scansafe overview n.
Skip this Video
Loading SlideShow in 5 Seconds..
ScanSafe Overview PowerPoint Presentation
Download Presentation
ScanSafe Overview

Loading in 2 Seconds...

play fullscreen
1 / 40

ScanSafe Overview - PowerPoint PPT Presentation

  • Uploaded on

ScanSafe Overview. Agenda. ScanSafe overview Solution highlights Deployment options Demo Q&A. #1 SaaS Web Security Solution. “The first successful in-the-cloud secure Web gateway service”. Industry’s most mature platform 20 Billion web requests per month

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

ScanSafe Overview

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript


  • ScanSafe overview
  • Solution highlights
  • Deployment options
  • Demo
  • Q&A

#1 SaaS Web Security Solution

“The first successful in-the-cloud secure

Web gateway service”

  • Industry’s most mature platform
  • 20 Billion web requests per month
  • 1,000’s of customers across 80 countries
  • 200 Million Blocks per Month
  • Global network operations in 4 continents
  • SLA backed 99.999% service uptime


web security a big market where cisco is 1
Web Security – A Big Market Where Cisco is #1
  • Web Security Market
  • Large: Overall market $2.5B by 2013
  • Broad across size, industry, geography
  • Growing: Market Growth at 12.3% CAGR; But 46.5% CAGR for SaaS segment
web security market shift to saas
Web Security – Market Shift to SaaS
  • SaaS is growing much faster than legacy software/hardware as it delivers lower TCO and effective security. Ideal for customers with distributed networks and mobile workers
  • Cisco ScanSafe is the dominant provider in SaaS, with 35% market share or 5x nearest competitor according to latest IDC research

Required Information:-

  • Overview of Prospect i.e. Seats/Locations/Gateways
  • Customer Project or Problem
  • Business Drivers – Compelling Mechanism
  • Timescales
  • Budget

Why ScanSafe:-

  • We do it cheaper, by saving time on cleaning infected PC’s & by managing the software on a day to day basis
  • We are more secure, 200 million malware blocks a month – spyware/malware/viruses
  • We are a complete solution – Internal users & External users are controlled via the same service



Competitive Outlook

  • Very significant market/vendor consolidation in past 2 years
  • Key Competitors:
    • Websense – incumbent in large % of deals. Focus on renewal unless pushed. Increase in development in SaaS platform. Continued move to try and position as a security vendor
    • Blue Coat – incumbent in large % of deals. Not that security focused. Rarely lose new business deals
    • MessageLabs– focus on email security with web security offered for completeness. Low cost, low functionality
    • Zscaler – small and relatively new, v. aggressive, may be acquired. Partnership with Microsoft. Less success in larger Enterprise customers.


12 months

scansafe competitive differentiation
ScanSafe Competitive Differentiation
  • Clear market leadership position (~34% market share)
    • More customers than any other cloud Web security solution
    • ScanSafe sees more real-world Web traffic than any other solution
  • Leading content visibility & zero-day threat protection
    • Large database of Web content used to “train” security engine
    • Uses combination of static & dynamic analysis
    • Proven to block >25% more malware than signature solutions
  • Proven reliability
    • Web is now business critical communication
    • 100% uptime for 7 years
  • Superior reporting
    • Complete flexibility into reporting criteria
    • Allows end users to define exactly what data is important


  • ScanSafe overview
  • Solution highlights
  • Deployment options
  • Demo
  • Q&A

Data Flow with ScanSafe

Web requests

Allowed traffic

Filtered traffic


Scalability & Reliability

  • Reliability
    • 15 Data Centers spanning four continents
    • Top tier certification
    • Thousands of devices deployed
    • 100% availability, automated monitoring, full redundancy


London (2)


New York



San Francisco




Hong Kong

  • Scalability
  • Billions of Web requests/day
  • Highly Parallel processing
  • Multi-tenant architecture: average <50 ms latency
  • 10Gb connectivity
  • Redundant network providers


Sydney (2)

Additional Data Centers planned


Outbreak Intelligence - The Results


Multiple injection attacks

Percentage of malware blocks

Zeus Botnet / Luckysploit


ScanCenter - Management

  • Multiple rules and schedules for User/Group granularity
  • Bi-directional content based policy enforcement
  • Dynamic content classification
  • Control over HTTP & HTTPS communications

Web Intelligence Reporting

  • Over 24,000 report combinations covering more than 80 attributesin 11 reporting categories
  • Cumulative, trending and search driven forensic reports, comprehensive drill down analysis
  • Based on data warehouse infrastructure for performance
  • Scheduled reports can be sent securely to defined users
  • Granular reporting enables actionable remedies to issues and unrivalled visibility into resource usage


Deployment options

  • ScanSafe overview
  • Solution highlights
  • Deployment options
  • Demo
  • Q&A


