Internet security moves to the cloud

Network World - FRAMINGHAM — A start-up that dishes up an in-the-cloud security service says it also eliminates capital outlay for security gear and reduces ongoing support costs.

Zscaler imposes security policy as defined by customers and logs security activity for reporting and forensic analysis by customers. The service provides antivirus and antispyware and can block the activity of bots, peer-to-peer networks, malicious content and phishing, the company said.

The service applies policies only to outbound Internet traffic on the fly and can eliminate the need for multiple single-function devices at the edge of corporate networks, says the company's founder, Jay Chaudhry. He is also the founder of Cipher Trust (now part of Secure Computing), AirDefense (now part of Motorola) and SecureIT (now part of VeriSign).

Customers proxy outbound Internet traffic to the nearest Zscaler gateway, where it is scanned and cleaned, Chaudhry says.

The Weather Channel has tested the service and may sign up for it within the month, says John Penrod, CISO for the TV network. He says he is being cautious about how the service affects performance as perceived by users, but so far he has seen latency of less than 1 second imposed on traffic filtered by Zscaler.

The company claims that its screening is 40 times faster than individual products that would perform the same functions.

Penrod says the reporting platform was not complete when he started testing the service, and he plans to delve into that this month.

He says he was looking for something to filter instant messaging, spam and phishing and had considered buying a secure Web gateway from Blue Coat. (Compare secure Web gateways.) But he says that the initial cost of the appliance plus administration and maintenance for five years would cost more than the service. The Weather Channel has a total of about 800 users at six sites.

To engage the service, customers point traffic that goes through edge devices such as firewalls and routers toward Zscaler gateways. For remote-access users, they change browser settings to direct traffic at the gateways.

Currently these gateways are located in Atlanta, Chicago, New York and Washington, with a central storage facility in San Jose and a mirror site in Fremont, Calif.

Other gateways are planned for elsewhere in the U.S. and Europe, Chaudhry says. The deployment follows the model of Akamai's media worldwide distribution network, he says.

Zscaler relies on two other unnamed vendors for its signature-based antivirus software and its URL database, but the rest of its technology is home-grown.

That includes a high-performance proxy engine, a software architecture that allows a single instance of security applications that can handle multiple users' traffic, compression technology that reduces logs by fiftyfold, and a global network.

Reprinted with permission from

For more information about enterprise networking, go to NetworkWorld.com
Story copyright 2009 Network World, Inc. All rights reserved.