Inside Netskope

Netskope, a global cybersecurity leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data.

  • 38 Topics
  • 28 Replies

38 Topics

M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope

Security posture for Workday application at NetskopeBlog

Workday is a cloud-based software platform that provides a suite of enterprise applications for human resources (HR), finance, and planning. It is designed to help organizations manage their workforce, streamline business processes, and gain insights into their operations. Workday is a critical application which hosts sensitive information. Netskope is currently monitoring and securing access to Workday internally with a breadth of products that are developed and maintained by the development and QA teams. These capabilities include areas such as inline protection, API-enabled protection, SaaS security posture management (SSPM), and Cloud Firewall, to name a few. In this guide, we will provide a perspective of how Netskope’s products and capabilities are used internally for securing enterprise data.  Real-time ProtectionWe are restricting access to the Workday app for Netskope employees through client enforcement in IDP, whereby access to Workday would be granted only if users are conn

2440
M
Netskope Employee
2 months ago
ssumner
Netskope Employee
ssumnerNetskope Employee
posted in Inside Netskope

P-DEM use cases - monitor SaaS & hybrid work performance

P-DEM Professional is easy to activate in your Netskope tenant. Here are the top 4 use cases it can help you drive productivity for hybrid working employees, IT operations and help desk teams: Optimizing SaaS PerformanceChallenges in managing the performance of SaaS and web applications stem from their dynamic, decentralized nature. With various factors affecting user experience, from devices to internet connectivity, IT teams struggle to detect, diagnose and fix issues, impacting user productivity and IT efficiency as problems take hours to resolve. Learn how P-DEM brings proactive visibility to accelerate troubleshooting and enhance user satisfaction.Video OverviewHybrid Work ProductivityHybrid work models bring unique performance hurdles, demanding a seamless user experience across varied environments. Pinpointing and managing these issues, which span from home Wi-Fi to SaaS performance, is critical to productivity. Diagnosing the exact failure point in the device-to-app journey is

0
ssumner
Netskope Employee
2 days ago
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope

Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Gen AIBlog

In today’s fast paced life we are being inundated with advances in technology which sometimes outpace our ability to process and keep up with. In this article we are going to:Discover the use of Generative AI within our organization; Influence Real-time Policy creation to promote user adherence and behavior to policies; Guide Generative AI Vendor/Application requirements; Build reports and dashboards that help identify and prioritize security risks; and,. Help us build a better product through self-reporting within the platform.*augmented with the assistance of Generative AIThe use of Generative AI has become extremely pervasive and grown at a rate that has left a lot of us wondering where it came from and how we got along without it in the past. A great example of this are the bullet points listed above.I got to thinking about using Gen AI to augment the bullet points and a title slide for a presentation on uncovering the insights of Gen AI. I realized the irony of the situation. It d

2211
M
8 days ago
R
Netskope Employee
rbutlerNetskope Employee
published in Inside Netskope

Register Now! Inside Netskope: Client Enforcement for Secure Access to SaaS ApplicationsNews

Netskope Client Enforcement for Secure Access to SaaS Applications Wednesday, April 248 am PDT |  4pm BST |  5pm CEST Enforcing the Netskope Client is vital in ensuring users have secure access to the correct SaaS applications to protect corporate resources. REGISTER NOW to hear from our very own Security Engineers. They will be discussing how Netskope integrates with Okta to “enforce” the compliance of having the Netskope client enabled and connected to a tenant for accessing SaaS applications using Identity Providers (IdP).  Learn how to: Define a SAML 2.0 Application in Okta Enable Netskope Client Enforcement Define a Sign-On Policy per SaaS Application Edit Download Templates

260
R
Netskope Employee
9 days ago
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope

Inside Netskope: Session 02 Recap - Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Generative AI

In case you missed the second webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on how to Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Generative AI can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Are there any templates for allowing access to controlled AI tools like corporate Copilot and Copilot Designer while blocking outside AI tools?A: We recommend taking the client and start to interact with the copilot to see if you're able to pick up some of those activities with the predefined connectors and potentially even developing a custom connector. We are currently working on the consumer version of the Copilot for O365 and then eventually the professional version.   Q: How can AI in Netskope help business to grow?A: We can analyze the traffic we are seeing w

430
S
Netskope Employee
22 days ago
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Inside Netskope

Dropbox

It is necessary to install the Dropbox desktop application, download the executable from the official website, at the time of installation it does not finish the installation.In the Steering Configuration EXCEPTIONS option, the application is bypassed but it still does not allow the installation, how can I remedy it?

