Internet security moves to the cloud

A start-up that dishes up an in-the-cloud security service says it also eliminates capital outlay for security gear and reduces ongoing support costs.

Zscaler imposes security policy as defined by customers and logs security activity for reporting and forensic analysis by customers. The service provides antivirus and antispyware, and can block the activity of bots, peer-to-peer networks, malicious content and phishing, the company said.

The service applies policies only to outbound Internet traffic on the fly, and can eliminate the need for multiple single-function devices at the edge of corporate networks, says the company's founder, Jay Chaudhry. He is also the founder of Cipher Trust (now part of Secure Computing), AirDefense (now part of Motorola) and SecureIT (now part of VeriSign).

Customers proxy outbound Internet traffic to the nearest Zscaler gateway, where it is scanned and cleaned, Chaudhry says.

The Weather Channel has tested the service and may sign up for it within the month, says John Penrod, CISO for the TV network. He says he is being cautious about how the service affects performance as perceived by users, but so far has seen latency of less than 1 second imposed on traffic filtered by Zscaler.

The company claims its screening is 40 times faster than individual products that would perform the same functions.

Penrod says the reporting platform was not complete when he started testing the service, and plans to delve into that this month.

He says he was looking for something to filter instant messaging, spam and phishing and had considered buying a secure Web gateway from Blue Coat. (Compare secure Web gateways.) But he says that the initial cost of the appliance plus administration and maintenance for five years would cost more than the service. The Weather Channel has a total of about 800 users at six sites.

To engage the service, customers point traffic that goes through edge devices such as firewalls and routers toward Zscaler gateways. For remote access users, they change browser settings to direct traffic at the gateways.

Currently these gateways are located in Atlanta, Chicago, New York and Washington, D.C., with a central storage facility in San Jose, Calif., and a mirror site in Freemont, Calif.

Other gateways are planned for elsewhere in the United States and Europe, Chaudhry says. The deployment follows the model of Akamai's media worldwide distribution network, he says.

Zscaler relies on two other unnamed vendors for its signature-based antivirus software and its URL database, but the rest of its technology is home-grown.

This includes a high-performance proxy engine, a software architecture that allows a single instance of security applications that can handle multiple users' traffic, compression technology that reduces logs by 50-fold and a global network.

Penrod says he is cautious about trusting the Zscaler security platforms but has faith in Chawdhry based on his experience. "I'm going to gain that trust," Penrod predicts.