Maybe it’s my inner Peter Lynch, or perhaps just intellectual curiosity, but I like to understand what a company in which I’m thinking of investing does, and the why and how. If there are any ZScaler experts out there, I’d like corrections, reinforcement, or constructive feedback of any kind to this:
I think the elevator pitch for ZScaler is something like: “Since many enterprise applications are now hosted in the cloud, use of those applications by-passes much of traditional security practices. ZScaler will look at all your internet traffic to be sure it’s legit and clean, without installation of any hardware.”
Perhaps one example is people using GMail. When an employee connects to GMail, an https, or SSL, connection is established. That means the traffic between that employee and GMail is encrypted. The employee could mistakenly download viruses, supply credentials to bad actors, etc., without the enterprise knowing, much less being able to prevent. In the past, some companies blocked access to sites like Facebook or YouTube or GMail, but as soon as the employee took that laptop home, he could access them since he wasn’t on the corporate network. ZScaler addresses this.
One of the way in which ZScaler operates is by becoming a Man in the Middle (aka, MiTM). The employee’s computer (owned and setup by the company) sends data not to GMail or Salesforce or Facebook or Concur, but to ZScaler. ZScaler looks at the data, then sends it on to the proper destination if it’s clean. When that application responds, ZScaler gets the response, then sends it to the employee’s computer if it’s clean. Military people in sensitive locations who have had their paper correspondence examined and censored know the principle.
The internet literate among you may now be wondering how ZScaler can do this. After, we’re trained to believe that when our browser shows the lock symbol, our traffic is encrypted and private. The answer is that the employee’s computer is owned and setup by the company, and part of that setup is installing what’s know as a PAC file (Proxy Access Configuration) into the employee’s browsers. This is what redirects browser traffic to ZScaler. The ZScaler site certificate is also installed as trusted on the computer, so browsers won’t complain to the user about the redirection. You can read the gory details here: https://help.zscaler.com/zia/what-pac-file and here: https://help.zscaler.com/zia/how-do-i-deploy-ssl-inspection
In essence, the employee’s browser is establishing a secure connection to ZScaler’s servers and then ZScaler is establishing a second secure connection to the actual site the employee wanted. So while your broswer URL line might say: “https:www.facebook.com,” it’s not actually going directly there. The green lock icon is shown because where it is going (ZScaler) supplies a certificate that the browser trusts. I don’t know for sure, but I suspect that if your computer is configured to use ZScaler, you could click on the lock icon to look at the actual certificate being trusted, and it would be a ZScaler cert, not a Facebook cert. If someone is using ZScaler I’d appreciate it if they’d try this out and report back.
The same thing can be done on employee smartphones, but ZScaler also has an app (https://help.zscaler.com/z-app/what-zscaler-app ). Installing the app also installs the ZScaler cert. The end result is that all traffic, even non-broswer traffic, goes to ZScaler. Yes, even Angry Birds.
Note that traffic goes to ZScaler even if the computer/phone is not on the corporate network. To me, this raises privacy concerns. Say your corporate email is Outlook 365 and you use use, say, GMail for your private correspondence. On a ZScaler configured device even that GMail traffic would go to ZScaler for vetting even when you’re not doing company business. Now, I think that’s OK for a company-supplied computer (at least if the company tells you), but if the company is requiring you to use ZScaler on your personal phone in order to gain corporate data access, then even your private conversations on your private device are going to some third party.
In addition to user privacy concerns, there is also the potential that ZScaler itself gets hacked, in which case all corporate and personal data going through it might be exposed to bad actors, despite use of SSL. A data breach at ZScaler might have a larger impact as recent breaches at Equifax since it’s not just ID info, but actual corporate (or private) data. There have been some security issues with ZScaler in the past (for instance see https://securityaffairs.co/wordpress/56776/hacking/zscaler-c… ), but I haven’t seen anything too serious yet. There is also a potential for ZScaler to suffer from DoS (Denial of Service) or similar attacks, as well as the ZScaler service itself going down, in which all all corporate traffic is log jammed. Finally, there has to be a performance hit, since all traffic is encrypted and decrypted twice, plus whatever time it takes ZScaler to perform its filtering.
Anyway, since all data goes through ZScaler’s servers, ZScaler can do any kind of threat detection or filtering it wants, and can add/subtract those features without changing anything on corporate devices (once initial setup is complete). So, ZScaler has a good business model for creating new value-added services for which they can charge additional fees, and of course, ZScaler can charge based on actual usage, and lock-in would appear to be really high since to change away a company would have to reconfigure literally every employee’s computer and phone. Seems like a good business model to me. The main risk I see right now is that ZScaler gets hacked or does an internal update that causes it to have problems providing its service.
If anything above is wrong or mis-characterized, I’d sure like to hear about it. TIA.