Netskope wurde im Gartner Magic Quadrant für Security Service Edge 2022 als führendes Unternehmen ausgezeichnet. Report abrufen.

  • Produkte

    Netskope-Produkte basieren auf der Netskope Security Cloud.

  • Plattform

    Unübertroffene Transparenz und Daten- und Bedrohungsschutz in Echtzeit in der weltweit größten privaten Sicherheits-Cloud.

Netskope wurde 2022 zum Marktführer im Gartner Magic Quadrant™ for SSE Report ernannt

Report abrufen Netskope Produktübersicht
Netskope führend bei SSE in Gartner MQ 2022

Netskope bietet einen modernen Cloud-Security-Stack mit vereinheitlichten Funktionen für Daten- und Bedrohungsschutz sowie sicherem privaten Zugriff.

Erkunden Sie unsere Plattform
Städtische Metropole aus der Vogelperspektive

Steigen Sie auf marktführende Cloud-Security Service mit minimaler Latenz und hoher Zuverlässigkeit um.

Mehr Informationen
Beleuchtete Schnellstraße mit Serpentinen durch die Berge

Verhindern Sie Bedrohungen, die häufig anderen Sicherheitslösungen entgehen, mithilfe eines SSE-Frameworks mit single-pass Architektur

Mehr Informationen
Gewitter über einem Großstadtgebiet

Zero-Trust-Lösungen für SSE- und SASE-Deployments

Mehr Informationen
Bootsfahrt auf dem offenen Meer

Netskope ermöglicht einen sicheren, cloudintelligenten und schnellen Weg zur Einführung von Cloud-Diensten, Apps und Public-Cloud-Infrastrukturen.

Mehr Informationen
Windkraftanlagen entlang einer Klippe
  • Customer Success

    Sichern Sie Ihren Weg zur digitalen Transformation und holen Sie das Beste aus Ihren Cloud-, Web- und privaten Anwendungen heraus.

  • Kunden-Support

    Proaktiver Support und Engagement zur Optimierung Ihrer Netskope-Umgebung und zur Beschleunigung Ihres Erfolgs.

  • Schulung und Zertifizierung

    Netskope-Schulungen helfen Ihnen ein Experte für Cloud-Sicherheit zu werden.

Vertrauen Sie darauf, dass Netskope Sie bei dem Schutz vor neuen Bedrohungen, neuer Risiken und technologischer Veränderungen unterstützt. Ebenso bei organisatorischen sowie Compliance Anforderungen.

Mehr Informationen
Lächelnde Frau mit Brille schaut aus dem Fenster

Wir verfügen weltweit über qualifizierte Ingenieure mit unterschiedlichem Hintergrund in den Bereichen Cloud-Sicherheit, Netzwerke, Virtualisierung, Inhaltsbereitstellung und Softwareentwicklung, die bereit sind, Ihnen zeitnahe und qualitativ hochwertige technische Unterstützung zu bieten.

Mehr Informationen Support Portal
Bärtiger Mann mit Headset arbeitet am Computer

Mit Netskope-Schulungen können Sie Ihre digitale Transformation absichern und das Beste aus Ihrer Cloud, dem Web und Ihren privaten Anwendungen machen.

Mehr Informationen
Gruppe junger Berufstätiger bei der Arbeit
  • Ressourcen

    Erfahren Sie mehr darüber, wie Netskope Ihnen helfen kann, Ihre Reise in die Cloud zu sichern.

  • Blog

    Erfahren Sie, wie Netskope die Sicherheits- und Netzwerktransformation durch Security Service Edge (SSE) ermöglicht.

  • Veranstaltungen& Workshops

    Bleiben Sie den neuesten Sicherheitstrends immer einen Schritt voraus und tauschen Sie sich mit Gleichgesinnten aus

  • Security Defined

    Finden Sie alles was Sie wissen müssen in unserer Cybersicherheits-Enzyklopädie.

Security Visionaries Podcast

Bonus-Episode: Die Bedeutung von Security Service Edge (SSE)

Podcast abspielen
Dunkelhäutiger Mann in einer Webkonferenz

Lesen Sie die neuesten Informationen darüber, wie Netskope die Zero Trust- und SASE-Reise durch Security Service Edge (SSE) -Funktionen ermöglichen kann.

Den Blog lesen
Sonnenaufgang und bewölkter Himmel

SASE-Week

Netskope hilft Ihnen dabei, Ihre Reise zu beginnen und herauszufinden, wo Sicherheit, Netzwerk und Zero Trust in die SASE-Welt passen.

Mehr Informationen
SASE-Week

Was ist Security Service Edge?