  • No User Granularity Required
  • User / Group Granularity Required
  • Connector-less Solutions
  • Roaming & Remote Users
scansafe deployment options1
ScanSafe Deployment Options

No User Granularity Required


Port Forwarding / Transparent Proxy

Firewall directs port 80 traffic to web security service via Transparent Proxy / Port Forward (no browser changes required)

Available with certain perimeter devices that have the ability to forward traffic based on port or protocol (BlueCoat, ISA, CheckPoint, Watchguard, SonicWall, Netgate etc…)

Provides Site/External IP granularity

  • NOTE: Many Cisco devices are not capable of port forwarding

Browser Redirection via GPO / PAC file

Proxy Settings are pushed to browsers via Active Directory GPO

Browsers connect through Firewall on port 8080 to Web Security Service

Firewall blocks all other GET requests

Provides Site/External IP granularity


PAC File Deployment

Through GPO, Desktop Users are configured to reference a PAC file with each browser session

A global PAC file can point to different ScanSafe towers dependant on internal IP

Web requests are sent directly to the ScanSafe towers

deployment ad group policy
Deployment - AD Group Policy
  • Can be targeted to the AD site, domain or individual OUs.
  • Supports various OS platforms:
    • Windows 2000
    • Windows 2k3 Server
    • Windows XP
    • Windows Vista
    • Windows 7
scansafe deployment options2
ScanSafe Deployment Options

User / Group Granularity Required


Standalone Connector

  • Proxy Settings are pushed to browsers via AD,GPO or PAC file
  • Forwards web traffic to ScanSafe on port 8080/443 to the Cloud based Tower
  • Connector receives Client info and queries Active Directory Server for Group Information, then proxies to ScanSafe upstream
  • Set Firewall to block all other GET requests
  • Provides IP/End User/Group granularity

Enterprise Connector - Inline ISA

  • Web Security Service is configured as upstream proxy on currently installed proxy device
  • Current proxy device communicates with Connector ICAP (on box) to provide IP/User/Group information (5,500 Users max recommended)
  • Browser traffic is directed to existing Proxy via GPO or PAC files
  • Set firewall to block all other GET requests
  • Provides IP/End User/Group granularity

Enterprise Connector - ICAP

Web Security Service is configured as upstream proxy on currently installed proxy device

Current proxy device communicates with Connector via ICAP to provide IP/User/Group information

Requires no further Client configuration

Set firewall to block all other GET requests

Provides IP/End User/Group granularity

scansafe deployment options3
ScanSafe Deployment Options

Connector-less Solutions


BlueCoat Integration - Connector-less

Provides AD user and group granularity.

BCAAA must be installed and configured within the Active Directory environment.

To also send internal IP address to the ScanSafe Scanning towers, Blue Coat must be configured to include x-forwarded-for headers.

BC can run in transparent or explicit proxy mode

Set firewall to block all other GET requests

Provides End User/Group (possible IP granularity)


PIM - Passive Identity Management

Proxy Settings are pushed to browsers via Active Directory GPO or PAC file OR PIM can be run in transparent mode with ISA / Bluecoat

Login Script (or GPO etc) runs the PIM.EXE with required switches

Requires no client installation

Firewall blocks all other GET requests

Provides End User/Group granularity

why pim
Why PIM?

There are many customers that do not want to deploy proxy servers yet still want granular policy control. This can be because of the shear number of sites they have to manage or for other technical reasons

Deploying a small number of proxy servers to where many different locations tunnel, negates a lot of the advantages of modern MPLS networks and increases latency and bandwidth costs

how does pim work
How Does PIM Work?

PIM adds -XS headers to the browser’s user agent string

Included in this string is a unique hash that identifies the user in our Scanning tower

This detail is encrypted

Upon logon, PIM sends an out-of-bound request to the scanning tower and uploads the group information for that user

These groups are automatically created in ScanCenter

Following registration, each time a request to the Web is made, only the hash is sent to us along with the request and we can indentify the user and apply the correct policy according to the relevant group/s

pim data flow
PIM Data Flow

Directory Sync request (Registration)

Internet request (Browsing)



Client running




The Internet

scansafe deployment options4
ScanSafe Deployment Options

Roaming / Remote Users


Roaming Users (Anywhere+)

Installs a Network Driver which binds to all connections (LAN, Wireless , 3G)

Automatic Peering Identifies nearest ScanSafe Datacenter and whether a connection is possible.

AD information can be remembered from when the user was last on the corporate network using the Gpresult API (group policy)

how does it work
How Does it Work?

Authenticates and directs your external client Web traffic to our scanning infrastructure

Numerous datacenters are located all over the world ensuring that users are never too far from our in-the-cloud scanning services

SSL encryption of all Web traffic sent improves security over public networks