full advantage of the resources pre-configured by AWS Control Tower as part of the initialization.   Solution overview and features Netskope Cloud Security Posture Management (CSPM) and Storage Scan allows organizations to confidently adopt and secure multi-cloud services. The Netskope solution gives organizations the ability to continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensiti

In this article we’ll demonstrate how you can implement automatic remediation for security posture violation findings discovered by Netskope Cloud Security Posture Management (CSPM).   Netskope CSPM continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensitive data and monitor for regulatory compliance. Netskope simplifies the discovery of security misconfigurations across your clouds. Netskope Auto-Remediation framework for AWS enables you to automatically mitigate the risk associated with these misconfigurations in your AWS cloud environment.   Netskope CSPM security assessment results for such security benchmark standards as NIST, CIS, PCI DSS, as well as for your custom rules are available via the View Security Assessment Violations Netskope API. Netskope auto-Remediation solution for AWS deploys the set of AWS Lambda functions that query the above Netskope API on the scheduled intervals and mitigates supported violations autom

We've continued our blog series on AWS Best Practices, and just published: https://www.netskope.com/blog/a-real-world-look-at-aws-best-practices-logging . Although CloudTrail is a well-trodden subject for AWS Security, there were still a few interesting findings among a slice of our customer base:   Enable VPC flow logs: 81% of VPCs do not have VPC flow logging enabled, which will hinder incident response and investigations. Encrypt CloudTrail logs at rest: 91% of CloudTrail logs are not encrypted at rest. Encryption at rest supports data compliance controls and is easy to do. Ensure S3 bucket access logging is enabled for CloudTrail buckets: 41% of CloudTrail buckets do not have server access logging enabled. Logging should be enabled for all CloudTrail S3 buckets. Ensure CloudTrail logs are integrated with CloudWatch or a SIEM: 54% of CloudTrails are not integrated with CloudWatch. These should be reviewed to ensure they are integrated w

Azure has the following logic to check  Active Directory for stale users: refreshTokensValidFromDateTime > STS TokenLifetimePolicy MaxInactiveTime (default of 90 days for Azure, may vary for customer) + acceptable number of days past the refresh token, for which an account can be inactive( in this case 30).   Security Posture Management can help with custom rule for above use case as in :   User should not have LastTokenChange isEarlierThan ( -120, "days")

Public IP addresses allow Internet resources to communicate inbound to Azure resources.   Security posture Management can help with custom rules to ensure that specifically tagged VM instances  donot have a Network Interface with public IPs assigned. The custom rule would look like following:   VirtualMachine where Tags with [ Name eq "confidential" ] should not have NetworkInterfaces with [ IPConfigurations with [ PublicIP len () gt 0 ] ]

Every company uses tagging and resource labeling in their own way. Among other uses, mature labeling practices are a great way to identify resources to their cost centers, keep track of their purpose and contents for compliance requirements and for naming ownership and maintenance responsibilities. Netskope Security Posture Management can help enforce good labeling practices with a few simple custom rules suited to your needs. How to ensure that every resource of a given type is labeled properly Most common use case for label policy enforcement is to ensure that resources are labeled at all. For example, if we want to ensure that every EC2 instance in our AWS Cloud carries a label named "org-unit", we can write the following rule for AWS monitoring:  EC2Instance should have Tags with [ Name eq "orgunit" ]   Once added to a compliance profile and being monitored by a Security Posture Policy, this rule should show in the Security Posture view with findings like this:   Likewi

Organizations have their own  convention of tagging buckets containing PII objects . We can leverage Security Posture Management to create custom rules to check if these specifically tagged buckets are open to the public:   AWS : S3Bucket where Access eq "Public" should not have Tags with [ Name eq "PII" ]   Azure: StorageAccount where ( Tags with [ Name eq "PII" ] ) should have every BlobContainers with [ Access eq "None" ] or not AllowBlobPublic   GCP: Bucket should not have Policies with [ Members . AllUsers eq True or Members . AllAuthenticatedUsers eq True ] and Tags with [ Name eq "PII" ]

Inside an AWS Private S3 bucket, a specific object can be made public by using any of the following steps:     Update the object's access control list (ACL) using the Amazon S3 console Update the object's ACL using the AWS Command Line Interface (AWS CLI) In order to make sure that a specific object is not turned public inside an otherwise private S3 bucket, we can make use of the AWS Block Public Access Settings , specifically the IgnorePublicAcls (Block public access to buckets and objects granted through any access control lists (ACLs)) boolean. Netskope SPM allows to write  custom rule for checking the above  configuration for each S3 bucket: S3Bucket should have Access eq "Private"  

Build custom rules under Policies > Security Assessment using Domain Specific Language (DSL) for Security Assessment of AWS, Azure, and Google Cloud resources.   The following syntax diagram represents the general rule to write a DSL statement.     Rule Format: <entity> [where <condition>] should [not] have <condition>   For example: Entity An entity defines what the rule is checking against. It can be used alone or with a condition to further specify the entity. Here are some examples of using an entity.   Condition A condition is a standard that the rule uses to check against an entity to narrow down the result.     The following table provides examples of using a condition. The formats in this table are applicable to all properties. Function Use functions in rules to find specific information about entities. Functions use the following syntax, <entity> <function>(<argumen

Security groups (AWS, Azure) and firewall rules provide stateful filtering of ingress/egress network traffic to Cloud Provider resources. The AWS rule below provides protection against security group allowing unrestricted ingress access to port 22 (SSH). This rule can easily be modified to provide similar protection for other ports such as RDP (3389), Oracle DB (1521), PostgreSQL (5432), MySQL DB (3306), MongoDB (27017), Microsoft-DS (445), HTTP (80), TCP (445), DNS (53), FTP (21), Telnet (23), SMTP (25), and more. See below for example rules in AWS, Azure, and GCP.   AWS: EC2Instance should not have SecurityGroups with [ InboundRules with [ IPRanges with [ IP isPublic () ] and Protocol in ("-1","tcp") and ( (FromPort lte 22 and ToPort gte 22) ) ] ]   GCP: FirewallRule where Disabled eq False should not have Direction eq "INGRESS" and Allowed with [ Protocol in ("all", "tcp") and Ports with [ ( FromPort lte 23 and ToPort gte 23 ) ] ] and SourceRanges with [ Value eq 0.0.0.0/0