2
Rohit_Bhaskar
Netskope Employee
27 days ago
ukrishna
ukrishnaNew Member
published in Inside Netskope

Sanitized HAR File Detection using NetskopeBlog

What are HAR files and why detect them?HAR stands for ‘HTTP Archive’ format and it is a file used to store the interactions between a particular Website and the Browser. These files are used to troubleshoot issues that a particular user might be facing with a website and the issues could be related to performance, page elements, cookies, HTTP headers, page rendering, etc. Large organization’s support and technical teams use the HAR files in order to understand what kind of issues the user should have faced when they inspect the HAR file related to the transaction. HAR files can be used for debugging as they present a clear picture of the transaction between the Browser and the Web server. This also presents a gaping hole as HAR files also record sensitive transactional information like cookies, authentication tokens, etc. It has become crucial to make sure the HAR files are not mishandled. There are sanitization tools available to make sure that all sensitive information for a particul

1430
ukrishna
1 month ago
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope

Register Now! Inside Netskope: Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Generative AINews

In today's dynamic cloud environment, gaining actionable security insights is critical. REGISTER NOW!Join this webinar to explore how Netskope uses Advanced Analytics and Generative AI to:Discover the use of Generative AI within our organization Influence Real-time Policy creation to promote user adherence and behavior to policies Guide Generative AI Vendor/Application requirements Build reports and dashboards that help identify and prioritize security risks Help us build a better product through self-reporting within the platform

530
S
Netskope Employee
1 month ago
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope

Recap: Inside Netskope Session 01 - Coaching Users into Compliance

In case you missed the first webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on how to coach users into compliance can be found below. Feel free to comment and continue the discussion! Watch on-demand Q: What is the Block restriction action for those that have not been able to complete the training in time?A: We take a gradual approach to the notification system, so there are different levels of restriction. Once the completion deadline has passed, users receive a similar message but they do not have the option to provide justification to do the training later. Their only option is to complete the training now or ignore the message which will follow them on all applications other than the required ones (Okta, LearnUpon, and Slack). Q: What has been the user experience/feedback from the users as you've deployed this notification sy

1260
M
Netskope Employee
2 months ago
aplaza
Netskope Employee
aplazaNetskope Employee
posted in Inside Netskope

Inside Netskope Webinar Series: Coaching Users Into Compliance

Join us on Wednesday, January 31st at 10am CST for the first webinar of our new Inside Netskope series, where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture.   This session will cover how to track users with missing security training and coach them into compliance using Netskope’s Real Time policies, Okta, an LMS with an API, and a SOAR solution.    Learn how to:  Customize various actions applied to your policies Adapt deadline infringement consequences to align with your unique compliance requirements Personalize the categories and applications that users can access without triggering alerts, all in accordance with your environment and specifications   Register now!

0
aplaza
Netskope Employee
2 months ago
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope

Netskope Client Enforcement: A Security Practitioner's Perspective

Background Q. How do you enforce Netskope Client adherence without impacting SAML flows after authentication?A. Netskope Client Enforcement. Netskope Client Enforcement is used to “enforce” the compliance of having a Netskope client enabled and connected to a tenant for accessing SaaS applications using Identity Providers (IdP) such as Okta. This includes IdP or Service Provider initiated connections, i.e. logging into Okta to access a SaaS application or logging into the SaaS application directly. Netskope Client Enforcement should be differentiated from other methods of steering real-time traffic to the Netskope tenant for the processing of policies; policies such as Next-Generation Software Web Gateway (NG-SWG), Data Loss Prevention (DLP), Netskope Private Access (NPA), User Enhanced Behavior Analytics (UEBA), Cloud FireWall (CFW), and so on, all of which are designed to protect an organization. Netskope Client Enforcement also enables end users to protect corporate resources th

1
S
4 months ago
P
Netskope Employee
pburtonNetskope Employee
posted in Inside Netskope

Empowering Security Awareness: Leveraging Netskope Advanced Analytics Real-Time Coaching