Entdecken Sie die Sicherheitselemente von SASE, die Zukunft des Netzwerks und der Security in der Cloud.

Mehr Informationen
Kreisverkehr mit vier Straßen
  • Unternehmen

    Wir helfen Ihnen, den Herausforderungen der Cloud-, Daten- und Netzwerksicherheit einen Schritt voraus zu sein.

  • Warum Netskope?

    Cloud-Transformation und hybrides Arbeiten haben die Art und Weise verändert, wie Sicherheit umgesetzt werden muss.

  • Unternehmensführung

    Unser Führungsteam ist fest entschlossen, alles zu tun, was nötig ist, damit unsere Kunden erfolgreich sind.

  • Partner

    Unsere Partnerschaften helfen Ihnen, Ihren Weg in die Cloud zu sichern.

Netskope ermöglicht das "neue" Arbeiten

Finde mehr heraus
Kurvige Straße durch ein Waldgebiet

Netskope definiert Cloud-, Daten- und Netzwerksicherheit neu, um Unternehmen dabei zu unterstützen, Zero-Trust-Prinzipien zum Schutz von Daten anzuwenden.

Mehr Informationen
Serpentinenstraße auf einer Klippe

Denker, Architekten, Träumer, Innovatoren. Gemeinsam liefern wir hochmoderne Cloud-Sicherheitslösungen, die unseren Kunden helfen, ihre Daten und Mitarbeiter zu schützen.

Lernen Sie unser Team kennen
Gruppe von Wanderern erklimmt einen verschneiten Berg

Die partnerorientierte Markteinführungsstrategie von Netskope ermöglicht es unseren Partnern, ihr Wachstum und ihre Rentabilität zu maximieren und gleichzeitig die Unternehmenssicherheit an neue Anforderungen anzupassen.

Mehr Informationen
Gruppe junger, lächelnder Berufstätiger mit unterschiedlicher Herkunft
Blog CSO, Full Skope Using Visibility to Combat Against Ransomware
Dec 30 2021

Using Visibility to Combat Against Ransomware

In the first half of 2021, average ransomware demands surged by 518%, while payments climbed by 82%. There has been a growing number of attacks in healthcare, with 560 healthcare facilities hit by ransomware last year in the U.S. alone. 

As new attacks generate headlines each week, we get real-world use cases for how ransomware proliferates in diverse ways, including social engineering attacks and exploitation of vulnerabilities. These incidents not only cost millions of dollars in recovery, but they also have led to delays in patient treatment and possibly even loss of life.

In addition to working with Netskope’s healthcare customers, I also run our corporate security operations, so I’m obviously concerned about ransomware myself—what could happen, how it might be triggered, and its impact on the organization.

With ransomware so rampant, organizations are starting to focus on what other layers can be put in place to combat the attacks. Most organizations start with basic email security, deploying a secure email gateway (SEG)—but that only gets you so far. There will always be a way for an attacker to push a link or a file that gets past these controls, so we must look at attack vectors holistically.

Greater complexity increases the attack surface

How we deal with ransomware today is evolving because our users are evolving. Our devices are BYOD and our data is no longer sitting in a physical server in an on-premise data center where we have physical access. For the most part, it’s now hosted somewhere else in the world on machines that are managed and maintained by another company.

Oddly, a lot of teams let their guards down because of that. They assume if their public cloud gets encrypted, someone else will step in and everything will magically be okay. They tell themselves that the cloud provider can probably revert all the files back to a previous version and it won’t be a big deal. In some cases and with some providers that might be possible—but in some cases, it’s not.

The risk factors with ransomware call for a proactive approach to both prevention and recovery, should the worst happen. It can really come down to one user making an errant click that subsequently shuts down the entire network.

As an attacker, I just need one click to put an entire company at risk. When you look at 10% across a company of 1,500 people, that’s 150 clicks. People are going to make mistakes—even extremely smart, well-educated, and security-savvy people. So, if we’re never going to have environments that are protected 100% of the time, how are we going to deal with it when that errant click does happen?

Setting aside the issue of whether you should ever pay a ransom, there are really two things to consider when it comes to preparing for a ransomware attack:

  • If your data gets encrypted (or is otherwise lost or offline due to catastrophe), you need to be able to restore your systems as quickly as possible
  • Even after your operations are back online, there’s still the worry that an attacker may have also exfiltrated sensitive or private data.

The evolution to cloud-based recovery systems

The recovery process is often the last thing anyone thinks about. Disaster recovery and business continuity (DRBC) is probably the toughest piece to solve and, often, the most ignored. But if your organization is in healthcare or part of critical infrastructure like utilities, there can be life-and-death consequences to service interruptions. Ensuring business continuity might mean the ability to keep working to save lives, which means that immediate time-to-recovery is going to be very important.

