When defining security policies, it is critical to know who the user is and what their privileges should be based on their role, and whether the device itself or the state of the device at the time of connection is in a known good state. Providing controls around what the user can perform once they are sending traffic to the internet is critical, but it’s easier said than done with traditional security solutions, as it is difficult to implement contextual controls with the desired granularity without introducing massive complexity.
In a previous blog, I wrote about an “out-of-the-box” experience for users, using the Netskope integration with Chrome, that was minimally invasive, yet provided deep contextual control to the administrator. The latest Netskope integration with Google Chrome Enterprise and Verified Access helps take this a step further.
To start, let’s examine what the “out-of-the-box” experience looks like here. First, the security administrator would set up an API connection between the Netskope Security Cloud and Google’s Verified Access. This only needs to be done once. This is transparent to the user, as the Google Admin will manage the users, as well as the deployment of the Netskope Chrome Extension on managed Chromebook devices. Now, when a student is given a Chromebook with an account on Google, they simply need to connect it to the network and log in with their Google credentials. At this point, the device is brought under management, the user is identified, the Netskope Extension is pushed to Chrome, and the state of the device is determined going forward. From the user’s perspective, they did nothing else but log into the Chromebook.
Let’s look at a general use case that might be seen in a typical organization. One user is on the Finance team and is constantly working with partners and customers on financial matters. This role requires a potentially significant amount of risky behavior that should be allowed, but needs to be closely monitored at minimum. A second user is a software developer that has access to significant intellectual property but that information should only be shared inside the organization. By using Chrome on an issued Chromebook and leveraging integration with Verified Access, the security administrator can now define deeply rich contextual policies.
From an enforcement point of view, the Netskope Security Administrator can now define policies based on users or groups, proper use, and state of the device. When the finance user logs in, they require access to multiple file sharing services with the ability to log into those services with multiple private accounts and have relative open access to the Internet. The action of downloading content from a corporate instance of Google Drive and then uploading it to a different file sharing service with a different account is highly risky activity. In this example, this action needs to be allowed based on the role, but it needs to be closely monitored. In the case of the developer user, their work product should only reside inside the organization. This user should not be allowed to upload content to any unsanctioned corporate resource as part of their job function. Both of these requirements are easily met with Netskope Security Cloud and Google Chrome Enterprise.
Since the user and device is being managed by the Google Administrator, those identities and roles are then leveraged for policy definition. Is this a known user, using a known good device that has passed boot verification? These questions are answered before any traffic is sent. Once the user starts to send traffic, it is forwarded to the Netskope Security Cloud that verifies the state of the device and role of the user with Verified Access. Once this has passed, traffic is allowed or denied based on policies defined in Netskope. These policies could be as simple as a block or the user could be presented with a coaching screen as to why the activity was blocked, or that it is considered dangerous but give them the option to proceed.
Netskope is excited to be an inaugural member and is now Google Chrome Enterprise recommended, and part of the Security and Trust solution track. This latest integration with Netskope and Google Chrome Enterprise, with Verified Access, goes a long way toward making the process of defining and applying these contextual controls simple for security leaders, and a hassle-free experience for users working “out-of-the-box” on their Chromebook, so their data is not at risk. Working together, Netskope and Google Chrome Enterprise are continuing the journey to make sure Chromebook users and their data are protected.
Click here to learn more about the Netskope integration with Chrome OS and Chromebook. If you’re interested in other Netskope integrations with Google, check out our pages on Netskope for GCP and Netskope for Google Workspace.