In today’s rapidly evolving threat landscape, user awareness plays a pivotal role in safeguarding organizations against cyber risks. Employees and end-users are often the first line of defense, making it essential to educate and empower them with the knowledge and skills necessary to identify and mitigate potential security threats.    Netskope understands the significance of user awareness in maintaining a robust cybersecurity posture. By combining cutting edge technologies and user-centric approaches, Netskope equips organizations with the tools to effectively monitor, analyze, and guide user behaviors in real time. This blog will delve into the importance of security user awareness, explore Netskope’s User and Entity Behavior Analytics (UEBA) capabilities, and highlight the value of its real-time coaching feature in promoting secure behaviors and enhancing overall security resilience. By embracing security user awareness and leveraging Netskope’s innovative solutions, orga

0
P
Netskope Employee
5 months ago
ukrishna
ukrishnaNew Member
posted in Inside Netskope

Sharing Indicators of Compromise (IoC) with Netskope’s Cloud Threat Exchange (CTE)

  “You can’t defend against threats that you are not aware of”   What is IoC and Why share it? IoC stands for Indicators of Compromise and as the name suggests, it points to technical identifiers or behavioral patterns which help to identify if a particular system or network or artifact has been compromised. Anything which helps to identify a particular malicious activity could be an IoC, ranging from an executable, hash, IP Address, URL, etc. As the quote above implies, organizations cannot safeguard themselves from threats and attacks they are unaware of. Utilizing heuristics can narrow the divide between familiar and unfamiliar threats, but pinpointing specific criteria significantly accelerates the process and demands fewer computational resources. That’s where a robust and strong IoC sharing program comes into lay. Through the efficient and effective exchange of IoCs among security telemetry tools, each tool acquires IoC data from others, contributing to enhanced detecti

0
ukrishna
5 months ago
M
Netskope Employee
madhurasridharNetskope Employee
posted in Inside Netskope

Security posture for Github application at Netskope

GitHub is a web-based platform that provides hosting for software development projects utilizing the Git version control system. It serves as a collaborative platform for developers to work together on code, track changes, manage projects, and host their code repositories. GitHub allows developers to create and maintain repositories, which are containers for code and related resources. These repositories can be either public, allowing anyone to view and contribute to the code, or private, restricting access to a selected group of individuals or organizations.   There are some security challenges that we as the Customer Zero team are trying to address for Github. The premise behind the security posture is considering sensitive data movement, malicious repositories, code injection and leakage, ensuring appropriate access controls and permissions. We are currently monitoring and securing access to Github internally with a breadth of products that are developed and maintained by the d

4
K
Netskope Partner
6 months ago
R
Netskope Employee
rbutlerNetskope Employee
posted in Inside Netskope

Remote Browser Isolation on Demand for the SOC

As a company, we have deployed and continue to utilize Remote Browser Isolation to browse unknown or questionable sites based on web categories in a ‘safely allow’ posture instead of an outright block. When one of our analysts requested the purchase of a remote browser service to conduct investigations into sites that didn't fall into the web categories that we already send to RBI, we decided to develop a process to isolate any desired sites using our existing product, incurring no additional cost for the company.   The security team is often asked to investigate suspicious web sites, whether they are phishing, malvertising, or others. Netskope uses our Remote Browser Isolation solution for uncategorized, no content, parked domains, proxies and anonymizers, and known threat websites. For sites outside of those categories that require a safe way to investigate a web site we have created a solution for this.   How to set it up  Step 1 The approach we took was to create a c

3
R
Netskope Employee
7 months ago
L
Netskope Employee
Lokesh_BalajiNetskope Employee
posted in Inside Netskope

Automating URL List Management for Remote Browser Isolation (RBI)

Welcome to a project aimed at enhancing the ease of an analyst's experience. In this venture, I've taken automation to the forefront by simplifying how we add URLs to RBI_url list. This list is specifically meant for Remote Browser Isolation (RBI), ensuring that some questionable/suspicious sites can be accessed securely for investigation purposes.   At the heart of this effort is a Slack bot I've designed. This bot comes with the right permissions and a simple command. With this command, users can mention the URLs to be included in the RBI URL list. This whole process starts when the bot communicates with the Tines platform, where the real magic happens.   Using the Tines platform, we have simplified this process through automation by which these URLs are added to the RBI URL list seamlessly and securely. This automation eliminates the need to manually navigate to the tenant to upload URLs, streamlining and expediting the task.   Requirements: Slack app (to get urls fr

