Skybox Security Suite Reviews

We're reselling it and also assisting with installations. It's become more popular in the last few years. Because even though Serbia is relatively small, it has suffered from hacker attacks. We thought we weren't such an important country. So companies are looking for security solutions. And after the basic ones like firewalls and endpoint protection, they're now looking for more. 

For example, robust solutions that bring additional security. And Skybox Security is one of them. It's aimed at larger customers with more assets, like one thousand desktops, servers, and a larger network infrastructure. So, it's a good tool for them to accomplish several things. 

Skybox consists of four modules. One is called Firewall Assurance. The other one is Network Assurance. Then there's Change Management, and the last one is Vulnerability Management. 

So if the company has several firewalls, and probably or potentially firewalls from different producers or manufacturers, they can check all those firewalls together. So at the same time, for several things, like if the policies/rules are made properly and if there are some shadow rules, For example, if there are some rules that have not been used for a long time, Then it can also look for the compliance of the rules or of the configuration of the firewalls in the sense of compliance to some of the standards—security standards, and so on. 

So the customers can manage and check the configuration on several firewalls, especially when there are more than 20 to 30 firewalls, to check if everything is okay with the security of those with the configuration. And the security of those firewalls.

When you import all the assets that you have, like desktops, servers, networks, devices, routers, and then firewalls, and other products, then Skybox makes like, a model of the network, but with context. 

So, it is not just a model in VIZIO. Or something like it like that. You get the model with context, and, like, it looks like a real network in a real-time. So you can check your network and the security of your network on that model. 

After that, Skybox adds vulnerability management of the assets in your network. For example, if you have 3,000 vulnerabilities in your network. You can find those vulnerabilities, but you cannot decide or you don't know which ones are the priority ones. So maybe there are vulnerabilities, but they are behind some firewalls. 

Even though they are serious, you don't have to start with them because there is no access to those assets because of the rules on the firewall. So it is vulnerability prioritization. You get the list of  10 to 20 most serious and most dangerous vulnerabilities, and you also get advice on how to patch them or how to get rid of those vulnerabilities. 

So it's important that you get the model of your network then you can see what assets are available from the outside and what are the parts for those assets. And if you will allow it or not, allow it or not. And then, on the other side, there is this vulnerability prioritization.

So the vulnerability management capability of Skybox really helps in security strategy when you know how to properly use it. 

It cuts your time in order to patch several hundreds of vulnerabilities. You can concentrate on the most important ones. 

We primarily use it for vulnerability path detection and compliance with policies we define.

The revalidation and policy recertifications are most valuable. They are easy to understand in the GUI.

We have been reselling Skybox for probably about five years now, so I'm pretty familiar with it. I've done numerous POCs and I've had hands-on with it quite a bit.

Because I get to work with a bunch of different customers, I get to see just about every use case for Skybox. The first one, which is pretty simple, is auditing firewall rule sets; taking a look at all the configurations that are on the firewalls and ensuring that they're locked down. What we run into a lot of times are firewalls that are set up with excessive permissions, meaning they allow a lot more traffic than they should. Skybox is essential to tearing that down.

Network visibility is another big use case, learning where all the assets are located on the network and how they can talk to each other. 

The last one that I deal with quite a bit is the vulnerability/exposure-monitoring piece. Looking at those vulnerabilities that are on the network, providing the context of network-based mitigation, and then reprioritizing or recasting those vulnerabilities.

Specifically, in the Vulnerability Management piece, vulnerability management products are very noisy and they provide this arbitrary score called the CVSS that rates the criticality of the vulnerability. How bad would it be if somebody were to exploit this vulnerability? That doesn't matter if I have something on the network that prevents that vulnerability from being exploited. What Skybox does is to allow organizations, including three of my largest customers, to reprioritize the vulnerability they attempt to patch and mitigate, based on the contextual awareness of the network.

Also, for the vulnerability, it's the operational efficiency of the patching team. Patch management programs are very expensive to run from a headcount cost, and also from a potential downtime cost, and there is a never-ending stream of vulnerabilities. The ability to contextualize those and recast them in a meaningful way to my organization, and to all my customers, has been very valuable in increasing the efficiency of the patching process.

With the Firewall Assurance, that changes the way applications are introduced into the environment. So instead of asking for firewall rules which may or may not be relevant, or could already be there, or could be over-permissioned, Skybox can be used to map out the resources that that application is going to use and provide the exact rules that an application would require to function correctly. If the traffic isn't able to flow for the application, if it's erring out, Skybox can be used to troubleshoot that and say, "All right, where is the traffic being stopped and why, and how do I fix that."

The primary use cases are to check role compliance and OS vulnerabilities.

The most valuable features are the rule compliance and the OS vulnerability checks.

Primary use case for us is configuration management and configuration compliance.

It's given us more visibility in terms of what are the kinds of configurations that are on these devices, and how many of these are stale rules. So it's helped greatly in terms of cleaning up of rules, for sure. And it has definitely given a more secure way of backing up the configuration on these devices.

In my company, we use Skybox Security Suite as a system for ticketing and compliance.

My company likes Skybox Security Suite as a product. I think that compliance checks and policy compliance are the product's good features.

Our company installs and manages the solution for our clients and we have two primary use cases. 

The most common use case is monitoring the security compliance of firewalls. Every company has a firewall policy that includes rules, what traffic is allowed, which ports are open and more. The solution analyzes each firewall and reports if compliance is not achieved. 

Another use case is importing network devices. The solution builds a map to analyze an entire network including compliance of routers and switches that sit behind the firewall. For example, a banking customer might have network zones such as office, core systems, and ATM cashpoints. Between those, the bank has various policies about what traffic can be open. The solution monitors compliance of the network's configuration against policies. Most UK banks are using the solution for this purpose because it is a unique feature. 

A third use case is change management in relation to firewalls. Companies that monitor their firewalls and network zones's compliance often have change orders. If a user requests a change today but it isn't implemented for a week, some solutions will only pick up a non-compliance issue at the actual time of implementation. This solution includes a change manager module that reviews changes before they are implemented, catches non-compliance issues, and stops implementation until they are corrected. It handles all network assurance including in the cloud. 

The final use case is vulnerability management. The solution is unlike Qualys which scans while it detects vulnerabilities, but it instead imports vulnerabilities and patch statuses from various vendors. This is a very useful tool for companies who may have different vulnerability scanners and patch management solutions because the solution imports everything into one consistent system where it runs vulnerabilities. The solution looks at which systems are most risky to fix those vulnerabilities first. Because of its unique network model, the solution understands possible flows of data in the network and analyzes attack vulnerabilities. 

The solution's most valuable and unique assets are the vulnerability management and change management solutions because they identify mistakes in the network before implementation which reduces risks. There aren't many competitors offering these tools. 

The platform's most valuable feature is reporting. 

There is room for improvement in the product's user interface. It could be more user-friendly.