Skip to main content

Security Posture Management

This is a discussion board on Netskope’s Security Posture Management (CSPM + SSPM) solutions that provide continuous security assessment, enforce a strong security posture, prevent configuration drift, and streamline compliance across clouds.

  • 39 Topics
  • 45 Replies
39 Topics
P
paulsmithauNew Member
posted in Security Posture Management
Netskope for protecting users on public WifI

Is it fair to say that Netskope can be used to protect user activity when connected to public wifi?

3430
mherbinet
Netskope Employee
N
nish0101New Member
posted in Security Posture Management
Netskope and Nomad software cache 1E- Vendor

Does the Netskope Agent update work with Nomad software cache 1E- Vendor?

690
myee
Netskope Employee
J
jayjoshi-crestExplorer
asked in Security Posture Management
What is the difference between Alert and Security_assessment endpoints in API?

Hi All, I am looking for getting alerts from the Netskope tenant. So far I am seeing 2 API endpoints which gives me similar results. https://docs.netskope.com/en/get-alerts-data.html https://docs.netskope.com/en/view-security-assessment-violations.html Can someone please help me understand the difference between them? And when should I use which endpoints? I am very new here, let me know if I started the discussion at the wrong place. thanks!

360
ekorhonen
Netskope Employee
N
nkingNew Member III
posted in Security Posture Management
Setting up IPSec Tunnels for AWS egress traffic

The guides linked to below illustrate how to configure Netskope IPSec tunnels with your AWS environment for egress traffic filtering and monitoring. This integration provides unmatched visibility and real-time data and threat protection for the traffic leaving your AWS environment. Steering your AWS egress traffic to the Netskope cloud allows you to apply full capabilities of the Netskope platform, including cloud network firewall, web content filtering, data leakage and threat protection, third-party risk protection, etc. You can integrate your AWS environment with Netskope with the following methods: You can establish IPSec VPN tunnels with AWS Site-to-Site VPN between your AWS virtual private gateway, which is associated with a single Amazon Virtual Private Cloud (VPC) and Netskope Points of Presence (POPs). You must repeat this implementation for each Amazon VPC from which you’d like to steer traffic to the Netskope cloud. With this option, you can stream up to 250 Mbps of bandwidt

1380
N
N
nkingNew Member III
posted in Security Posture Management
Netskope AWS Control Tower Integration

The Netskope CSPM and Storage Scan services are multi-account security solutions that provides visibility into resources, configurations, data protection, and malware on the AWS cloud. Implementing this solution, you can identify and remediate risky misconfigurations, identify sensitive data (DLP), and detect malware and ransomware. The purpose of the AWS Implementation Guide is to enable every AWS Marketplace customer to seamlessly activate, deploy and configure the Netskope CSPM and Storage Scan in AWS Control Tower environment while taking full advantage of the resources pre-configured by AWS Control Tower as part of the initialization. Solution overview and features Netskope Cloud Security Posture Management (CSPM) and Storage Scan allows organizations to confidently adopt and secure multi-cloud services. The Netskope solution gives organizations the ability to continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensitive data, and monito

450
N
Y
yduchovnyNew Member
posted in Security Posture Management
CSPM security violation findings' Auto-Remediation for AWS

In this article we’ll demonstrate how you can implement automatic remediation for security posture violation findings discovered by Netskope Cloud Security Posture Management (CSPM). Netskope CSPM continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensitive data and monitor for regulatory compliance. Netskope simplifies the discovery of security misconfigurations across your clouds. Netskope Auto-Remediation framework for AWS enables you to automatically mitigate the risk associated with these misconfigurations in your AWS cloud environment. Netskope CSPM security assessment results for such security benchmark standards as NIST, CIS, PCI DSS, as well as for your custom rules are available via the View Security Assessment Violations Netskope API. Netskope auto-Remediation solution for AWS deploys the set of AWS Lambda functions that query the above Netskope API on the scheduled intervals and mitigates supported violations automatically. You c

1370
Y
jhwong
jhwongNew Member
posted in Security Posture Management
AWS Best Practices: Real-World Data

We've continued our blog series on AWS Best Practices, and just published: https://www.netskope.com/blog/a-real-world-look-at-aws-best-practices-logging . Although CloudTrail is a well-trodden subject for AWS Security, there were still a few interesting findings among a slice of our customer base: Enable VPC flow logs: 81% of VPCs do not have VPC flow logging enabled, which will hinder incident response and investigations. Encrypt CloudTrail logs at rest: 91% of CloudTrail logs are not encrypted at rest. Encryption at rest supports data compliance controls and is easy to do. Ensure S3 bucket access logging is enabled for CloudTrail buckets: 41% of CloudTrail buckets do not have server access logging enabled. Logging should be enabled for all CloudTrail S3 buckets. Ensure CloudTrail logs are integrated with CloudWatch or a SIEM: 54% of CloudTrails are not integrated with CloudWatch. These should be reviewed to ensure they are integrated with a production log search service or SIEM. If y

340
jhwong
R
RajarshiNew Member
posted in Security Posture Management
Ensure Azure Active Directory donot have any stale users ( users who did not login in last 30 days)

Azure has the following logic to check Active Directory for stale users: refreshTokensValidFromDateTime > STS TokenLifetimePolicy MaxInactiveTime (default of 90 days for Azure, may vary for customer) + acceptable number of days past the refresh token, for which an account can be inactive( in this case 30). Security Posture Management can help with custom rule for above use case as in : User should not have LastTokenChange isEarlierThan ( -120, "days")