0
L
Netskope Employee
7 months ago
ukrishna
ukrishnaNew Member
posted in Inside Netskope

Onboarding Multiple Subscriptions for Azure CSPM

What is CSPM and Why CSPM?   CSPM stands for Cloud Security Posture Management, it is a process to monitor cloud resources that belong to an organization for any potential security misconfigurations or risks which can lead to financial or data loss. The CSPM process scans the public cloud infrastructure continuously to check for violations against a set of predefined rules. The rules are tuned/muted by each organization as per their compliance and security needs. Netskope CSPM also offers a set of comprehensive rules which can be used by customers to improve their compliance and security posture of public cloud. Netskope offers CSPM solutions for Microsoft Azure, Google Cloud Platform and Amazon Web Services at the time of writing this post. Storage scans can also help with DLP and Malware violations. This post explains in an efficient and expeditious method on how to onboard multiple Azure subscriptions into Netskope CSPM.    Making use of Azure Management Groups  

0
ukrishna
7 months ago
jramirez
Netskope Employee
jramirezNetskope Employee
posted in Inside Netskope

Netskope & Okta Can Help With Tracking Compliance Training

Security awareness compliance training refers to a specific training initiative created to educate employees, contractors, and other involved parties within a company regarding the significance of adhering to security measures, guidelines, and mandates. The fundamental aim of this training is to foster a mindset of security awareness and adherence across the entire organization. By doing so, it guarantees that all individuals comprehend their obligations in upholding the confidentiality of delicate data and countering security risks. However, not all users fulfill their training requirements punctually. At Netskope, over the past few years, we have persistently dispatched regular emails to users, urging them to finalize their training. Presently, we are exploring innovative and effective strategies to ensure timely completion of training by users.   Using Netskope, Okta, an LMS with an API, and a SOAR solution, we have created a solution to track users with missing security traini

0
jramirez
Netskope Employee
8 months ago
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope

Bypassing Zoom Traffic for Stability

Multiple users have reported issues with the stability of Zoom, as well as the performance of the application itself. Common complaints or issues relating to audio dropping, audio quality, and screen redraws or slowness painting the screen. Due to these issues, as seen traversing a proxy, it is recommended that Zoom traffic be bypassed and go directly to the destination, at least for real-time traffic.  We do recommend using our Next Generation API Data Protection for Zoom. With its current release, audit events, standard user behavior analytics alerts in Skope IT, and DLP alerts may be seen in the tenant. Future improvements to API data protection includes, threat protection, inventory and dashboard remediation actions, and retroscan. Instructions The following instruction set allows you to bypass Zoom traffic using the Netskope Client’s  real-time traffic steering method. Go to https://support.zoom.us/hc/en-us/articles/201362683-Zoom-network-firewall-or-proxy-server-setti

4
M
8 months ago
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope

Real-time Policy Recommendations

Steer It And You Can See It   It goes without saying that if you cannot see data exfiltration then you cannot stop it from happening.  CASB applications need to be steered in order to be seen, including SSL certificate pinned applications, destination locations, applications (CFW and CASB custom applications), and a few other bypass exceptions.   For reference SSL certificate pinning is when a desktop or mobile application validates if the proposed server certificates match the hardcoded ones in the application. It's a security technique used to prevent man-in-the-middle attacks (MITM).   We recognize some vendor ssl certificate pinned applications by default which need to be bypassed, Amazon Drive for example.  So, in order for end users to use the application without errors resulting, we need to bypass the application traffic and allow it to go directly to the destination.  In order for that to occur, we define the application and the hosts or domains to

