私がなぜZscalerに？
•Descargar como PPTX, PDF•
4 recomendaciones•6,972 vistas
Zscalerの凄さを知ってしまったので皆さんに共有したいと思います。クラウド時代に必要なセキュリティの実装方式、アーキテクチャ、インフラの将来像を見せてくれるベンダーです。
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a 私がなぜZscalerに？
Similar a 私がなぜZscalerに？ (20)
私がなぜZscalerに？
- 2. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION2 Securing your cloud transformation >>>自己紹介 ☑ ITセキュリティ業界で 18 年の経験 ☑ ネットワークセキュリティ ☑ データセキュリティ ☑ ウェブセキュリティ ☑ サイバーセキュリティ ☑ ネットワークセキュリティ ☑ DBSC DB暗号化WG/DB内部不正対策WG リーダ経験、各ガイドライン公開中（経産省HP） 趣味：居合道、衝動買い
- 3. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION3 Securing your cloud transformation WHAT I KNEW ABOUT “Z” Zについて知っていたこと
- 4. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION4 Securing your cloud transformation v.s. in SWG/ZTNA Market ?
- 5. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION5 Securing your cloud transformation COMMON SOLUTION 共通するソリューション
- 6. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION6 Securing your cloud transformation クラウド時代で企業が直面する課題 NotPetya クラウドが新しい 業務基盤 バックホール通信 Branch: MPLS / Mobile: VPN 低いユーザ生産性 効率的な通信 Direct-to-Cloud MPLS バックホール費 用 潜在的 セキュリティリスク にも関わらず セキュリティは オンプレ？
- 7. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION7 Securing your cloud transformation 機能比較 提供する機能 Symantec Zscaler URLフィルタリング ○ ○ ファイルタイプの制御 ○ ○ SSL可視化 ○ ○ アンチウイルス ○ ○ ホワイトリスティング ○ ○ サンドボックス（静的） ○ ○ サンドボックス（動的） ○ ○ 無害化 ○ ○ クラウドアプリの可視化 ○ ○ モバイルデバイス対応 ○ ○ DLP（情報漏えい対策） ○ ○ 帯域制御 ○ ○ SDP（Software Defined Perimiter） ○ ○ SIEM連携 ○ ○ CASB連携 ○ ○ EDR連携 ○ ○ ?
- 8. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION8 Securing your cloud transformation DIFFERENCIATION OF “Z” Zの知られざる凄さについて
- 9. 9 Securing your cloud transformation 100% クラウドありきの アーキテクチャ
- 10. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION10 Securing your cloud transformation 従来の多層防御 DLP LB AV IPS NGFW DNS Sanbox VM VM VM VM VM VM VM VM それぞれが分析・ポリシー実行・ログ書き込みを実行する非効率さ VMで動かしても クラウドで個別に動かしても 結果は同じ SSL C E L C E L C E L C E L C E L C E L C E L C E L
- 11. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION11 Securing your cloud transformation Zscaler = Zenith Scalability（天井知らずの拡張性） C E L >150ノード 脅威インテリジェンス ポリシー管理 全パケットの インライン高速処理 ログの匿名化圧縮および 指定パス送信 CENTRAL AUTHORITY ZSCALER ENFORCEMENT NODE NANOLOG
- 12. 12 Securing your cloud transformation Denver Toronto New York Paris London Amsterdam Brussels Stockholm Moscow Mumbai Singapore SydneyCape Town Madrid Riyadh Johannesburg Atlanta Dallas Frankfurt Sao Paulo Lagos Kuala Lumpur Tel Aviv Washington DC Chicago Los Angeles Copenhagen Melbourne Milan Hong Kong Taipei Zurich Chennai Tianjin Tokyo Doha Dubai Abu Dhabi Miami Jeddah Al Khobar Warsaw Seattle Oslo Shanghai SASE要件でもある「グローバル対応」は業界No.1 2: https://www.peeringdb.com1: https://www.zscaler.com/threatlabz/global-internet-threats-insights リクエスト処理数/日 600億+ ブロックした脅威/日 10億+ 12万+ セキュリティ情報更新/日6大陸にまたがるデータセンター展開 100 2Tb ピアリング キャパシティ O365を含む 主要CSPとの ピアリング zScalerのプラットフォームは世界のグローバル企業にご活用いただいています。
- 13. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION13 Securing your cloud transformation パケットの処理が違う ・各レイヤでキュー ・処理待ち ・CPU負担高い 10ms
- 14. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION14 Securing your cloud transformation パケットの処理が違う ・キューなし ・処理待ちなし ・CPU負担極小 0.1ms
- 15. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION15 Securing your cloud transformation セキュリティスキャンも速い . . . Data Packet Proxy Antivirus Sandbox DLP
