Netskope es nombrado líder en el Cuadrante Mágico™ de Gartner 2022 para Security Service Edge. Obtenga el informe

  • Productos

    Los productos de Netskope se basan en Netskope Security Cloud.

  • Plataforma

    Visibilidad inigualable y protección contra amenazas y datos en tiempo real en la nube privada de seguridad más grande del mundo.

Netskope ha sido nombrado Líder en el Informe del Cuadrante Mágico de Gartner™ 2022 en SSE

Obtenga el informe Todos los productos
Líder SSE Netskope gartner mq 2022

Netskope ofrece una estrategia de seguridad cloud moderna, con capacidades unificadas para los datos y protección frente a amenazas, además de un acceso privado seguro.

Explora nuestra plataforma
Vista aérea de una ciudad metropolitana

Cambie a los servicios de seguridad en la nube líderes del mercado con una latencia mínima y una alta fiabilidad.

Más información
Lighted highway through mountainside switchbacks

Prevenga las amenazas que a menudo eluden otras soluciones de seguridad utilizando un marco SSE de un solo paso.

Más información
Lighting storm over metropolitan area

Soluciones de confianza cero para implementaciones de SSE y SASE

Más información
Boat driving through open sea

Netskope hace posible un proceso seguro, rápido y con inteligencia cloud para la adopción de los servicios en la nube, las aplicaciones y la infraestructura de nube pública.

Más información
Wind turbines along cliffside
  • Nuestros clientes

    Netskope da servicio a más de 2.000 clientes en todo el mundo, entre los que se encuentran más de 25 de las 100 empresas de Fortune

  • Soluciones para clientes

    Le apoyamos en cada paso del camino, garantizando su éxito con Netskope.

  • Formación y certificación

    La formación de Netskope le ayudará a convertirse en un experto en seguridad en la nube.

Ayudamos a nuestros clientes a estar preparados para cualquier situación

Ver nuestros clientes
Woman smiling with glasses looking out window

El talentoso y experimentado equipo de servicios profesionales de Netskope proporciona un enfoque prescriptivo para su exitosa implementación.

Más información
Netskope Professional Services

Asegure su viaje de transformación digital y aproveche al máximo sus aplicaciones en la nube, web y privadas con la capacitación de Netskope.

Más información
Group of young professionals working
  • Recursos

    Obtenga más información sobre cómo Netskope puede ayudarle a proteger su viaje hacia la nube.

  • Blog

    Descubra cómo Netskope permite la transformación de la seguridad y las redes a través del servicio de seguridad (SSE).

  • Eventos & Workshops

    Manténgase a la vanguardia de las últimas tendencias de seguridad y conéctese con sus pares.

  • Security Defined

    Todo lo que necesitas saber en nuestra enciclopedia de ciberseguridad.

Podcast Security Visionaries

Episode 15: Building Permanent Security Awareness

Reproducir el pódcast
Black man sitting in conference meeting

Lea lo último sobre cómo Netskope puede hacer posible el viaje de confianza cero y SASE a través de las capacidades de SSE.

Lea el blog
Sunrise and cloudy sky

Semana SASE

Netskope puede ayudarle a dar los primeros pasos en el mundo SASE y a descubrir qué papel desempeñan en él la seguridad, las conexiones de red y Zero Trust.

Más información
Semana SASE

¿Qué es Security Service Edge (SSE)?

Explore el lado de la seguridad de SASE, el futuro de la red y la protección en la nube.

Más información
Four-way roundabout
  • Empresa

    Le ayudamos a mantenerse a la vanguardia de los desafíos de seguridad de la nube, los datos y la red.

  • Por qué Netskope

    La transformación de la nube y el trabajo desde cualquier lugar han cambiado la forma en que debe funcionar la seguridad.

  • Liderazgo

    Nuestro equipo de liderazgo está firmemente comprometido a hacer todo lo necesario para que nuestros clientes tengan éxito.

  • Partners

    Nos asociamos con líderes en seguridad para ayudarlo a asegurar su viaje a la nube.

Netskope posibilita el futuro del trabajo.

Descubra más
Curvy road through wooded area

Netskope está redefiniendo la seguridad de la nube, los datos y la red para ayudar a las organizaciones a aplicar los principios de Zero Trust para proteger los datos.

Más información
Switchback road atop a cliffside

Pensadores, constructores, soñadores, innovadores. Juntos, ofrecemos soluciones de seguridad en la nube de vanguardia para ayudar a nuestros clientes a proteger sus datos y usuarios.

Conozca a nuestro equipo
Group of hikers scaling a snowy mountain

La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.

Más información
Group of diverse young professionals smiling

Using Visibility to Combat Against Ransomware

Dec 30 2021

In the first half of 2021, average ransomware demands surged by 518%, while payments climbed by 82%. There has been a growing number of attacks in healthcare, with 560 healthcare facilities hit by ransomware last year in the U.S. alone. 

As new attacks generate headlines each week, we get real-world use cases for how ransomware proliferates in diverse ways, including social engineering attacks and exploitation of vulnerabilities. These incidents not only cost millions of dollars in recovery, but they also have led to delays in patient treatment and possibly even loss of life.

In addition to working with Netskope’s healthcare customers, I also run our corporate security operations, so I’m obviously concerned about ransomware myself—what could happen, how it might be triggered, and its impact on the organization.

With ransomware so rampant, organizations are starting to focus on what other layers can be put in place to combat the attacks. Most organizations start with basic email security, deploying a secure email gateway (SEG)—but that only gets you so far. There will always be a way for an attacker to push a link or a file that gets past these controls, so we must look at attack vectors holistically.

Greater complexity increases the attack surface

How we deal with ransomware today is evolving because our users are evolving. Our devices are BYOD and our data is no longer sitting in a physical server in an on-premise data center where we have physical access. For the most part, it’s now hosted somewhere else in the world on machines that are managed and maintained by another company.

Oddly, a lot of teams let their guards down because of that. They assume if their public cloud gets encrypted, someone else will step in and everything will magically be okay. They tell themselves that the cloud provider can probably revert all the files back to a previous version and it won’t be a big deal. In some cases and with some providers that might be possible—but in some cases, it’s not.

The risk factors with ransomware call for a proactive approach to both prevention and recovery, should the worst happen. It can really come down to one user making an errant click that subsequently shuts down the entire network.

As an attacker, I just need one click to put an entire company at risk. When you look at 10% across a company of 1,500 people, that’s 150 clicks. People are going to make mistakes—even extremely smart, well-educated, and security-savvy people. So, if we’re never going to have environments that are protected 100% of the time, how are we going to deal with it when that errant click does happen?

Setting aside the issue of whether you should ever pay a ransom, there are really two things to consider when it comes to preparing for a ransomware attack:

  • If your data gets encrypted (or is otherwise lost or offline due to catastrophe), you need to be able to restore your systems as quickly as possible
  • Even after your operations are back online, there’s still the worry that an attacker may have also exfiltrated sensitive or private data.

The evolution to cloud-based recovery systems

The recovery process is often the last thing anyone thinks about. Disaster recovery and business continuity (DRBC) is probably the toughest piece to solve and, often, the most ignored. But if your organization is in healthcare or part of critical infrastructure like utilities, there can be life-and-death consequences to service interruptions. Ensuring business continuity might mean the ability to keep working to save lives, which means that immediate time-to-recovery is going to be very important.

In the past, we used to have to go and pull tapes from an archive at some off-site place to restore systems—and that could take days. A few years ago, many businesses had backup systems inside a hosted data center, allowing them to restore from another server by replicating data across the pipe. That was a lot quicker than tape backups, but it still had limitations. Today, cloud-hosted solutions make things much easier because they take snapshots in time of your data. For this reason, cloud storage makes DRBC much faster than legacy solutions that are still stuck in a physical-servers-and-appliances frame of mind.

