Netskope named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge. Get the Report.

  • Products

    Netskope products are built on the Netskope Security Cloud.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

Netskope Named a Leader in the 2022 Gartner Magic Quadrant™ for SSE Report

Get the report Go to Products Overview
Netskope gartner mq 2022 sse leader

Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform
Birds eye view metropolitan city

Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn more
Lighted highway through mountainside switchbacks

Prevent threats that often evade other security solutions using a single-pass SSE framework.

Learn more
Lighting storm over metropolitan area

Zero trust solutions for SSE and SASE deployments

Learn more
Boat driving through open sea

Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn more
Wind turbines along cliffside
  • Customer Success

    Secure your digital transformation journey and make the most of your cloud, web, and private applications.

  • Customer Support

    Proactive support and engagement to optimize your Netskope environment and accelerate your success.

  • Training and Certification

    Netskope training will help you become a cloud security expert.

Trust Netskope to help you address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements.

Learn more
Woman smiling with glasses looking out window

We have qualified engineers worldwide, with diverse backgrounds in cloud security, networking, virtualization, content delivery, and software development, ready to give you timely, high-quality technical assistance.

Learn more
Bearded man wearing headset working on computer

Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn more
Group of young professionals working
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Bonus Episode: The Importance of Security Service Edge (SSE)

Play the podcast
Black man sitting in conference meeting

Read the latest on how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky

SASE Week

Netskope is positioned to help you begin your journey and discover where Security, Networking, and Zero Trust fit in the SASE world.

Learn more
SASE Week

What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn more
Four-way roundabout
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Netskope enables the future of work.

Find out more
Curvy road through wooded area

Netskope is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data.

Learn more
Switchback road atop a cliffside

Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain

Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn more
Group of diverse young professionals smiling
Blog Platform, Products, & Services Highlighting New Advanced Security Capabilities for Netskope Cloud Firewall
Sep 13 2022

Highlighting New Advanced Security Capabilities for Netskope Cloud Firewall

One of the benefits of a secure access service edge (SASE) framework is that organizations can dramatically simplify the implementation of security services without having to go through constant network redesigns and appliance operating system updates. The new advanced security capabilities for Netskope Cloud Firewall, which we are introducing today, exemplify these principles, by allowing organizations to implement a number of important protections by enabling services without having to redesign the network or plan for outages.

Providing granular classification and enforcement with app control

The first new capability is app control for Netskope Cloud Firewall. To understand how Netskope delivers app control, it’s important to first recap a few key concepts. To start, many Netskope customers today use Next Gen SWG to overcome the lack of visibility of cloud and web activity within their current environment. By leveraging Netskope Next Gen SWG, organizations are able to assert context-driven, fine-grained activity control over 100+ criteria across cloud and web in ways that traditional hardware firewalls cannot.

But the difference is not purely a matter of functionality. Hardware firewalls have physical constraints both in location and computing resources. One cannot easily move a firewall when users move locations, and network teams can only support operations in a finite number of geographical regions. In addition, the finite compute available even in on-prem next-gen firewalls means that organizations are not able to take advantage of new and existing security capabilities, especially when they are computationally intensive such as with SSL decryption. This is problematic since more than 90% of traffic is encrypted these days. Thus, managing outbound security policy from a hardware firewall creates both security and logistical challenges, especially when considering the demands of hybrid work.

 With the new release of app control capabilities for Netskope Cloud Firewall, organizations can now take the next step in their SASE journey. Instead of using app control solely for web and cloud applications, organizations can apply app control through Netskope Cloud Firewall for non-web traffic as well.

Why is app control important to Netskope Cloud Firewall? 

App control adds additional granularity to policies that go beyond port and protocol. Port and protocol are foundational firewall controls, but port assignments are no longer meaningful for identifying applications, especially when you think about how many apps operate over HTTP/HTTPS. So at a base level, port-based policies help funnel traffic through Next Gen SWG. However, open ports could enable a port-hopping application to egress as well, so more precise controls are needed.

By using app control for Netskope Cloud Firewall, the traffic classification and policy enforcement definitions are based on the app itself. This enables organizations to create policies that limit the use of applications that could pose a risk. For example, remote desktop protocol (RDP) is an important tool, but can be very concerning when there are RDP sessions that connect to the internet. From a security point of view, organizations might want to establish tighter granular controls over RDP no matter what port it crosses. This way organizations can not only provide more granular policy controls, but also avoid opening a port that could be used for other purposes. Therefore, app controls help organizations minimize exposure to risk, especially when there are better ways to manage valid uses for RDP, such as using a zero trust network access (ZTNA) tool like Netskope Private Access instead.

Identifying and stopping potential attacks with DNS Security

A second new capability for Netskope Cloud Firewall is DNS Security. The threat landscape continues to expand, and attackers’ techniques take advantage of the ubiquity of DNS services and the distributed queries that lie outside the conventional access control and content inspection protections that organizations normally rely on. 

At a baseline, an attacker will use sites to host phishing, command & control (C&C) servers, and malware, usually with domains that are not obviously recognizable as being dangerous. To keep users away from connecting from such a domain, DNS Security delivers domain blocking that can be applied categorically.

Time is detrimental to the attack, because the longer it remains linked to a particular domain, the more likely the site is eventually flagged as malicious and either blocked or taken offline. To stay ahead of threat researchers, attackers will use newly generated domains to operate from sites that have yet to be classified. More advanced techniques computationally determine new domains that would be under the attacker’s control in the future, using domain generation algorithms, which use domains that have yet to appear in order to reestablish communications when an older site is blocked. Netskope Cloud Firewall delivers protection against these techniques by applying the latest threat intelligence, augmented by third-party threat intelligence from Cloud Exchange, and combined with AI/ML technologies to add predictive capabilities that stop or sinkhole dangerous communications to newly emergent C&C sites.

Another technique for C&C and data exfiltration is to use tunneling over DNS by using software on the infected host to encode extra content within a DNS query. Given that DNS queries are distributed, an infected host could take advantage of the unused padding to covertly communicate with the attacker. Organizations can eliminate the blind spot in DNS tunneling by using Netskope Cloud Firewall to identify and stop DNS tunneling techniques, thus providing key protections against the later stages of a cyberattack before the damage is done.

These security services are but a few of the ways that the newly launched app control and DNS Security capabilities in Netskope Cloud Firewall can help your security posture. To learn more, visit the Netskope Cloud Firewall web page for more information.

If you’d like to hear more from me about firewalls, register for my session at SASE Week on September 14.

author image
About the author
Brian is responsible for platform and threat product marketing at Netskope. Prior to Netskope, he worked in network security at Palo Alto Networks and data protection at Symantec.
Brian is responsible for platform and threat product marketing at Netskope. Prior to Netskope, he worked in network security at Palo Alto Networks and data protection at Symantec.