- 16. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION16 Securing your cloud transformation セキュリティスキャンも速い IPヘッダ 除去 プロキシ処理 パケット 一度に 並列セキュリティ処理を完了 SSMATM （Single Scan Multiple Analysis）
- 17. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION17 Securing your cloud transformation サンドボックスも凄い 某Sandbox クラウド上の SSL復号 ＋サンドボックス機能で オンプレサンドボックス 不要に 某Sandbox
- 18. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION18 Securing your cloud transformation ログの肥大化を防ぐ技術 平文でのログ出力 重複排除 匿名化 圧縮 1/50ログサイズ： NanologTM
- 19. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION19 Securing your cloud transformation 上り下りでキッチリ帯域制御ができる Office 365 guaranteed 40% YouTube capped at 30% Youtubeの上限を 30％に絞りたい！ O365通信用に常時 40％保証したい！ ユーザ・アプリ・場所・時間ごとに帯域制御ポリシーを適用可能
- 20. 20 Securing your cloud transformation ByteScanTM Page Risk IndexTM Nanolog SSMATM PolicyNowTM 最先端のセキュリティ技術を搭載 ユーザの場所に合わせた セキュリティポリシーの施行 μ秒でのコンテンツスキャンを可能 にする並列セキュリティスキャン 各オブジェクトの動的なリスク分析 1/50にログを圧縮・暗号化および 高速レポート処理 パケットをByte単位でスキャン することで隠れた脅威を検出 THE ZSCALER CLOUD Enforce Log Control USA EU Private 100+ data centers across 5 continents
- 21. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION21 Securing your cloud transformation MPLS WAN Broadband4G/5G Satellite モバイル IaaS & PrivateInternetSaaS インターネット環境 および拠点 管理外 企業管理 本社 DCAgent SD-WAN (GRE/IPsec tunnels)通信のハンドリング Zscalerのプラットフォームサービス Zscaler Internet Access (ZIA) インラインですべての通信を保護 Zscaler Private Access (ZPA) 安全なユーザを内部アプリへ接続 あらゆる場所、ネットワークからでも ユーザとアプリを繋げるアクセスポリシーを提供
- 22. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION22 Securing your cloud transformation London Hong Kong OUTBOUND INBOUND DLP URL Filter Antivirus SSL Sandbox DNS Out. NGFW LB New York GSLB DDoS VPN Ext. NGFW LB In. NGFW In. LB ZIA eliminates outbound gateways SWG (Protect Users) VPN Server Protection ZPA eliminates VPN gateways WAF / VDI Ext. NGFW LB In. NGFW In. LB GSLB DDoS Apps/ServersUsers What we eliminate DC / Regional Hubs London Hong Kong zScalerでシンプルに OUTBOUND INBOUND DLP URL Filter Antivirus SSL Sandbox DNS Out. NGFW LB GSLB DDoS VPN Ext. NGFW LB In. NGFW In. LB ZIA で外向けゲートウェイを削減 New York SWG (Protect Users) VPN Server Protection ZPAでVPNゲートウェイを削減 WAF / VDI Ext. NGFW LB In. NGFW In. LB GSLB DDoS Apps/ServersUsers データセンター・拠点の 設備および運用削減 すべてのユーザにセキュアな ローカルブレイクアウトを zScalerで生産的に Global Network Remote Access (VPN) Branch Regional office CLOUD / INTERNET ファイアウォールの設置を 300以上の拠点で削減
- 23. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION23 Zscaler: クラウド時代のセキュアなITインフ ラ RELIABLE.FAST. SECURE. あらゆる場所、ネットワークからでも ユーザとアプリを繋げるアクセスポリシーを提供 100+data centers across 6 continents 60B+transactions processed daily 300of the Forbes Global 2000 Nasdaq: ZS マーケット リーダー グローバル 展開 信頼できる キャパシティ
- 24. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION24 Securing your cloud transformation グローバル企業を支えるzScaler ユーザ数実績 1.3 M 400 K 200 K 120 k Office 365 月次通信量 83 TB 60 TB 44 TB 35 TB グローバルレベルの 保護実績 185 150 113 70 拠点数実績 11,00 0 1,20 0 30,00 0 1,500 すべての通信 – すべてのユーザ – すべてのアクセス場所
- 25. 25 Securing your cloud transformation クラウドプラットフォーム移行の3ステップ 100,000 ユーザ / 85 カ国 80,000 ユーザ / 48 カ国 SECURE 上位セキュリティの配備 Zscalerをネクストホップに指定 –この段階ではオンプレに変更なし Cloud SIMPLIFY 多層防御製品の撤去 オンプレのアプライアンスを削減 -コストと遅延をなくしていく Cloud ローカルブレイクアウトを実現 (SD-WAN) ユーザの生産性向上/ ネットワーク設備排除 TRANSFORM ローカルブレイクアウト Cloud
