Skyhigh Security Cloud 6.7.2 Release Notes (Sep 2024)

Enhanced Proximity Condition in Classifications 

1. The proximity condition in the Classification editor (found under DLP Policies > Classifications > Create/Edit Classification > Conditions > Select Criteria > Proximity) now includes a new option named Match Criteria Settings.
   
   
    
2. Use the Match Criteria Settings option to configure the settings and view an example of the match criteria for your proximity rule. 
   1. Select Match Criteria. Enables you to define the settings for the match criteria to trigger unique and non-unique proximity matches.
      
      
       
   2. Example of Match Criteria. Displays a real-time example of proximity matches, updated based on the settings selected in the Select Match Criteria cloud card. For details, see Create a Classification using Proximity.
      
      
       

Security Operations Center (SOC) administrators can leverage this setting to control how match strings are paired between the criteria of the proximity rule for unique or non-unique proximity matches. It enables them to define proximity classifications with flexible match criteria, including keyword validation. Organizations can use the improved proximity condition to migrate their DLP policies with proximity conditions from data identifiers to classifications quickly and easily. It also helps to increase confidence, reduce false positives, and enhance operational efficiency in data classification.  

View Classification and Sanctioned DLP Policy Events in the Audit Log 

1. The Audit Log page (found under Settings > Audit Log) now provides visibility into DLP events for classifications (advanced pattern and dictionary) and sanctioned DLP policies. 
2. Use the DLP Classifications and CASB DLP Policy event categories to track DLP events, such as the creation, modification, and deletion of advanced patterns, dictionaries, and sanctioned DLP policies by users within your organization. 
3. View details about the DLP events for advanced patterns, dictionaries, and sanctioned DLP policies based on the selected event type:
   1. DLP Classification Events
      • Classification Advanced Pattern created 
      • Classification Advanced Pattern deleted 
      • Classification Advanced Pattern updated 
      • Classification Dictionary created 
      • Classification Dictionary deleted 
      • Classification Dictionary updated
        
        
         
   2. Sanctioned DLP Policy Events
      • Assigned jurisdiction to CASB DLP Policy
      • CASB DLP Policy Rule or Exception Group updated
      • CASB DLP Policy activated
      • CASB DLP Policy created
      • CASB DLP Policy de-activated
      • CASB DLP Policy deleted
      • CASB DLP Policy exported
      • CASB DLP Policy updated
      • DLP Dictionary created
      • DLP Dictionary deleted
      • DLP Dictionary updated
        
        
         

Security Operations Center (SOC) analysts can gain insights into the DLP events for advanced patterns, dictionaries, and sanctioned DLP policies to identify the users that trigger DLP events and track the changes in classifications and sanctioned DLP policies that impact their DLP policies. It helps SOC administrators identify and investigate any unauthorized or malicious activity related to classification and policy management. These capabilities enable SOC admins to improve their organization's data protection strategy, reduce the risk of data exfiltration, and maintain regulatory compliance. 

Additional DLP Improvements 

ML Auto Classifiers 

1. The Classifications page (found under Policy > DLP Policies > Classifications > Create Classification > Conditions > ML Auto Classifier) now includes ML Auto Classifiers to automatically detect and classify various types of sensitive files in sanctioned and shadow/web services.
   
   
    
2. It displays the matches triggered by various ML Auto Classifiers and their confidence percentage on the Sanctioned DLP Policy Incident Cloud Card.
   
   
    
3. ML Auto Classifiers simplify the process of identifying and categorizing sensitive data by providing the following benefits. For details, see ML Auto Classifiers.

Enhanced Visibility for Sanctioned DLP Incidents 

Skyhigh now provides a focused view and a preferred view for easy and quick visibility into all relevant sanctioned DLP policy incidents within your organization. 

End User Notification Page - Coaching Page Support   

The Coaching page deployment now supports templates created through the End User Notification page feature. You can apply templates designed with the End User Notification page feature to the Coaching page. Additionally, templates customized via the UI template builder on the End User Notification page can be utilized while working with the Coaching page. To configure the coaching page, clone the coaching activation template from the Skyhigh Default tab and make modifications as required. For more details, see End User Notification Page - Coaching Page Support.