4
S
Netskope Employee
8 months ago
M
Netskope Employee
madhurasridharNetskope Employee
posted in Inside Netskope

Endpoint DLP - Netskope Customer Zero Best Practices

Netskope Endpoint Data Loss Prevention (Endpoint DLP) provides data protection at the endpoint by utilizing Netskope cloud DLP capabilities. You can use Endpoint DLP to monitor and govern USB storage devices connected to your endpoint. Endpoint DLP is an optional add-on capability to the Netskope Client and does not require deploying and managing a separate client or agent on the endpoint.   With Endpoint DLP, you can create Device Control and Content Control policies. Device Control policies enable granular control over which devices are allowed and which users can access them. Whereas, Content Control policies enable the full use of  Netskope DLP profiles and rules to inspect and control data movement between an endpoint and a USB mass storage device. To avoid user interaction during deployment, please ensure that full disk access is enabled for all Mac OS systems for which the endpoint DLP service would be deployed.    Within the Customer Zero team, we have

0
M
Netskope Employee
8 months ago
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope

Google Workspace RProxy as a Service

Welcome to the world of Reverse Proxy! Today, I will be your guide on creating a Reverse Proxy as a Service (RPaaS) in Google Workspace. We’ll then apply contextual awareness to “guide” employees to steer traffic to Netskope using RPaaS if they are not originating from a Netskope IP address. This is similar to what we do with Microsoft Azure AD RPaaS and conditional access policies; the contextual awareness is Google’s implementation of conditional access.   There are requirements needed for licensing as well as caveats which warrant mentioning. You will need to be licensed for Protect your business with Context-Aware Access - Google Workspace Admin Help . There are a limited number of applications at this point which context awareness works with or for, see pic below.   For SAML apps, policy evaluation occurs on sign-in to the app. Third party SAML apps that use Google as the identity provider. A third party identity provider (IdP) can also be used (third party IdP federat

0
S
Netskope Employee
9 months ago
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope

Netskope Tools Directory Importer to SCIM Migration Process

Users are provisioned in three different methods within the tenant-manually adding them, Netskope Tools Directory Importer, or via System for Cross-domain Identity Management (SCIM).  SCIM is an open standard designed to manage user identity information.  It is possible to use all three methods to provision users to the tenant.  However, it is recommended that only one method be used to avoid confusion.   As more and more resources migrate to the cloud, it makes sense to use an Identity Provider (IDP) which resides in the cloud as well.  SCIM provides a defined schema for representing users and groups, and a RESTful API to run CRUD operations on those user and group resources.   This guide provides administrators the ability to migrate from the Netskope Tools Director Importer to SCIM, regardless of the service provider such as Okta or Ping.   Netskope Tools Directory Importer Netskope Tools Directory Importer is installed, running, and on the latest

0
S
Netskope Employee
9 months ago
qyost
qyostExplorer III
asked in Inside Netskope

IPS Signatures - Detailed Descriptions?

I hope this will just be a pointer to the resource...Is there a repository with more details about what the signatures are.  Or a way to see what caused the match?   Some of the descriptions are quite vague, and it's hard to determine if an exception should be created.eg: Sig 20019  "MALWARE-CNC User-Agent known malicious user agent - test"

1
S
Netskope Employee
9 months ago
ukrishna
ukrishnaNew Member
posted in Inside Netskope

Using API for SSPM V2 Alerts

How do you feed the Netskope SSPM Alerts to SaaS Application Administrators?   The Netskope Cloud provides a wide range of innovative and competitive products, among which one of the most important offerings should be Netskope SSPM. SSPM stands for SaaS Security Posture Management and is used to continuously monitor cloud-delivered Software-as-a-Service applications. This service monitors the SaaS applications' configuration to ensure that they are configured securely and in compliance with regulations. Security administrators can set policies and receive alerts for SaaS application instances that do not adhere to the required policy.   Typically, SaaS application administrators are not part of the company's core security team. Instead, the security team receives the SSPM alerts for all the SaaS applications. These alerts must be forwarded to the respective SaaS application owners so that they can work on remediation. In some cases, the security team might be hesitant to gran

0
ukrishna
9 months ago

Badge winners

  • Solutions - 10
    mkoyfmanhas earned the badge Solutions - 10
  • Solutions - 10
    sshifletthas earned the badge Solutions - 10
  • Solutions - 10
    VarunKhas earned the badge Solutions - 10
  • Solutions - 2
    mkoyfmanhas earned the badge Solutions - 2
  • Solutions - 2
    rosshas earned the badge Solutions - 2
Show all badges
Terms & ConditionsCookie settings