- 26. 26 Securing your cloud transformation Why Securing your cloud transformation SSMATM を始めとした通信遅延を最小化するアーキテクチャで 場所を問わず快適なアクセス環境を可能に FAST. SECURE. RELIABLE. リアルタイムリスク分析 PageRiskTM を始めとした技術で ゼロトラストに基づくポリシー制御を提供 グローバルなプラットフォーム提供で大企業の新しいインフラに 選ばれたマーケットリーダーとしての実績
- 27. 27 Securing your cloud transformation データセンター ＆ハードウェア 業務 アプリケーション ネットワーク セキュリティ 「大変革」が 起こる時 新たなリーダーが 誕生する Securing your cloud transformation M e g a S h I f t
- 28. 28 Securing your cloud transformation Appendix | SASEへの展開
- 29. ©2019 Zscaler, Inc. All rights reserved. ZSCALER CONFIDENTIAL INFORMATION29 Securing your cloud transformation SASE評価項目（Gartner) お客様想定競合社製品 SASE機能網羅性 18/24 SASEポリシー施行ポイント エージェント、クラウド、SD-WANデバイス SASEポリシー管理 クラウド アーキテクチャ クラウド・ネイティブ、SSMEによる低遅延高速分析手法の提供 オンプレミス側CPE対応 Velocloud, Shilberpeak他主要SD-WAN連携 プライベート/マルチテナント マルチテナント POPロケーションとピアリング 6大陸100拠点、主要CSPとのピアリング IaaSコンピューティング採用 100％クラウドネイティブなアーキテクチャ SSL通信のスケーラブルな可視化 ◎ （ByteScan） シングルパスでのマルチスキャン ◎（SSMA） 地域要件（GDPR等）に応じた通信制御 ◎（EU専用Nanologサーバ） IoT/ECPの対応 ブラウザ対応 脅威の検知 サンドボックス、リアルタイムのリスク分析、無害化 機密情報の検出 ◎（EDM） プライバシーの保護 ◎（各コンプライアンスDLPポリシー） エージェントのマルチデバイス対応 ◎ BYOD対応 ◎ 全ユーザの詳細ログ情報管理キャパシティ ◎（NanoLog） ふるまいリスクの検出 ◎（UEBAベンダ連携） Role-based管理コンソール ◎ ライセンス体型（SD-WAN/SECaaS） SD-WANは個別
- 30. Securing your cloud transformation Thank You ありがとうございました
Notas del editor
- Thanks and confirm time
- Apps are leaving the data center and moving to the cloud as orgs are getting out of the DC and file storage business. Yet, we continue to backhaul internet-bound traffic from branches to the data center to go out and hairpin back. It’s even worse if you’re a mobile user - you bring a user on the network, from wherever they’re connecting only to go out again. I’ve yet to meet anyone that likes VPN. It’s a poor user experience and you’re paying to backhaul traffic in two directions. It will only get worse at Internet traffic continues to grow – apps like Office 365. The natural path is to go direct – and with 5G around the corner more traffic will go direct. But security is sitting in the DC, protecting the network. Leaving you exposed. Once a user gets infected and they’re on the network – branch or remote, everyone is at risk….NotPetya exploited this and quickly infected other users on the network.
- Our cloud is deployed in 100 data centers across 6 continents to bring security close to the user for a fast experience. Nestle, Siemens, and GE have users connecting to all of our datacenters around the world. Employees in London, connect in London. When the same employee is in NY, they connect to the NY data center. We peer with all leading content and service providers, including Office 365, Azure, AWS, Box and Salesforce. This helps you get the fastest performance because our data center sitting in Chicago and New York are peered with the content, giving you fastest connection from our cloud. The DCs in yellow peer with Office 365. We have over 2Tbs of peering capacity today and are aggressively expanding. The cloud processes over 60B transactions every day. We block over 100M threats each day. And do over 120,000 unique security updates every day. Imagine trying to do this with appliances. We have over 40 threat feeds updating our cloud and every time a identify a new threat, we block it everywhere. We made sure that our cloud is very secure. Our cloud is the first security cloud platform for both ZIA and ZPA to receive FedRamp certification.
- We essentially flipped the security model and built a cloud security platform that securely connects a user to app, independent of where the app is located – whether it’s a SaaS app, or internal app in AWS, Azure or the DC. And independent of the underlying network and device. For sites that still have a lot of traffic destined for apps in the DC, you should continue to use MPLS, but breakout out Internet traffic locally – a hybrid branch. For sites that don’t have a lot of traffic going to the DC, you can route all traffic to Zscaler. For HQ and branches, you route traffic to Zscaler over IPSec and GRE tunnels – this can be done using your router, or with SD-WAN. For mobile users, we recommend using Zscaler App. In fact a lot of smaller sites use ZAPP instead of tunnels. Traffic can be routed over 4G/5G, Broadband, Satellite – doesn’t matter. The Zscaler cloud acts as a checkpost. For access to SaaS apps or the internet, Zscaler provides full inline inspect, to block the back and protect the good. For access to internally managed apps, AWS, Azure or the DC, Zscaler private app connects an authenticated user and devices to an authorized applications. In contrast, legacy networks were: a private hub and spoke network that you controlled and managed. The security model was castle and moat – where you secure the network to protect users and apps. In the new world, it’s a direct to cloud architecture over the internet. A network you don’t control and breaks the network security model. The security model is new world is policy based – securely connects a user to a an app or service.
- We often get asked, what exactly do you replace and do you eliminate the need for firewalls. When you take a look at the internet gateway, you have an outbound gateways protecting users going to the internet, and inbound gateways – an inbound gateway for remote access or VPN and and inbound gateways to protect servers an apps. With ZIA, we eliminate the entire outbound SWG stack of appliances. With ZPA, we eliminate the VPN stack of appliances. While do replace the need for branch firewalls and UTMs, we do not replace firewalls protecting your servers and apps in the data center. Our view is that over time these servers will eventually move to the cloud. On the flip side, we enable a fast, and secure direct-to-cloud architecture. This allows you to reduce your MPLS costs and in the case of AutoNation – largest car dealership in the US, the need to deploy over 300 branch firewalls in their branches.
- Zscaler was founded on the notion that cloud and mobility would disrupt traditional network and security architectures. To secure this new world, we realized we need to build a security cloud from the ground up. Just like Salesforce built a multitenant CRM platform. Simple goal: provide fast, secure and reliable access to your apps – across any network, on any device, from any location. Today our cloud…..
- Our cloud has been proven by some of the worlds largest brands to support these use cases. Zscaler started with the goal of being the salesforce of cloud security. Scale was extremity important. In fact, Zscaler stand for Zenith of Scalability. Let me highlight 4 dimensions of scale. Protection across countries: Siemens has employees being secured by our cloud in over 185 countries Locations protected: LDS has over 30K meetings houses all over the world that offer Internet services – we secure all of them. User protected: MCNC: over 1.3 M users in North Carolina are secured by Zscaler – most of it being SSL traffic to YouTube. YouTube hands down created more traffic on our network until late last year. Office 365 Traffic has now surpassed YouTube and account for 20% of our Internet traffic. All companies will have a logo slide – many only sold a box being used for a department or small office. With a few exceptions, all employees form all locations go through Zscaler every day. Adoption is not just across all industries. We have the largest organizations in the most verticals trusting Zscaler for their secure cloud transformation.
- A lot of companies, including MARs and United, got started with Zscaler to reduce their risk and improve security – adding advanced threat protection over their existing stack, extending the same level of protection to remote users, and in some cases using ZPA to provide executives and departments a VPN alternative for remote access. After deploying Zscaler, the second phase of their journey involves phasing out security appliances to reduce cost and complexity. This can be done at your pace, but more often than not, this is typically shortly after or in tandem with starting to send traffic to Zscaler. The third phase of the journey is about routing traffic locally via Internet breakouts to Zscaler. By routing traffic locally companies can optimize their MPLS spend and deliver a more secure and better user experience. Office 365 has been a key accelerator for local breakouts as Microsoft now recommends routing traffic locally and doing local DNS. So users are connecting to the closest Office 365 pop and on their network as fast as possible. Most companies tend to follow the secure, simplify, and transform journey, but underlying use case may be different.
- To close, technology is always changing, but every 10-15 years, megashifts take place that creates new opportunities and new leaders. It’s extremely difficult for incumbents to pivot. Datacenter and hardware is moving to Azure and AWS. Applications that sat in the datacenter are being replaced by SaaS applications. Workday is replacing Peoplesoft. ServiceNow Remedy. And Salesforce Siebel. Siebel tried to compete with Salesforce by repurposing their on premise app for the cloud, but it’s not that easy and doesn’t work.
- To close, technology is always changing, but every 10-15 years, megashifts take place that creates new opportunities and new leaders. It’s extremely difficult for incumbents to pivot. Datacenter and hardware is moving to Azure and AWS. Applications that sat in the datacenter are being replaced by SaaS applications. Workday is replacing Peoplesoft. ServiceNow Remedy. And Salesforce Siebel. Siebel tried to compete with Salesforce by repurposing their on premise app for the cloud, but it’s not that easy and doesn’t work.