cerrar
cerrar
Su red del mañana
Su red del mañana
Planifique su camino hacia una red más rápida, más segura y más resistente diseñada para las aplicaciones y los usuarios a los que da soporte.
          Descubra Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            Líder en SSE. Ahora es líder en SASE de un solo proveedor.
            Líder en SSE. Ahora es líder en SASE de un solo proveedor.
            Netskope debuta como Líder en el Cuadrante Mágico™ de Gartner® para Single-Vendor SASE
              Protección de la IA generativa para principiantes
              Protección de la IA generativa para principiantes
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Prevención moderna de pérdida de datos (DLP) para Dummies
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Libro SD-WAN moderno para principiantes de SASE
                  Modern SD-WAN for SASE Dummies
                  Deje de ponerse al día con su arquitectura de red
                    Entendiendo dónde está el riesgo
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        Los 6 casos de uso más convincentes para el reemplazo completo de VPN heredada
                        Los 6 casos de uso más convincentes para el reemplazo completo de VPN heredada
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive Salvaguarda su "Propiedad Intelectual" con Protección de Datos Inteligente y Adaptable
                          Colgate-Palmolive Salvaguarda su "Propiedad Intelectual" con Protección de Datos Inteligente y Adaptable
                            Netskope GovCloud
                            Netskope logra la alta autorización FedRAMP
                            Elija Netskope GovCloud para acelerar la transformación de su agencia.
                              Let's Do Great Things Together
                              La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.
                                Soluciones Netskope
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Soporte técnico Netskope
                                  Soporte técnico Netskope
                                  Nuestros ingenieros de soporte cualificados ubicados en todo el mundo y con distintos ámbitos de conocimiento sobre seguridad en la nube, redes, virtualización, entrega de contenidos y desarrollo de software, garantizan una asistencia técnica de calidad en todo momento
                                    Vídeo de Netskope
                                    Netskope Training
                                    La formación de Netskope le ayudará a convertirse en un experto en seguridad en la nube. Estamos aquí para ayudarle a proteger su proceso de transformación digital y aprovechar al máximo sus aplicaciones cloud, web y privadas.

                                      Applying 3 Practical Lessons from the SolarWinds Breach

                                      Jan 22 2021

                                      It’s been more than a month since the SolarWinds breach first started dominating security headlines, and we’re still learning new details about the attacks and the organizations affected. Even as the discussion quiets down, it’s easy to imagine we’ll still be looking back and analyzing the full effects of these incidents in much the same way we talk about other seminal breaches and security events from the past 20 years. 

                                      You might be thinking: another “what-we-learned” piece on the SolarWinds stuff? Well, I wear the CMO hat at Netskope, so I’m of course always interested in how we position and discuss these things. But my longer history is as a CISO and Chief Strategy Officer. I want to look at how to manage risk, sure, but also how to cut through all the hype and chatter and speculation and get to real advice that we can apply—today—based on what we have learned. 

                                      Based on many conversations with leaders in the security community over the last few weeks, here are what I think are three of the most practical lessons.

                                      Lesson: There is more empathy and support among security pros than we realized. Let’s use that.

                                      Security professionals, CISO or otherwise, tend to have each other’s backs. No one wants to be in the position that professionals at FireEye, SolarWinds, or anyone else involved found themselves. And with notable exceptions–come on, folks, your barely-disguised exploitative marketing is obvious!—security vendors and influencers did not pile on, instead expressing solidarity and wanting to see how we, as a community, can do better as a result of what we’ve learned from the mess. 

                                      These past few years have been a divisive time, all over the world. We talk about unity, we talk about wanting to do better as far as public-private industry cooperation in security, we talk about threat intelligence sharing, we talk about being good citizens…we talk. If there’s to be any silver lining in what happened with SolarWinds, perhaps it will be that it inspired us to actually collaborate on the things that have to get done, not just forming more threat info sharing committees or pushing a technology agenda. SolarWinds is a wake-up call that we are not anywhere close to “there” yet as far as security controls, but we have the right people committed to the right outcomes.

                                      Lesson: We found out what we really mean by “visibility and control.” 

                                      Those two words…man, we love them, don’t we? “See everything, take action on it immediately”? Sounds great in marketing, but is too often theoretical, if not misleading. 

                                      We need an airtight understanding of what’s going on in our networks, with our data, with the people accessing it, in the entirety of our environment and extended ecosystem. Jamil Farshchi, the CISO at Equifax, recently described supply chain security as “relying on point-in-time, low-assurance questionnaires, and on-site visits, or MSA legalese.” As he explained in a LinkedIn post, “It just doesn’t work.” Supply chain security is one of hundreds of aspects of full visibility and control over your ecosystem, of course, but the logic Jamil described applies in many cases. We’re just not able to get a handle on what’s happening without committing to the broadest and deepest visibility and the real-time ability to address anomalies in what we’re seeing. 

                                      The technology is there now to do that, even in highly distributed, cloud-first environments. Not enough of us are using it yet. When we are, we can offer the kind of transparency Jamil describes from Equifax: “That’s why we’ve decided to give our customers real-time visibility into the operating effectiveness of our cloud security controls—products, services, and supporting infrastructure—just like I wish our suppliers would do for us.” That’s a call-to-action we should all get behind. 

                                      Lesson: We won’t get to where we need to be without continuous risk management

                                      As organizations continue to embrace cloud, the old ways of thinking about data protection are no longer productive. DLP as many of us think of it comes from the pre-cloud era of security and is still rooted in the idea that the “goods” are in a data center, protected by a perimeter, and we can prevent data from leaking “out” in authorized ways, all while stopping others from getting “in.”

                                      Data protection in the cloud era is ultimately about context; we allow or disable access to it based on the deepest and most granular possible understanding of who the user is, what the user is trying to do, and why the user is trying to do it. If we can enable conditional access controls to be defined based on the context of users, apps, devices, and data, we create continuous risk management, not rely on an incomplete or outdated picture of our environment.

                                      How are you planning to achieve continuous risk management? Connect with me on LinkedIn and let’s talk about how we do this better.

                                      author image
                                      Jason Clark
                                      Jason Clark brings decades of experience executing successful strategic security programs and business strategies to Netskope as Chief Strategy and Marketing Officer.
                                      Jason Clark brings decades of experience executing successful strategic security programs and business strategies to Netskope as Chief Strategy and Marketing Officer.

                                      ¡Mantente informado!

                                      Suscríbase para recibir lo último del blog de Netskope