Best Practice Policies - Inline - Netskope

Best Practice Policies - InlineFocus: “Real-time Protection” Policy (Not “API Data Protection” Policy)2021 Netskope. All rights reserved.

Agenda Introductions Real-time Protection vs. API Data Protection Policies Preparing Your Organization for Change Structuring Real-time Protection Policies Real-time Protection - Threat Policies Real-time Protection - Utility Policies Real-time Protection - Active CASB Policies Real-time Protection - Web Policies Q&A2021 Netskope. All rights reserved.2

Real-time Protection vs. API Data Protection Policies2021 Netskope. All rights reserved.

Real-time (Inline) vs API Protection (Out of Band) Policies2021 Netskope. All rights reserved.

Real-time Protection Policy Processing is Order specific! Understanding the order of your Real-time Protection policies is important Real-time Protection policies are processed sequentially (Top to Bottom) When traffic matches rule conditions, the action applies (Allow/Coach/Block) withoutfurther processing through the rule base Select the rule position when saving the policy: Top / Bottom / Before / After Drag and drop, or choose the policies to re-order Click Apply Changes to save the order. Policy changes do not take effect until you apply changes.2021 Netskope. All rights reserved.5

Best Practice Policies - General guidelines Remember that rules are processed from the top down in theReal-time Protection policies list Place rules to be applied to individuals or small groups nearthe top of the list. Block with exceptions at the top Use the Filter option to view specific policies– Note : Default allow if no policy is matched2021 Netskope. All rights reserved.

Best Practice Policies - Web Configuration Dynamic Classification– Dynamic classification looks at the textual contents of a page and dynamically determinesthe category for the uncategorized URLs. This feature is turned off by default.–After a page has been dynamically categorized, the classification applies to all of yourtenant instances. The page classification to a category expires every 12 hours so that if anychanges occur to the page, the content is re-evaluated so the chosen category matches thecurrent page content.–Navigate to: “Settings Security Cloud Platform Configuration” Dynamic classification looks at the textual contents of a page and dynamicallydetermines the category for the uncategorized URLs2021 Netskope. All rights reserved.

Real-time Protection Policies - Workflow1.Create a new Real-time Protection Policy2.Select “Add Criteria” to add additional source criteria (such as Access Method)3.Define the Identity (User, Group, OU)4.Specify the Application, Category, App instance (Ex: Box, Cloud Storage, etc.)5.Select “Edit” to specify the Activities & Constraints that need protection/control (Ex: create, delete,share, etc.)6.Select “Add Criteria” to add additional destination criteria (such as App Tagging)7.Choose an action (Alert, Allow, Block, By-Pass, etc.)8.Give the policy a name9.(Optional) Provide a description for this policy10.(Optional) Email Notifications (None, Every Event, 30 mins, 60 mins, 6 hours, 24 hours).2021 Netskope. All rights reserved.8

Preparing Your Organization for Change2021 Netskope. All rights reserved.

Introducing new Inline Policy to an OrganizationEnsuring a Smooth PolicyRoll-Out to your Organization:2021 Netskope. All rights reserved.-Create a DocumentedAcceptable Use Policy(AUP)-Ensure anEscalation/Exception processis in place and followedthroughout the roll outprocess10

TSMMonitoring Phase - Steer traffic to your tenantMonitor: Steer traffic to tenantAlert: alert netskope admins on particularly risky behavior (covered later)Coaching: create policy that will inform users of risky behaviorBlocking: enable policy blocking to enforce company policy2021 Netskope. All rights reserved.11

TSMMonitoring Phase Part 2 - Involve Key Departments As an organization moves from monitoring user traffic to actually alerting andcoaching users on violations, it is important to involve key stakeholders Create SOC / Help Desk processes and inform executives of upcomingchanges–It is important that key departments understand the changes that users (from Executives toIndividual Contributors) will be experiencing–An example of a process for a SOC would be to follow a naming convention like appending[pre-prod] and [prod] to policy names to differentiate policies–Follow a naming convention like [pre-prod] and [prod] policy names to differentiate policiesand filter active channels2021 Netskope. All rights reserved.12

TSMUser Alerting and Coaching Phases - Involve the EntireOrganization In the previous phase, we informed key operational departments of the upcoming changes userswill see while performing their day to day activities Before we actually transition the policies and change the user experience, we need tocommunicate the upcoming change to the entire organization–Create User Awareness Campaign - Very Important to dispel FUD –Note from Executives on new program to ease user lash back for new control.Some customers also create an internal wiki that they link in the user alert to reduce userquestions about new control. Important - Only provide as much detail as needed an no more. Never include actualpolicy logic as this can be used by malicious actors to work around controls.2021 Netskope. All rights reserved.13

TSMBlocking Phase - Real Time Prevention After policies have been in User Alerting and Coaching mode, you will seedrastic changes to user behavior (for the good!). Now it’s time to modifycertain high risk (prevent malware and data loss) and unacceptable (browsinginappropriate websites) activities policies to blocking mode–Ex. Upload of Sensitive document to Cloud Storage App IP - ORG Secret, TS, Design Documents Customer Databases Form data – DD214 member B, Medical Documentation Controlled Documents Offensive and productivity killing web browsing2021 Netskope. All rights reserved.14

Structuring Real-time Protection Policies2021 Netskope. All rights reserved.

