Zscaler Offers Secure Web Gateway as a Service
by Matt Sarrel
Dashboard
The Zscaler Dashboard greets me after I log in to the administration portal. Traffic amounts overall, traffic by time, traffic by location, traffic by department, and threat information is shown. This screen can be customized. The Favorites drop down in the middle holds my favored reports. Within 5 minutes of logging in I know whats going on.
Data Loss Prevention
I configured Zscaler to watch out for transmission of social security numbers. Then I had a test user attempt to send a Facebook message containing a SSN. Zscaler correctly identified the data leakage condition, alerted me, and logged the incident.
Reporting
Reports are a strong suit of Zscaler. I can quickly find threats and how they attempted to enter my testbed.
URL by Class
Reporting allowed me to quickly see the types of sites accessed by my test users.
Blocked Virus
This not only illustrates that the eicar test virus was blocked, you can also see I was able to customize the notification screen with a logo, contact info, and custom text.
Bandwidth Control
A fascinating feature is the ability to define policies for bandwidth control by application class. Here, “web conferencing” is given full bandwidth but “media/streaming” is limited to 50%.
Streaming Media
Further drilling down into managing the application class “streaming media”, I could set a specific site, in this case last.fm, to be exempt from the rules.
Configuration Reminder
A strong positive feature is the warning that is clearly shown reminding administrators to save and activate changes.
Getting Started
The Getting Started panel walked me through configuring Zscaler security services in about 1.5 hours. I could have done it faster but I wanted to explore and read everything.
First Run
The first time I logged into zscaler I got an eyeful of unpopulated dashboard. I clicked Getting Started in the top right corner and got right to configuration.
Password Controls
I was delighted to see that Zscaler insists on new strong passwords when the admin account is activated.
Email Security
Email security reporting is as straightforward and powerful as Web security reporting. I enjoyed watching the legitimate e-mail vs. spam race over a 24-hour period for my domain. They started off neck and neck, but after business hours the volume of spam tripled.
Spam Report
An extremely helpful feature is the ability to double-click on the spam slice of the pie chart shown in the previous screen shot and have it open up a listing of all spam e-mail. This can be exported to CSV for deeper analysis.