Support for Custom Trusted Certificate  

Skyhigh Web Gateway previously used a self-signed certificate from Skyhigh to block messages on sites in the SSL Bypass List. Still, it will now use a certificate from a customer-configured HTTPS Connection feature for these messages. This change addresses issues such as certificate errors encountered with websites that fail to recognize the Skyhigh-signed certificates. For SSL decryption, you now need to select the HTTPS Connection feature configuration, specifically Customer_CA in this case. For more details, see Support for Custom Trusted Certificate. 

Review Changes before publish - Iterative Enhancements 

This installment of iterative enhancements offers comprehensive visibility into user modifications. Instead of a generic Modified label, you now get detailed views of all changes, including additions, deletions, and modifications. For more details, see Review Changes before publish - Iterative Enhancements. 

Detailed Insights via Expandable Side Panel 

Skyhigh Web Gateway supports a side panel for Web Users, Web Traffic, Web Malware, and Isolated Site pages. Click on a row to open a side panel displaying details for all fields, including events, traffic, and usage trends. The panel is expandable and collapsible, ensuring a user-friendly experience even with many fields. For more details, see Detailed Insights via Expandable Side Panel.

Progress Bar and Ruleset Reference Checks 

Skyhigh Web Gateway includes a progress bar for deleting lists and feature configurations. When deleting a list, the system checks for references in rulesets to prevent disruptions in policy execution. The progress bar shows the status while the system searches for these references. A list can only be deleted if it is not referenced in any ruleset. For more details, see Progress Bar and Ruleset Reference Checks. 

Rule Trace Enhancements 

Rule tracing facilitates the tracking of the path taken when evaluating a policy for a user, as well as the rule or ruleset that was assessed to determine whether to allow or block a request. You can obtain the logs through rule tracing and view the path that the traffic traversed in the web policy tree. You can then use the rule tracing logs for troubleshooting. The Rule Tracing page now displays details including Username, Smartmatch Filter, Region, Session ID, and Timestamp. Contact Skyhigh Support for more information. 

Control Parameters in Policy UI for Streamlined Policy Management 

RBI capabilities previously available only through policy code are now included in the policy UI. New options allow administrators to enable read-only websites, disable the RBI password manager for login sites, and block web page printing. These features provide administrative control ensuring threat protection during full and remote isolated sessions. For more details, see Control Parameters in Policy UI for Streamlined Policy Management. 

Secure App Connector V2 Stickiness  

In a scenario with multiple connectors in a group, enabling this UI toggle ensures that traffic is routed through a randomly selected connector, maintaining consistent user session routing. For more details see, Add Applications. 

Extending Network Level Access to Support UDP-Based Applications  

Private Access now extends support to relevant use cases fulfilled by traditional VPNs using Network Level Access (NLA) by securely opening the network like a VPN but based on zero trust principles for UDP-based applications. NLA supports network types such as subnet, IP, and domain wildcards in addition to domains, enabling easy migration from legacy VPNs.  For more details see, Add Applications. 

New Artificial Intelligence Risk Tab on the Cloud Registry 

A new Artificial Intelligence risk tab is introduced in the Cloud Registry to capture AI-related risks of a cloud service. All the LLM risk attributes are now captured under the Artificial Intelligence risk tab. For details, see the LLM Risk Attributes for AI Category Services.

Skyhigh Domain Unification to Support Chrome/Edge Browsers 

Skyhigh Security unified different domains operating under the Skyhigh console (Dashboard) to a single domain, named skyhigh.cloud to mitigate the ability of websites to misuse the cross-site tracking. Implementing this change will seamlessly enhance the user experience with the product on the Chrome/Edge browser.

After unifying to a single domain, when you use the Skyhigh console, you will be directed to the domains under skyhigh.cloud instead of myshn.net or myshn.eu. Now, all the components in the Skyhigh console work under a single domain, the skyhigh.cloud.

To know more information on domain unification, see Skyhigh Domain Unification to Support Chrome/Edge Browsers.