In the past, we used to have to go and pull tapes from an archive at some off-site place to restore systems—and that could take days. A few years ago, many businesses had backup systems inside a hosted data center, allowing them to restore from another server by replicating data across the pipe. That was a lot quicker than tape backups, but it still had limitations. Today, cloud-hosted solutions make things much easier because they take snapshots in time of your data. For this reason, cloud storage makes DRBC much faster than legacy solutions that are still stuck in a physical-servers-and-appliances frame of mind.

To stay ahead of ransomware, businesses need to step up their game and move to a next generation cloud-based DRBC strategy. One of the main reasons why many organizations have not taken this critical step is that they’re worried about the security of those cloud environments.

A recent Cloud Security Alliance (CSA) study showed that security remains a major concern when it comes to cloud adoption for 58% of respondents. But that fear is creating a different risk when it comes to fast, seamless recovery and continuity of operations from a debilitating outage—whether it’s caused by ransomware, a natural disaster, or any other reason.

And the fact is, compared to many of the old secondary storage approaches, the cloud can offer better visibility and control of your data than servers in a physical data center. Your time-to-recovery can be much quicker, and your uptime can be much better.

Ensuring data visibility

Within healthcare it’s not necessarily just about getting access to your data back, but what else happened during that encryption process. Did the attackers damage the data? Was the privacy of your patients also breached in the process of this attack? A US government cybersecurity alert not long ago warned specifically about spiking ransomware activity targeting the healthcare and public health sector—specifically calling out threats that carry out both disruption of services and data theft.

The second part of ransomware preparedness is about establishing comprehensive visibility of your data. Data classification makes this possible. You want to be able to inventory all your data—tagging it according to type, sensitivity, and location. Visibility helps us put policies in place to ensure sensitive information never leaves the organization, and it also helps block files that violate policy (such as cloud-stored ransomware) from coming in based on their classification. It simultaneously helps us keep the good stuff in and the bad stuff out.

With ransomware, you never know if a link or file somehow made it past security controls by clever means to trick someone into innocently opening it. The perfect example is somebody applying for a job. A “job applicant” might send a Dropbox, Google Drive, or OneDrive link to their resume or work sample portfolio in response to an HR posting—but what’s waiting there is ransomware, launched into your organization from the cloud platform. The attack vector has evolved from the file having to physically enter your network to having delivery access from the edge.

When I think about ransomware, I start by thinking about how my users interact with external or even other internal users. Work communications have transcended email and evolved toward dedicated team collaboration tools—sometimes employees even use them just to chat and catch up socially. As a result, we’re now increasingly seeing these tools used as an attack vector.

If an attacker feels like an organization has great email security and all of their users are well-trained to avoid email-based phishing attacks, then what about a link to a Google Drive or Dropbox folder where the payload is located and it doesn’t necessarily have to come through an email? Instead, it can come through Slack or WebEx Teams. The attacker just has to be able to elicit a single click on a link to launch their malware and start the encryption process. Having transparent visibility and policy-based controls in place can help prevent that from happening.

SASE and beyond – Zero trust

With a secure access service edge architecture (SASE) architecture and data loss prevention (DLP) capabilities, I can protect our users inside of what I know—OneDrive or Google Drive, or our corporate Slack channel. The problem is, I don’t know what I don’t know.

Greater mobility, BYOD policies, SaaS applications, and the spike in remote workers have made things even more complicated, especially over the last 18 months. So, I also need visibility and policy-based controls to keep malicious files from being downloaded onto any device that is authorized to have our data.

This is also where zero trust becomes part of the story – or as I like to think of it, continuous adaptive trust. We need to expand full security visibility beyond just data to also have a comprehensive view of users, devices, and applications. This gives us a greater capacity for enforcing granular, role-based controls and reducing the opportunities for threats (including ransomware) to penetrate the network in the first place. The more we know about our expanded network environments, the better we can protect our users, devices, applications, and data from disruption.

This article was originally published by HelpNet Security

author image
About the author
Damian Chung is a cybersecurity leader with over ten years of security experience focused in healthcare. As the Business Information Security Officer at Netskope, Damian is responsible for overseeing corporate security tools and processes and acts as the subject matter expert in the healthcare vertical. He also serves as an adjunct professor for the cybersecurity program at the University of Advancing Technologies in Tempe, AZ.
Damian Chung is a cybersecurity leader with over ten years of security experience focused in healthcare. As the Business Information Security Officer at Netskope, Damian is responsible for overseeing corporate security tools and processes and acts as the subject matter expert in the healthcare vertical. He also serves as an…