Create a Plugin Access Control Policy

1. Log in to Strata Cloud Manager.
2. Select ConfigurationSaaS SecurityPosture SecuritySecurity ConfigurationPolicies.
3. Add Policy Plugin Access Control Policy.

   A Policy Creation page for a plugin access control policy opens.
4. On the Basic Information tab, specify the following information about your policy:

   • The Name of the policy. This name will appear in the list of policy rules on the Policies tab of the Security Configurations page. For this reason, specify a meaningful name that will be distinguishable from the other policy rules in the list.
   • A Description of the policy. After you create the policy, this description will appear on the details page for the policy. Describe the purpose of the policy for administrators who might be viewing the policy later.
5. Go to the Next tab of the Policy Creation page to identify the plugins to be affected by the policy.
6. On the Plugins tab, select one or more of the third-party plugins in the table.

   These are the third-party plugins that you don’t want to allow in your environment. When the policy is enabled, SSPM will scan the marketplace apps at regular intervals to determine if the selected third-party plugins are installed.

   To identify high-risk plugins, examine the information in the Severity and Risk columns of the table. The Severity is based on the marketplace app's scopes that were granted to the third-party plugin. The greater the access to the marketplace app's data and actions, the higher the Severity. The Risk column shows the application's risk score. The risk score is between 1 (low risk) and 5 (high risk) and is calculated from over 55 application attributes including compliance attributes, security and privacy attributes, identity access management attributes, and, if applicable, GenAI attributes.

   To help you locate the third-party plugins you want to add to the policy, you can Add Filter to the table. You can filter the table by third-party plugin attributes such as the application name, marketplace, and severity.
7. Go to the Next tab of the Policy Creation page to configure the policy actions.
8. On the Policy Actions tab, select one or more actions.

   These are the actions that you want SSPM to take when it detects a third-party plugin identified in the policy. The action will apply to all selected third-party plugins for a particular marketplace. Depending on the marketplace app and other factors, the following actions are available:

   • Revoke / Block: Depending on the permission level that SSPM has to the marketplace app, and on the capabilities that the marketplace app's API provides, SSPM can automatically revoke user access to the plugin. The Policy Actions page indicates whether this action is available for the marketplace. If the Revoke / Block action isn’t available, you can instead log in to the marketplace app's administration console, and follow its documentation to remove the plugin.
   • Ticket: If you're using the Jira or ServiceNow issue tracking system to manage your team's tasks, SSPM can create a ticket in the issue tracking system about the plugins that need to have their access revoked. Based on the information in the ticket, you can revoke user access to the plugin. You can revoke access to the plugin either from the 3rd Party Plugins page (if supported by the marketplace app), or from the marketplace app's administration console. To configure SSPM for ticket creation, you must have linked SSPM to a Jira or ServiceNow instance. From the Configure Ticketing area, you can select the issue tracking system and specify information such as the type and instance of the issue tracking system, and the type of ticket to create.
   • Notify: SSPM can send information about the plugins that need to have their access revoked to an email address. If you have configured webhooks in SSPM to send notifications to a channel in Slack or Microsoft Teams, SSPM can also send notifications to one of those webhooks. Based on the information in the notification, you can revoke user access to the plugin. You can revoke access to the plugin either from the 3rd Party Plugins page (if supported by the marketplace app), or from the marketplace app's administration console. SSPM sends the email notifications to the email address of the user who created the plugin access control policy. SSPM sends webhook notifications to the webhook you select in the Configure Notification area.
9. Go to the Next tab of the Policy Creation page to view a summary of the policy.
10. Review the information on the Summary page to verify that the information is correct. If necessary, you can Edit the information.

    By default, SSPM enables the policy rule by default, which means the SSPM will scan the marketplace apps at regular intervals to determine if any of the third-party plugins that you identified are installed. If any are installed, SSPM will perform the actions you specified. If you don’t want to enable the policy at this time, position the Enable Policy toggle to the off position.

    When you're sure that this is the policy that you want to create, Save the policy.
11. After you have reviewed the information on the Summary page and are sure that this is the policy that you want to create, Save the policy.