The Future of Zero Trust and SASE is Now! Register now

close
close
The platform of the future is Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Next Gen SASE Branch is hybrid — connected, secured, and automated

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch
People at the open space office
Designing a SASE Architecture For Dummies

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook
Embrace a Secure Access Service Edge (SASE) architecture

Netskope NewEdge is the world’s largest, highest-performing security private cloud and provides customers with unparalleled service coverage, performance and resilience.

Learn about NewEdge
NewEdge
Your Network of Tomorrow

Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.

Get the white paper
Your Network of Tomorrow
Netskope Cloud Exchange

The Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.

Learn about Cloud Exchange
Netskope video
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope achieves FedRAMP High Authorization

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud
Netskope GovCloud
  • Resources chevron

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops chevron

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined chevron

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Cookies, Not Biscuits
Host Emily Wearmouthas sits down with experts David Fairman and Zohar Hod to discuss the past, present, and future of internet cookies.

Play the podcast
Podcast: Cookies, Not Biscuits
Latest Blogs

How Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky
SASE Week 2023: Your SASE journey starts now!

Replay sessions from the fourth annual SASE Week.

Explore sessions
SASE Week 2023
What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn about Security Service Edge
Four-way roundabout
We help our customers to be Ready for Anything

See our Customers
Woman smiling with glasses looking out window
Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn about Professional Services
Netskope Professional Services
The Netskope Community can help you and your team get more value out of products and practices.

Go to the Netskope Community
The Netskope Community
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working
  • Company chevron

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope chevron

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership chevron

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners chevron

    We partner with security leaders to help you secure your journey to the cloud.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Highest in Execution. Furthest in Vision.

Netskope recognized as a Leader in the 2023 Gartner® Magic Quadrant™ for Security Service Edge.

Get the report
Netskope recognized as a Leader in the 2023 Gartner® Magic Quadrant™ for Security Service Edge.
Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling

Catching A Wave, Standing Up on My Surfboard: How Cloud Threat Exchange Saves My SOC From Drowning (For Now)

Mar 31 2022

We have built a Security Operations Center at Netskope in short order. Facing the vast expanse of the Security Operations ocean, I grabbed my board with my team and focused on doing a few things really well. We documented workflows, expanded our visibility, and tuned monitoring systems. We paddled out from shore, braving the shark-infested waters of the threat landscape. Of course, with many tools comes many threat data sources, and as expected, the threat data ingestion tidal wave quickly manifested itself.

Testing the waters

Our SOC, like most, operates in an extremely fast-moving environment with shiny objects everywhere. We are constantly asked to look at the latest technology, most of which are just little swells that won’t become waves and aren’t worth the energy to surf. I am always interested in checking out new technology to understand the potential fit. But if you can’t explain the use case to me in 30 minutes, I move on. I surf big waves. This is a story of a swell that quickly turned into a big wave for my team.

A big wave

When approaching the topic of orchestrating static indicators of compromise such as hashes, IP addresses, and domains, I was introduced to an in-house solution: Cloud Threat Exchange (CTE). CTE is a module that runs in a lightweight collection of Docker applications, named Cloud Exchange, that ingests, manages, and shares IP addresses, domains, and file hashes. It’s free, too.

My team and I pushed up from our boards. After careful research of our own environment and prioritizing the many threat data routing options available to us, we deployed our own instance in the SOC and started connecting key data points.

Hanging ten

We are now routing high-fidelity threat data multi-directionally and in near-real-time between our Netskope instance and other monitoring points, such as EDR and our email gateway. Furthermore, we are channeling certain output for incorporation into the Netskope threat detection engine. We are up on our boards and carving a ride on the wave.

We are not drowning. We are routing threat data faster than ever and you can too. We are up on our boards and can see the threats below the surface sooner. This protects Netskope AND drives improvements in our own threat detection engine to protect our customers.

How it works

Sharing threat intelligence is configurable between any two connected systems. For instance, we can facilitate sharing between different endpoint providers or even multiple Netskope cloud tenants. As threat intelligence and IOCs are received via CTE, we can enforce real-time security enforcement, blocking user access to malicious sites or files that can endanger our security posture. The possibilities are truly mind-boggling.

Consider this diagram an example of how we think about using CTE for automated indicator routing in the SOC:

Diagram of how we think about using CTE for automated indicator routing in the SOC
  1. The industry and community channels have an enormous amount of threat data to sift through. Sharing is caring, but is it useful?
  2. To make threat data useful, organizations should analyze the threat using various analysis techniques. Intelligence analysis is outside the scope of this post, but for the purpose of this example, we will assume that the threat data that is feeding your security instrumentation is of high fidelity and vetted through rigorous intelligence analysis.
  3. As indicators are fed to security instrumentation, such as EDR, email gateways, and firewalls, certain actions are constantly performed depending on numerous configuration and environmental factors. Again, those tuning considerations are outside the scope of this post, but for the purpose of this example, we will assume that your tools are tuned and working as expected.
  4. Depending on the partnership connections in place at any given time, every piece of your security stack may or may not be capable of integrating with each other. Chances are, there will be some tool that cannot talk to another. 
  5. This is where the power of CTE comes in. There are several out-of-the-box integrations, such as CrowdStrike Falcon, VMware Carbon Black Cloud, SentinelOne, and ServiceNow. In addition, we add our own plug-ins to enable sharing between CTE and our own IT systems and/or scripts.
  6. Of course, our own Netskope security stack benefits from the near-real-time ingestion of the routed threat data. The client pulls the updated rules from the Netskope Security Cloud and the user and data are protected.
  7. Since sharing is caring, we can now share indicators out to wherever we choose, be it our own internal intelligence hub, or external partner organizations.

Dashboard

The CTE dashboard provides information on how frequently IOCs have been seen and from what systems, enabling customers to determine the scope of an attack surface. We can also configure when IOCs are timed-out due to staleness, plus choose which IOC sources to trust when they are provided with conflicting (e.g. ‘safe’ versus ‘suspicious’) information. This allows for granular control and decisions on which indicators should be routed where, and for how long.

Ready for more waves (wash, rinse, repeat)

For our SOC, CTE enables even more robust automation and orchestration capabilities to gain full visibility into every event that is happening here. For example, we can make a secondary call to add to monitoring for a priority use case. We have fewer false positives because we are considering more data points more thoughtfully. Pervasive attacks and their IOCs can trigger IR workflows or orchestration playbooks to automate response steps. This makes our security analysts more efficient across multiple security tools. As the SOC continues to evolve with the business, thoughtful implementation of technologies such as CTE provide a much-needed mechanism for us to keep our heads above water and see what lurks beneath the surface.

Ready to use CTE?

There is no charge to use CTE or any of the modules running on Cloud Exchange. CE is a business development tool provided at no charge to Netskope customers and covered by the Netskope EULA. You can download it from Netskope’s public Github repository once you are ready to start surfing! Please contact your Netskope account team or [email protected] if you have any questions.

author image
Jason Barnes
Jason Barnes is Senior Manager of Security Operations and manages the global Netskope Security Operations Center.

Stay informed!

Subscribe for the latest from the Netskope Blog