Zscaler manages the largest secure cloud gateway on the planet, with a presence in 55 private and 45 public data centers around the globe and over 10 million users in 160 countries. The company processes over 12 billion inbound and outbound transactions a day for its customers, so the service is obviously built to scale.
Administrators configure policy through a Web portal, then push it throughout the Zscaler network. Real-time reporting provides instant and continuous visibility into user behavior and the threats that the corporate network and endpoints are facing.
After logging in, the first task I was guided to complete was to configure user authentication. Users can be authenticated using SAML for those of you implementing single sign-on. In my testing I authenticated against Microsoft Active Directory. I could have chosen LDAP or a simple hosted database of user ID and password. I configured Zscaler to require authentication and to display the acceptable usage policy. I easily customized the acceptable usage policy with my own text and logo.
I pushed a proxy auto-config (PAC) file to each test workstation that forced all network traffic to flow through Zscaler where traffic inspection takes place and security rules are applied. The best part of using a PAC file for endpoint configuration is that users won’t even notice a change in their browsing and email experience. The PAC file also forces the user’s device to proxy all traffic through the Zscaler network. Administrators can also choose to protect entire networks using site-to-site IPsec VPNs.
Zscaler protects Windows, Mac, Linux and mobile platforms such as iPhone, iPad and Android against threats by scanning incoming and outgoing traffic from websites, social apps, cloud apps and email.
I attempted to access all of the security features offered by Zscaler throughout my testing – not an easy task given the comprehensiveness of the security service. I created and enforced Facebook and Twitter policies that prevented test users from sharing business critical information via those social networks.
I took this a step further and established DLP policies to prevent transmission of social security and credit card numbers via social networks, websites, email and webmail. I defined authorized app stores and defined acceptable apps for mobile platforms. (No, you may not install that game that accesses the company contact list.)
For larger IT organizations, administrators get full role-based access control that provides varying degrees of configuring policy and viewing reports. I easily masked user names to maintain confidentiality within the administrative interface.
Perhaps most important, all administrative tasks are logged by task, time and IP address. A comprehensive set of reports is accessible directly via the administrative Web portal, and it’s also possible to configure alerts and stream directly into management software like ArcSight or Splunk.
Zscaler stands apart from the competition when it comes to the quality and quantity of help and technical support provided for administrators. There were so many tutorials to watch, I didn’t even attempt to get through them all. They range in topic from basic security concepts to down and dirty configuration options. Each setting in the administrative portal has detailed help, many times including a video demonstration. This excellent help and support make the intricate service easy and quick to implement and administer.
Zscaler should be on your short list if you are evaluating secure cloud gateways.
