Most users never change their passwords and use the same password in several applications. When unsanctioned apps are hacked, the compromised accounts in these apps can expose accounts in your sanctioned apps. The Netskope Compromised Credentials dashboard informs you about known compromised credentials for the accounts used by your employees.
You can use the Compromised Credentials page to build awareness around the number of compromised credentials in your company. If you have risk officers, they can use this information to assess the need for SSO and 2-factor authentication in sanctioned cloud apps. Using this feature as input, it is possible to setup a workflow to automate remediation actions such as resetting a user’s AD account. Passwords are never checked. To access the Compromised Credentials page, go to Incidents > Compromised Credentials.
Use the Compromised Credentials page to view:
- Total number of users with compromised credentials. Click the link here to view and edit the domains tracked. This number is the total of domain users + non-domain users.
- Total number of domain users.
- Total number of non-domain users. Click the link here to upload a file with user names.
- User – Compromised user’s email address associated with the Netskope account.
- Matched User – email address associated with the breached access method.
A Matched User email may differ from a User email address. For example, smith@netskope.com is the User email associated with the Netskope account. But smith@netskope.com is the same person as smith@gmail.com or smith@hotmail.com, the Matched User email associated with the breach.
- Edit Email Notification Template – send email to a specific user, selected admins, or all admins for your account. This is not an automated process. You must manually send email notifications using the notification template.
- Detection Settings – allows selecting specific tracked domains and users to match, including the ability to restrict to corporate domains only. To learn more: Detection Settings
You can customize the information shown by clicking +Add Filter and selecting specific types of information, plus switch between all acknowledged compromised credentials or just the unacknowledged ones. Use the filter to view by:
- Access Method – the named user used one of these access methods: Explicit Proxy, Secure Forwarder, Mobile Profile, Client, Reverse Proxy, DPOP inline, TAP, AD Importer, CSV Upload, API Connector, and Log when the breach was detected.
- Source of info.
- Application
- Activity – the activity the user performed that triggered the compromised credential detection
- Incident ID – compromised credential ID
- Activity
- Date compromised – choices include: Before this Date, After this Date, On this Date, and Custom Range NOTE: This is an optional field. If the date field shows “Not Available” this means the exact compromised date is unknown. However, the Timestamp column shows the date the compromised account was detected by the system.
- Timestamp – detected date
Click a user’s email address to go to the Skope IT page for more details. To export the Compromised Credentials page information to a spreadsheet, click Export and choose the desired options. To remove one or more of the compromised credentials, enable the checkbox next to an item and click Acknowledge, or click Acknowledge All.
Edit Email Notification Template
Clicking the link on the Compromised Credentials list page opens the template. You can send an email to a specific user, selected admins, or all admins for your account. This is not an automated process. You’re manually sending email notifications using this notification template.
This allows granular control for admins to explicitly define recipients of this email notification versus an entire admin group.
In addition, admins can add the following variables to the email for more clarity:
- Compromised Credential
- User
- Source of breach info
- Detail description – this description is also visible in Skope IT > Alerts > Alerts Details (as shown below)
- Date compromised
- Date detected
Select the ‘Selected Admins‘ radio button and click in the Admin = text box to view a list of users that are designated as account admins. Select the checkbox next to their emails to add them to your sender’s list.
To send an email notification, navigate to the list page and click the ellipses (#1 in the image below) at the end of the user’s row and click ‘Send an email notification‘ (#2 in the image below). The email sends immediately.
If the email is sent successfully, you’ll see the following notification at the top of the Compromised Credentials list page.
In addition, you can check Settings > Administration > Audit Log to view the activity.
Detection Settings
Detection Settings allows admins to select specific tracked domains and users to match, including the ability to restrict to corporate domains only. Use this configuration to limit credential matching to your choice of corporate domains and specified corporate users.
Click Detection Settings to open the following window. Toggle the radio button to enable Restrict detection to requested domains only. The detection will only match to end-users with the requested domains.
Add your comma-separated domains for compromised credential detection. Add domains that are owned by your corporation. For example, Netskope lists netskope.com, etc.
Click the Users tab to add users for compromised credential detection. You can import from CSV, export the user list, or delete all. The max size is 8MB.
