Extended RBI

The Extended RBI offering covers additional risk scenarios which are not included in Targeted RBI, i.e. any web categories and untrusted, unsanctioned, non-corporate cloud apps.

Extended RBI protects the browsing activity and browser for corporate users accessing untrusted, non-corporate cloud apps and websites.

Extended RBI allows admins to leverage additional policy matching criteria including:

Destination

Extended RBI allows admins to create Real Time Protection Policies with the following destinations:

Application – Any “Application” or “Cloud App Suite”

Category – Any “Predefined Categories” or “Custom Categories”

The additional policy criteria are available to use:

Use cases and recommended configurations are described in the sections below.

1- Safely enable web access to unsanctioned cloud apps in a certain web category

Sanctioned apps in these web categories are controlled by CASB controls. Protect endpoint and leverage RBI templates settings to augment data protection capabilities in the isolated session e.g. printing, copy, paste, read-only, uploads, downloads.

2 – Safely enable access to potentially risky apps in a web category, based on CCL

Leverage Netskope’s CCI database to isolate low level confidence apps. e.g. Allow (excellent), Block (poor), Isolate (low CCL). Use RBI as an additional protection and an alternative to block access.

3 – Safely expand access to web pages in a potential risky destination country

RBI Provides additional protection of a user’s privacy because the browser has no context of the user and exposes RBI egress IPs. Actual source IP, endpoint details are not uncovered. This is ideal for research.

4 – Define Fine grain Isolation policies: Isolate specific cloud apps

Ability to go beyond isolation based on category matching, with no need to define exceptions or create custom URL lists for custom categories.

Leverage Netskope’s Cloud App definition to create RBI policies to only isolate your risky app. User browsing is isolated only in the application domain boundaries.

5 – Disable clipboard pasting in unsanctioned apps to reduce data leakage

Disabling clipboard paste in the isolated sessions prevents users from pasting corporate information into these unsanctioned apps. This setting augments Data Protection and does not require activity detection or DLP matching.

6 – Provide Read Only access to personal webmail

Some of the most popular webmail apps are unsanctioned (personal use) apps such as: Gmail, Outlook Live (personal) or Yahoo mail. All of these are not corporate.

Admins can leverage RBI templates to configure policies for certain apps to only allow text input in the login domain. Access to the rest of the webmail app is read-only: