Modernizing Cloud andInternet Access withSASE-Based TIC 3.0Solutions
Reducing the attack surface helps remove
cloud transformation barriers

ZSCALER SASE-BASED TIC 3.0 SERVICES

With federal cloud adoption at an all-time high and growing with IT
modernization, federal teams need secure 24/7/365 access to data andapplications anywhere, from any device. For years, the Trusted InternetConnection (TIC) policies, combined with the use of remote VPNs, limited
agencies’ ability to move to the cloud due to the restrictions the old TIC
policies placed on internal and external connections to the network andthe internet. This made the traditional TIC model untenable in today’s
cloud-first world.
Old World TIC/MTIPS

New World TIC 3.0

Perimeter security appliances toprotect the network
Internet

SaaS

OutboundGateway

FW/IPS

Global LB

URL Filter

DDoS

Antivirus

Ext. FW/IPS

DLP

APJ
DC

Private Cloud

Inbound
GatewayWorkforce

Customers

Digital Service
Exchange

Workforce
Customers

RAS (VPN)

SSLInternal FW
Sandbox

EUDC

Internal LB
DNS

Data Center

RemoteAgencyTrusted Network

NADC

Data center is the center of gravity
Hub-and-spoke WAN (backhaul to DC)
Castle-and-moat network security
Users connect to the network for app access (trusted)

Workforce

Customers/Contractors

Cloud is the new data center
Internet is the new network (direct access)Business policies connect apps, devices, and user
User connects to an app, not the network (ZTA)

Fast forward to today, the volume of cloud-based applications and the associated high-volume,
high-demand traffic is exploding. The number of mobile devices is exceeding desktops, and theperimeter is almost completely dissolving.
Responding to these challenges, the Department of Homeland Security (DHS) and the Office ofManagement and Budget (OMB) finalized an important TIC policy update. The TIC 3.0
guidelines expand on the original program to drive security standards and leverage advances intechnology as agencies adopt mobile and cloud environments. The goal of TIC 3.0 is to find new
and innovative ways to secure federal data, networks, and boundaries while providing visibility
into agency traffic, particularly for cloud communications.
TIC 3.0 offers vital support for broader cybersecurity efforts, including Cloud Smart, theNational Cybersecurity Protection System (NCPS), and the Continuous Diagnostics andMitigation (CDM) programs.

©2020 Zscaler, Inc. All rights reserved.

2ZSCALER SASE-BASED TIC 3.0 SERVICES

The guidance also provides a catalogue of approved agency use cases, where agencies canreview results for environments with security requirements similar to their own and consider new
possibilities. These use cases could include:
Direct-to-Cloud

Branch Office

Branch Office / Remote User

Direct Connect, Express Route, TLS, VPN, etc

Shared path with Security Pattern 3,
but with new final destination

Bulk GRE/TLS, Clent agent, proxy, etc

CSP

CSP

CSP

SECaaS/CASB

Agency Campus

Agency Branch OfficeOption 1Agency Branch Office

Agency Branch Office

Option 2Option 3

The Zscaler™ multitenant Cloud Security Platform and “TIC in the Cloud” approach meet TIC 3.0guidelines. As agencies work to meet modernization goals of shared services, mobile workforce
enablement, improved FITARA scores, and more, Zscaler powers the shift to a modern,direct-to-cloud, zero-trust architecture, regardless of device or user location.

Zscaler meets the TIC 3.0 framework with fast, secure access to the internet,
SaaS, and IaaS/PaaS via SASE and zero trust architecture

Real-time policy and analytics

Your security stack as a service

Real-time policy engine
Polices follow the user
Changes are immediately enforced, worldwide

Business analytics
Global visibility into apps and threats blocked
Identify botnet infected machines for remediation

Access Control

Threat Prevention

Cloud Firewall
URL Filtering
Bandwidth Control
DNS Filtering

Adv. Protection
Cloud Sandbox
Anti-Virus
DNS Security

Data Protection
Data Loss Prevention
Cloud Apps (CASB)
File Type Controls

Direct to cloud
Block the bad, protect the good

IoT

MOBILE

HQ

BRANCHMPLS

APPS

Data Center

The best approach for SD-WAN and Office 365©2020 Zscaler, Inc. All rights reserved.

3ZSCALER SASE-BASED TIC 3.0 SERVICES

Improve security controls – Keep IT focused on innovation
with TIC in the Cloud
Federal IT leaders can improve on the who, what, where, when, and how they see, protect, and control
user traffic to the internet by moving TIC security controls and other advanced security services toa cloud platform. The goal: immediate remediation on a global scale. This approach offers agencies
global internet access and peering with FedRAMP-authorized applications. In addition, agencies
capture extensive log/telemetry data and keep CDM reporting in place, while storing all agency dataon U.S. soil with U.S. citizen-only access.
Zscaler’s TIC in the Cloud is an innovative approach that recognizes the secure and trusted user.
This means wrapping the security policy around the user rather than the network, enabling agencies
to route traffic direct to the cloud through their choice of internet connection with no additional
hardware required. Further, this approach lets authorized users securely and efficiently access dataon their smartphones, laptops, tablets, and more. Users are protected wherever they go.

Open Internet

Third-Party Cloud/IaaS
Private Applications

SaaS

On-Site Data Center
Private Applications

LegendZPA (Zscaler)
Encrypted Connection
ZIA (Zscaler)
Encrypted Connection
TIC
TIC Telemetry

Remote/Mobile

lien

ler C

Zsca

Zscaler Tunnel
Encrypted Connection

tornnect Co

Nanologs
IPSec Tunnel

Zscaler App Connector
CONTRACTORPARTNERDHS/Einstein

EMPLOYEEHQMOBILE

SD-WAN

Peering

Direct-to-Cloud Architecture = Productivity, Flexibility
With a direct-to-cloud architecture, users take the shortest path to the application or internetdestination, which optimizes performance. In addition, purpose-built cloud-based security
technologies apply numerous techniques to minimize processing overhead, reducing latency ascompared to an appliance-based solution. As agencies eliminate appliances, they reduce cost andcomplexity. At the same time, reduced latency means improved user experiences.

©2020 Zscaler, Inc. All rights reserved.

4

ZSCALER SASE-BASED TIC 3.0 SERVICES

Zscaler TIC 3.0 Solutions
The Zscaler multitenant Cloud Security Platform applies policies set by the agency to securely
connect the right user to the right application. As a Secure Access Service Edge (SASE) service,
the Zscaler Cloud Security Platform is built from the ground up to provide comprehensive network
security functions. Unlike traditional hub-and-spoke architectures where traffic is backhauled overdedicated wide area networks via VPNs to centralized gateways, Zscaler routes traffic locally andsecurely to the internet over broadband and cellular connections. The Zscaler SASE architecture
shifts security functions to focus on protecting the user/device in any location, rather than securing
a network perimeter. This ensures that users get secure, fast and local connections no matter where
they connect.
Zscaler Internet Access-Government (ZIA): ZIA-Government, the first FedRAMP-authorized secureinternet and web gateway has achieved “In Process” status at the High Impact level. It securely
connects users to externally managed applications, including SaaS applications and internet
destinations, regardless of device, location, or network.

External Apps

Block Bad / Protect Good

Use Cases
Office 365

Protect Against Threatsand Data Leakage• App prioritization/peering with Microsoft• One-click deployment

Threat Protection• Inspect encrypted traffic at scale• Cloud-effect: Identify once, protect all

ID Provider

Secure SD-WAN
San JoseChicagoAshburn• Local breakouts for branch internet• API integration with SD-WAN vendors

Data Protection
Broadband

Fiber

4/5G

• Shadow IT discovery• Protect IP/PII/Compliance• Standardization • Simplification •Identical Protection (mobile, branch, HQ)

BranchHQ Road WarriorYour Workforce©2020 Zscaler, Inc. All rights reserved.

5

ZSCALER SASE-BASED TIC 3.0 SERVICES• Delivers the security stack as a service from the cloud, enabling agencies to route more missioncritical traffic straight to the cloud• Connects users securely to externally managed applications regardless of device, location, network• Reduces costs associated with backhauling traffic through outdated technology• Reduces complex array of security applications, while increasing performance
Zscaler Private Access™-Government (ZPA™): ZPA-Government is the first and only zero trust remote
access service to achieve a JAB FedRAMP-High authorization. It provides seamless and secure zerotrust access to internal applications for authorized users using a software-defined perimeter, notappliances, to provide comprehensive security and a fast, transparent user experience.

Private cloud/On-premises
data center

Zero trustarchitecture
1ZPA Public Service Edge

3 App Connectors

3secure user to app connection

2App Connectors• Treat all as untrusted both outside
and inside the perimeter• Verification prior to granting access

Zscaler Client Connector or
ZPA Browser Access• Access is granted on a strict“need to know” basis

request access to app

3

Zero trust accesswith ZPA

1 ZPA Public Service Edge

sit in front of apps
outbound-only connection• App access without requiring
network access• Segment of one is created between
named user and named application

2 Client Connector orZPA Browser Access• Delivers the same access whether agency applications are hosted in the government data center,in the AWS GovCloud, or in another service• Replaces legacy VPN technology and provides encrypted (TLS 1.2) connections to applications• Connects users to applications without placing users on the network, reducing risks introduced byunmanaged devices and eliminating the threat of lateral movement• Ensures applications are “dark” to unauthorized external and internal users, reducing the possibilityof DDoS or other internet-based attacks• Provides visibility into an agency’s full internal application environment, enabling IT to understanduser activity, and discover and define access policies for internal applications©2020 Zscaler, Inc. All rights reserved.

6

ZSCALER FEDERAL CLOUD SERVICES

9 Consecutive years: Named a Leader on
Gartner’s Magic Quadrant for Secure Web Gateways
100M+ Threats Detected Per Day
175K+ Unique Security Updates Per Day
Internet Exchange Peering with 150+ vendors,
including Office 365, AWS, Azure

Future Forecast – A zero trust-optimized TIC 3.0 environment
Zscaler provides the entire internet security stack as a service, continuously applying policies andthreat intelligence to protect agencies from malware and other advanced threats. Identifying andunderstanding the user, while protecting the application with inside-out connectivity, precise access,and “trust no one” encryption, removes the network and the device used to access it from thesecurity equation.
Whether the user is in the office or working remotely in the field, Zscaler’s patented technology allows
policies to follow the user, determining trusted and untrusted connections to make routing decisions
appropriately -- creating a zero trust-optimized TIC 3.0 environment.

For more information, visit

zscaler.com/resources/ebooks/zscaler-cloud-security-platform

About Zscaler
Zscaler enables the world’s leading organizations to securely transform their networks and applications for a mobile and cloud-firstworld. Its flagship services, Zscaler Internet Access™ and Zscaler Private Access™, create fast, secure connections between users andapplications, regardless of device, location, or network. Zscaler services are 100% cloud delivered and offer the simplicity, enhanced
security, and improved user experience that traditional appliances or hybrid solutions are unable to match. Used in more than 185
countries, Zscaler operates a multitenant, distributed cloud security platform that protects thousands of customers from cyberattacks
and data loss. Learn more at zscaler.com or follow us on Twitter @zscaler.

Zscaler, Inc.

©2020 Zscaler, Inc. All rights reserved. Zscaler™, Zscaler Internet Access™, ZIA™, Zscaler Private Access™, and ZPA™ are either (i) registeredtrademarks or service marks or (ii) trademarks or service marks of Zscaler, Inc. in the United States and/or other countries. Any other trademarks
are the properties of their respective owners. V.062220

120 Holger Way
San Jose, CA 95134+1 408.533.0288
www.zscaler.com