Best Practice - Structuring Real-time Protection PoliciesThreat protection policies should block high risk behaviors, such as downloading malware or uploadingsensitive data to an unsanctioned application. More broad access control policies should be towardsthe bottom of the policy.More specific to less specific1.2.3.4.5.6.Threat Protection (High risk)Utility PoliciesRemote Browser Isolation (RBI)CASB (Activity Oriented)Web(Category Based)Netskope Private Access (NPA) Allow list business critical applicationsBlock list predefined high riskcategories and IOCs.Leverage the Netskope REST API tomaintain URL lists. ThreatUtilityRBICASBWeb2021 Netskope. All rights reserved.16

BlockScanAllowThreatUtilityInstance IDAppCategory SanctionedCategory PersonalCASB ToolsCategory UnsanctionedLow / Poor CCLCategory Level PolicyWeb2021 Netskope. All rights reserved.

Real-time Protection - Threat Policies2021 Netskope. All rights reserved.

TSMBest Practice: Threat Policies - Overview2021 Netskope. All rights reserved.19

TSMBest Practice Policies - High Risk CategoriesCreate a custom category to include the predefined high risk categories, Global Deny URL, and securityrisk exception URL ListsIn almost all situations these risk categories should be blocked2021 Netskope. All rights reserved.20

Threat Protection Policy:Block Security RisksSource - AnyDestination - Custom Category that contains allsecurity risk subcategories, parent security riskcategory, global deny url list, and security riskexceptionsActivity - AnyProfile/Action: Block ; Template of your choiceName - Customer Discretion but Naming conventioncan be useful to differentiate between productionand test policies during roll out and tuning. Example- [Test] Threat Protection Policy or- [Threat] Block Security Risk Categories212021 Netskope. All rights reserved.

TSMBest Practice Policies - Threat Protection: File ProfileCustomize your Threat ProtectionProfile, by creating a “File Profile”This will enable you to create additionalcontrols for known good and bad files.Common use cases are: Allow list of business criticalapplications and/or false positives byfile hash, type, object id, file size,and/or encryption Block list of known file types, hashes,and IOCs2021 Netskope. All rights reserved.22

TSMBest Practice Policies - Threat Protection: TP Profile Now you can include your new File FilterProfiles within a new Threat Protection(TP) Profile Creating multiple File Filters allows you tocreate exceptions for different businessunits.2021 Netskope. All rights reserved.23

TSMBest Practice Policies - Threat Protection : Block Malware Source - Any Destination - All Categories (CC) Activity Download & UploadProfile: Custom Malware profile(with File Profiles) or DefaultMalware Scan Set all severities to BlockEmail notification after each event2021 Netskope. All rights reserved.24

TSMBest Practice Policies - Threat Protection: Risk Exception Source : Depending on Business use caseof exceptionDestination: Custom Category (URL list ofexception to the security risk categories)Action : AllowName: [Threat] Allow Security RiskCategory Exception2021 Netskope. All rights reserved.25

Real-time Protection - Utility Policies2021 Netskope. All rights reserved.

TSMBest Practice: Utility Policies - Overview2021 Netskope. All rights reserved.27

TSMBest Practice Policies - Policy Replication SyncWhen a Netskope administrator applies aReal-time Protection policy change in theNetskope UI, those changes arereplicated across the NewEdge dataplane. Replication is generally completewithin five minutes, but there are timeswhere replication can take a prolongedperiod of time.To confirm which policy is active, a usernotification can be configured to informthe administrator which version of thepolicy is currently being applied throughthe POP within the NewEdge data planebeing used.For more information and configurationplease -Policy-Change-Runbook2021 Netskope. All rights reserved.28

TSMBest Practice Policies - DNS over HTTPSDNS over HTTPS is not a supportedprotocol for Netskopesteering(CASB/NGSWG/NPA) andcan be compromised by maliciousactors. Therefore, we need to ensurethat we configure a policy to steerand block this traffic.Source - AnyDestination : Cloud App- DNS Over HTTPS- Do not press “Edit”- Leave as “Any”Action - Block : No notification*This will not prompt the user*2021 Netskope. All rights reserved.29

Real-time Protection - Active CASB Policies2021 Netskope. All rights reserved.

TSMBest Practice: Active CASB Policies - Overview2021 Netskope. All rights reserved.31

Sanctioned Instance - For supported AppsNote: you have to tag the instance before you can set aninstance id policy. instance id ! 'NULL'Source - AnyDestination - Sanctioned App InstanceActivities - All Supported ActionsProfile/Action: AllowTraffic Action - Not SetName - Customer Discretion but Naming convention can beuseful to differentiate between production and test policiesduring roll out and tuning. Example - [Test] Threat ProtectionPolicy322021 Netskope. All rights reserved.

Instance ID Support-P1 Apps Supported - Please work with your TSM to understand the scope-Regularly testing instance efficacyActivities (login, upload, download, post, share, send)-Other activities also should work for instance ID, but we are not regularly testing it.--Activities Not Supported(Browse, Formpost, etc) - These activities for Web tenants withApp and Category Level blocks with no Activities specified in the policy will come into playunless you explicitly define Allow policies for these activities.We add Instance ID to events for 100 apps- These are not regularly tested and may have limited activity support.Malformed instance IDs and/or Minor Instance ID deviations do occur occasionally and will need to be manuallytagged and added to policy while working with support to enhance the product to handle the ever changing natureof these app flows.332021 Netskope. All rights reserved.