Netskope named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge. Get the Report.

  • Products

    Netskope products are built on the Netskope Security Cloud.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

Netskope Named a Leader in the 2022 Gartner Magic Quadrant™ for SSE Report

Get the report Go to Products Overview
Netskope gartner mq 2022 sse leader

Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform
Birds eye view metropolitan city

Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn more
Lighted highway through mountainside switchbacks

Prevent threats that often evade other security solutions using a single-pass SSE framework.

Learn more
Lighting storm over metropolitan area

Zero trust solutions for SSE and SASE deployments

Learn more
Boat driving through open sea

Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn more
Wind turbines along cliffside
  • Our Customers

    Netskope serves more than 2,000 customers worldwide including more than 25 of the Fortune 100

  • Customer Solutions

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification

    Netskope training will help you become a cloud security expert.

We help our customers to be Ready for Anything

See our Customers
Woman smiling with glasses looking out window

Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn more
Netskope Professional Services

Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn more
Group of young professionals working
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Episode 14: Enabling Security from the Top-Down

Play the podcast
Black man sitting in conference meeting

Read the latest on how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky

SASE Week

Netskope is positioned to help you begin your journey and discover where Security, Networking, and Zero Trust fit in the SASE world.

Learn more
SASE Week

What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn more
Four-way roundabout
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Netskope enables the future of work.

Find out more
Curvy road through wooded area

Netskope is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data.

Learn more
Switchback road atop a cliffside

Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain

Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn more
Group of diverse young professionals smiling

Cloud Threats Memo: Hard Statistics About Poorly Secured Cloud Accounts

Dec 08 2021

Cloud accounts continue to be a valuable target for cybercriminals: not only do the resources of a compromised IaaS environment grant an immediate profit for the attackers, but the same infrastructure also provides a trusted environment to launch attacks against other targets. A recent report by Google’s Cybersecurity Action Team is particularly insightful on this topic and shows some interesting data about the multiple ways cybercriminals can exploit poorly secured Google Cloud Platform accounts (spoiler alert: Google Cloud Platform is not the only IaaS environment that can be abused by threat actors).

According to the study, in a sample of 50 recently compromised GCP instances, 86% were abused to perform cryptocurrency mining (with easily predictable implications on the victims’ bills), 10% to conduct port scanning on other targets, 8% to launch attacks against other targets, and 6% to host malware (in all cases the attackers leverage the power of a trusted environment). Even worse, weak passwords and unauthenticated API are the most exploited initial access vectors with 48%, ahead of vulnerabilities in third-party software (26%) and misconfigurations and other issues (both with 12%). The shortest amount of time between the exposure of a vulnerable cloud instance and its compromise is an incredible value of 30 minutes (8 hours in 40% of cases). And apparently, the attackers don’t waste time after the compromise, considering that in 58% of cases where the instance was compromised to mine cryptocurrency, the mining software was downloaded after 22 seconds.

But opportunistic criminals are not the only ones interested in cloud accounts, and Google Cloud Platform is certainly not the only targeted IaaS service. A new report by Mandiant has shed light on the latest campaign of the suspected Russian group Nobelium, known for its massive supply-chain attacks and more recently for a campaign targeting cloud service providers. In at least one case of their latest cluster of activity, the attackers used a compromised Azure AD account of a cloud service provider as the initial access to infiltrate the Azure subscriptions used to host and manage the downstream customers’ environments, from where they subsequently performed privilege escalation, lateral movement, and data collection in a complex kill chain. This example shows why attackers are moving to the cloud: compromising an IaaS environment of a cloud service provider is the easiest way to carry out a supply chain attack and target multiple organizations in a single shot.

How Netskope mitigates the risk of poorly secured cloud accounts being abused by attackers.

Netskope Public Cloud Security detects misconfigurations in IaaS environments, such as AWS, Azure, and Google Cloud Platform, that can be exploited by bad actors. A set of predefined profiles allows users to comply with best practices and industry standards, such as NIST CSF, PCI-DSS, and CIS. Additionally, it is possible to easily build custom rules with Domain Specific Language. The same protection is also available for SaaS applications (such as Microsoft 365, Salesforce, GitHub, Zoom, and ServiceNow) thanks to the new SSPM (SaaS Security Posture Management) module.

Since the public cloud can also leave workloads unprotected, there has been an explosion of misconfigured remote access services (like RDP or SSH) targets of brute-force or password-spraying attacks. Netskope Private Access is the solution to mitigate this risk, allowing organizations to publish their services (hosted in a public cloud or an on-prem datacenter) in a secure manner, embracing the Zero Trust access paradigm.

Finally, Netskope Advanced Analytics provides specific dashboards to assess the risk of cloud misconfigurations, with rich details and insights, supporting the security teams in the remediation process.

Stay safe!

author image
Paolo Passeri
Paolo supports Netskope’s customers in protecting their journey to the cloud and is a security professional, with 20+ years experience in the infosec industry. He is the mastermind behind hackmageddon.com, a blog detailing timelines and statistics of all the main cyber-attacks occurred since 2011. It is the primary source of data and trends of the threat landscape for the Infosec community.