360
R
R
RajarshiNew Member
posted in Security Posture Management
Ensure specific Azure Compute Instances do not have a public IP

Public IP addresses allow Internet resources to communicate inbound to Azure resources. Security posture Management can help with custom rules to ensure that specifically tagged VM instances donot have a Network Interface with public IPs assigned. The custom rule would look like following: VirtualMachine where Tags with [ Name eq "confidential" ] should not have NetworkInterfaces with [ IPConfigurations with [ PublicIP len () gt 0 ] ]

150
R
ekorhonen
Netskope Employee
ekorhonenNetskope Employee
posted in Security Posture Management
Using custom rules for resource tag and label enforcement

Every company uses tagging and resource labeling in their own way. Among other uses, mature labeling practices are a great way to identify resources to their cost centers, keep track of their purpose and contents for compliance requirements and for naming ownership and maintenance responsibilities. Netskope Security Posture Management can help enforce good labeling practices with a few simple custom rules suited to your needs. How to ensure that every resource of a given type is labeled properly Most common use case for label policy enforcement is to ensure that resources are labeled at all. For example, if we want to ensure that every EC2 instance in our AWS Cloud carries a label named "org-unit", we can write the following rule for AWS monitoring: EC2Instance should have Tags with [ Name eq "orgunit" ] Once added to a compliance profile and being monitored by a Security Posture Policy, this rule should show in the Security Posture view with findings like this: Likewise, We can use a

490
ekorhonen
Netskope Employee
R
RajarshiNew Member
posted in Security Posture Management
Ensure Public buckets donot have a PII tag. (AWS / Azure / GCP)

Organizations have their own convention of tagging buckets containing PII objects . We can leverage Security Posture Management to create custom rules to check if these specifically tagged buckets are open to the public: AWS : S3Bucket where Access eq "Public" should not have Tags with [ Name eq "PII" ] Azure: StorageAccount where ( Tags with [ Name eq "PII" ] ) should have every BlobContainers with [ Access eq "None" ] or not AllowBlobPublic GCP: Bucket should not have Policies with [ Members . AllUsers eq True or Members . AllAuthenticatedUsers eq True ] and Tags with [ Name eq "PII" ]

270
R
R
RajarshiNew Member
posted in Security Posture Management
Ensure Object ACLs cant be turned public inside private S3 buckets.

Inside an AWS Private S3 bucket, a specific object can be made public by using any of the following steps: Update the object's access control list (ACL) using the Amazon S3 console Update the object's ACL using the AWS Command Line Interface (AWS CLI) In order to make sure that a specific object is not turned public inside an otherwise private S3 bucket, we can make use of the AWS Block Public Access Settings , specifically the IgnorePublicAcls ( Block public access to buckets and objects granted through any access control lists (ACLs) ) boolean. Netskope SPM allows to write custom rule for checking the above configuration for each S3 bucket: S3Bucket should have Access eq "Private"

320
R
C
Community_TeamExplorer III
posted in Security Posture Management
Custom Rules using Domain Specific Language

Build custom rules under Policies > Security Assessment using Domain Specific Language (DSL) for Security Assessment of AWS, Azure, and Google Cloud resources. The following syntax diagram represents the general rule to write a DSL statement. Rule Format: <entity> [where <condition>] should [not] have <condition> For example: Entity An entity defines what the rule is checking against. It can be used alone or with a condition to further specify the entity. Here are some examples of using an entity. Condition A condition is a standard that the rule uses to check against an entity to narrow down the result. The following table provides examples of using a condition. The formats in this table are applicable to all properties. Function Use functions in rules to find specific information about entities. Functions use the following syntax, <entity> <function>(<argument>) For example: S3Bucket should have Tags len ( ) gt 0 Protocol in ("-1", "tcp") The following table provides a complete list

460
C
N
nkingNew Member III
posted in Security Posture Management
Ensure no security groups / firewall rules allow ingress from 0.0.0.0/0 to port [ ]

Security groups (AWS, Azure) and firewall rules provide stateful filtering of ingress/egress network traffic to Cloud Provider resources. The AWS rule below provides protection against security group allowing unrestricted ingress access to port 22 (SSH). This rule can easily be modified to provide similar protection for other ports such as RDP (3389), Oracle DB (1521), PostgreSQL (5432), MySQL DB (3306), MongoDB (27017), Microsoft-DS (445), HTTP (80), TCP (445), DNS (53), FTP (21), Telnet (23), SMTP (25), and more. See below for example rules in AWS, Azure, and GCP. AWS: EC2Instance should not have SecurityGroups with [ InboundRules with [ IPRanges with [ IP isPublic () ] and Protocol in ("-1","tcp") and ( (FromPort lte 22 and ToPort gte 22) ) ] ] GCP: FirewallRule where Disabled eq False should not have Direction eq "INGRESS" and Allowed with [ Protocol in ("all", "tcp") and Ports with [ ( FromPort lte 23 and ToPort gte 23 ) ] ] and SourceRanges with [ Value eq 0.0.0.0/0 ] Azure: Virt

900
N

Most helpful members this week

Badge winners

Show all badges

Popular tags

Terms & ConditionsCookie settings

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings