To detect files containing sensitive data that are shared outside of the organization, the administrator should select both 'Shared Externally' and 'Public' sharing options. These settings ensure that any files shared externally (outside the organization) or publicly are scanned for sensitive data. This comprehensive approach covers all potential scenarios where data could be exposed outside the organization.

Step-by-Step Configuration:

Select Specific Sharing Options:

Navigate to the CASB API-enabled Protection policy configuration page.

Choose the option for 'Specific Sharing Options' to limit the scan to files shared under certain conditions.

Enable Shared Externally and Public:

Check both 'Shared Externally' and 'Public' options. This setting ensures that files shared either publicly or with external domains are included in the scan.

Configure Advanced Options:

For further granularity, configure the advanced options under each sharing type if needed (e.g., specifying particular external domains).

This configuration aligns with the best practices for CASB policies and ensures that all files potentially leaving the organization are scanned for sensitive data.

Netskope CASB Policy Configuration Documentation

To create a policy to quarantine files based on sensitive content in Netskope, you need to include the DLP Profile variable. Here's a detailed explanation of the steps involved:

Access Netskope Admin Console: First, log in to your Netskope admin console.

Navigate to Policies: Go to the Policies section where you can create and manage different types of policies.

Create a New Policy: Click on the option to create a new policy. Select the type of policy you want to create. In this case, it will be a Data Loss Prevention (DLP) policy.

Define Policy Criteria: Define the criteria for your policy. This includes specifying the conditions under which files should be quarantined. You will need to include sensitive content detection as part of the criteria.

Include DLP Profile: The most crucial step is to include a DLP Profile in your policy. The DLP Profile will define the sensitive content that the policy will monitor for. Netskope provides various predefined DLP profiles that you can use, or you can create custom DLP profiles based on your organization's needs.

Set Action to Quarantine: Specify the action to be taken when the policy criteria are met. In this case, you want to quarantine the files. Select the 'Quarantine' action from the available options.

Save and Apply Policy: Once you have configured the policy with the DLP profile and action, save the policy and apply it to the relevant users, groups, or organizational units.

Netskope Knowledge Portal: Using DLP Profiles and Policies.

To deploy Netskope's zero trust network access (ZTNA) solution, NPA, you need to enable Steer all Private Apps in your existing steering configuration(s) from the admin console. This will allow you to create private app profiles and assign them to your applications. NPA will then provide secure and granular access to your applications without exposing them to the internet or requiring VPNs.Reference:[Netskope Private Access (NPA) Deployment Guide]

The three components that make up the Borderless SD-WAN solution are:

Endpoint SD-WAN Client: This client is installed on endpoints (such as laptops and mobile devices) to ensure secure and optimized connectivity to the corporate network, even when users are remote. The Endpoint SD-WAN Client is a critical part of extending SD-WAN capabilities to individual users and devices, providing seamless connectivity and security.

SASE Orchestrator: The Secure Access Service Edge (SASE) Orchestrator is responsible for managing and orchestrating the various components of the SD-WAN solution. It ensures that policies are enforced consistently across the network, manages the deployment of network functions, and provides centralized control and visibility.

SASE Gateway: The SASE Gateway provides secure, optimized access to cloud applications and services. It combines SD-WAN capabilities with advanced security functions, such as firewalling, intrusion prevention, and secure web gateways, to protect data and users as they access resources from different locations.

These components work together to provide a comprehensive SD-WAN solution that addresses the needs of modern, distributed workforces by combining networking and security functions in a unified architecture.

Netskope REST API v2 Overview.

Using the REST API v2 dataexport Iterator Endpoints.

Using the REST API v2 UCI Impact Endpoints.

Netskope SDK on PyPI.

Postman Collection for Netskope REST API.

TLS/SSL Inspection:

Cloud security solutions achieve visibility into TLS/SSL-protected web traffic through a process known as TLS/SSL interception or inspection.

How It Works:

The security solution acts as an intermediary (man-in-the-middle) during the TLS handshake.

When a user initiates a connection to a TLS/SSL-protected website, the security solution intercepts this connection.

It completes the TLS handshake with the user's device using its own certificate, and simultaneously performs the handshake with the destination website.

Certificate Replacement:

The security solution decrypts the traffic, inspects it, and then re-encrypts it before forwarding it to the destination website.

The user's browser trusts the security solution's certificate, which replaces the original website's certificate.

Security Implications:

This method allows the security solution to inspect encrypted traffic for threats or policy violations while maintaining secure communication.

Reference:

Detailed explanations and implementation steps can be found in Netskope documentation on SSL/TLS inspection.