To stay ahead of ransomware, businesses need to step up their game and move to a next generation cloud-based DRBC strategy. One of the main reasons why many organizations have not taken this critical step is that they’re worried about the security of those cloud environments.

A recent Cloud Security Alliance (CSA) study showed that security remains a major concern when it comes to cloud adoption for 58% of respondents. But that fear is creating a different risk when it comes to fast, seamless recovery and continuity of operations from a debilitating outage—whether it’s caused by ransomware, a natural disaster, or any other reason.

And the fact is, compared to many of the old secondary storage approaches, the cloud can offer better visibility and control of your data than servers in a physical data center. Your time-to-recovery can be much quicker, and your uptime can be much better.

Ensuring data visibility

Within healthcare it’s not necessarily just about getting access to your data back, but what else happened during that encryption process. Did the attackers damage the data? Was the privacy of your patients also breached in the process of this attack? A US government cybersecurity alert not long ago warned specifically about spiking ransomware activity targeting the healthcare and public health sector—specifically calling out threats that carry out both disruption of services and data theft.

The second part of ransomware preparedness is about establishing comprehensive visibility of your data. Data classification makes this possible. You want to be able to inventory all your data—tagging it according to type, sensitivity, and location. Visibility helps us put policies in place to ensure sensitive information never leaves the organization, and it also helps block files that violate policy (such as cloud-stored ransomware) from coming in based on their classification. It simultaneously helps us keep the good stuff in and the bad stuff out.

With ransomware, you never know if a link or file somehow made it past security controls by clever means to trick someone into innocently opening it. The perfect example is somebody applying for a job. A “job applicant” might send a Dropbox, Google Drive, or OneDrive link to their resume or work sample portfolio in response to an HR posting—but what’s waiting there is ransomware, launched into your organization from the cloud platform. The attack vector has evolved from the file having to physically enter your network to having delivery access from the edge.

When I think about ransomware, I start by thinking about how my users interact with external or even other internal users. Work communications have transcended email and evolved toward dedicated team collaboration tools—sometimes employees even use them just to chat and catch up socially. As a result, we’re now increasingly seeing these tools used as an attack vector.

If an attacker feels like an organization has great email security and all of their users are well-trained to avoid email-based phishing attacks, then what about a link to a Google Drive or Dropbox folder where the payload is located and it doesn’t necessarily have to come through an email? Instead, it can come through Slack or WebEx Teams. The attacker just has to be able to elicit a single click on a link to launch their malware and start the encryption process. Having transparent visibility and policy-based controls in place can help prevent that from happening.

SASE and beyond – Zero trust

With a secure access service edge architecture (SASE) architecture and data loss prevention (DLP) capabilities, I can protect our users inside of what I know—OneDrive or Google Drive, or our corporate Slack channel. The problem is, I don’t know what I don’t know.

Greater mobility, BYOD policies, SaaS applications, and the spike in remote workers have made things even more complicated, especially over the last 18 months. So, I also need visibility and policy-based controls to keep malicious files from being downloaded onto any device that is authorized to have our data.

This is also where zero trust becomes part of the story – or as I like to think of it, continuous adaptive trust. We need to expand full security visibility beyond just data to also have a comprehensive view of users, devices, and applications. This gives us a greater capacity for enforcing granular, role-based controls and reducing the opportunities for threats (including ransomware) to penetrate the network in the first place. The more we know about our expanded network environments, the better we can protect our users, devices, applications, and data from disruption.

This article was originally published by HelpNet Security

author image
Damian Chung
Damian Chung es un responsable de ciberseguridad con más de diez años de experiencia en seguridad centrada en la sanidad. Como responsable de la seguridad de la información de negocio en Netskope, Damian es responsable de supervisar las herramientas y los procesos de seguridad corporativos y actúa como experto en la materia en el sector sanitario. También es profesor adjunto del programa de ciberseguridad de la University of Advancing Technologies en Tempe, Arizona, EEUU.