Securing work beyond the perimeter with Zero Trust tomodernize security across enterprise environments

CHALLENGES

SOLUTION

Hybrid work is increasingly becoming the normal

To secure work beyond the perimeter, most IT

way of doing business. Employees are working

teams have begun adopting a Zero Trust modelfrom anywhere, partners and their devices arethat has of three key criteria: identity, user device

moving on and off the office network, and many

posture and access policies. These criteria areapplications once hosted in data centers area means for establishing Zero Trust based on

now moving to a public cloud or being replaced

context and then adapting access rights as thewith software as a service (SaaS). The corporate

context changes.

network is becoming less relevant as more worktakes place off of it, and gateway appliances
designed to build a hard perimeter around it are
now obsolete.

Together CrowdStrike and Zscaler are simplifying
the adoption of Zero Trust for IT teams byproviding an integrated end-to-end security
solution — from endpoint to application —Traditional solutions emphasized network security

that gives administrators a real-time view of aand often did not consider device posture priordevice’s security posture and bases access toto allowing access to network resources. But thecritical applications on granular access policies.

prevalence of cloud adoption means IT can no

By sharing data between the CrowdStrike Falcon®

longer control secure application access whensensor at the endpoint and the Zscaler Zerorelying on the castle-and-moat architectures ofTrust Exchange™, access policies canthe past. There is a need to protect the user-

automatically be adapted according to userto-application connectivity from end to end,

context, device health and newly detected IOCs.

regardless of where users are connecting from.
Security teams have access to more data thanever and need tools that provide the right visibility
into data with the right context at the right time.
This requires security beyond the perimeter.

CrowdStrike Falcon Zero Trust Assessment(ZTA) provides continuous, real-time security
and compliance checks for endpoints, making
sure that authentication and authorization aregranted only to devices with security posture as
approved by the organization.

©2022 Zscaler, Inc. All rights reserved.

Solution Brief

CrowdStrike and Zscaler
Integration

Zscaler Zero Trust Exchange uses policy toworkflow helps organizations increase thesecurely connect users to the internet, SaaS

timeliness and effectiveness of threat defense,

or private apps. CrowdStrike provides a ZTA

detection and remediation.

score, which is the device posture score, andalso provides the ability to use threat intelligenceso Zscaler can adaptively enforce policy toaccess applications or to block malicious URLs,
IP addresses or domains inline via a custom
blocklist. This enables a security administrator toinitiate a quarantine action from Zscaler to theCrowdStrike Falcon platform and stop malware
from spreading from the offending device. Thisbidirectional sharing across platforms of threat
intelligence, increased visibility and automatic

As a part of the CrowdXDR Alliance, Zscaler
integrates with CrowdStrike to share relevant
Zscaler logs for improved end-to-end visibility
with telemetry from endpoints, networks andcloud applications. This sharing of intelligencemaximizes cross-platform effectiveness foraccelerated investigations. CrowdStrike FalconFusion can trigger cross platform response
workflow, enabling Zscaler Zero Trust Exchange
to adapt flexible access policies with speed andefficacy.
Falcon Insight XDR now integrates with Zscaler
Zero Trust Exchange to drive response actions
from XDR detections or via automated Falcon

Key Benefits	device health metrics are• Real-timeused to enforce access policy to privateand SaaS apps	capability to enforce access policy• The

is based on the changing device posture
over time	
integrations enable convergence• Theof user, device and network visibilityto indicators of compromise (IOCs)
and automated workflow as a holisticsystem, strengthening security posture

Fusion (SOAR) workflows. These automatedresponse actions include limiting or updatinguser access to applications with adaptive access
control policies based on detection criticality,
providing full closed-loop remediation acrossplatforms.
In addition, Zscaler Deception deploys decoys on
endpoints, networks, cloud, and identity
systems to provide high-fidelity alerts andtelemetry of targeted attacks. It also enables
administrators to initiate both orchestrated andmanual containment requests to the CrowdStrike	ability to trigger device quarantining• The

Falcon platform to prevent lateral movement	visibility enables stronger• Increased

The benefits from the joint solution are not justhelps prevent malware from propagating
after a user accesses malicious files
reporting and remediation andmaximizes an organization’s ability torespond to the increasing volume andsophistication of attacks

from a compromised host in real time.

limited to IT security alone. As businesses look toenable work-from-anywhere strategies, thisjoint solution makes it easier to provide users
with safe, seamless and secure access toessential business applications for day-to-day
employee activity. All of this can now beachieved on a foundation of Zero Trust.

©2022 Zscaler, Inc. All rights reserved.

Solution Brief2

HOW IT WORKS* Third-party logos remain the property of their respective owners and are not meant to convey a relationship or endorsement.

ZERO TRUST ACCESS TO ALL APPSSTEP 1: The CrowdStrike Falcon platform evaluates device posture with Zero Trust Assessment (ZTA)
The CrowdStrike Falcon platform collects OS and sensor settings from an endpoint device and calculates
its ZTA score. Any changes in settings will automatically trigger a recalculation of the ZTA score. Bycomparing the ZTA score with the organization’s baseline score, CrowdStrike can measure the health of theuser’s device relative to the organization’s baseline and recommended best practices over time.
STEP 2: Zscaler Zero Trust Exchange implements access policies
Zscaler Zero Trust Exchange implements Zero Trust access policies in two layers. First, Zscaler Client
Connector checks if the CrowdStrike Falcon sensor is running on the endpoint device. Next, Client
Connector reads the device’s ZTA score and compares it against the policy threshold defined for selectedbusiness-critical applications. If these conditions are met, access to applications is granted. If not, thenaccess is denied. Access policies on the Zscaler dashboard can be adjusted to change the threshold of thescore based on the organization’s requirements and changing conditions over time.

©2022 Zscaler, Inc. All rights reserved.

Solution Brief

3

ZERO-DAY DETECTION AND REMEDIATIONSTEP 1: Zscaler Cloud Sandbox correlates zero-day malware detection with CrowdStrike Falcon
telemetry
The Zscaler Cloud Sandbox sits inline at the cloud edge to detect zero-day threats. Malicious files aredetonated in the sandbox, creating a report that is correlated with endpoint data from the Falcon platform.
This ties the threat detected at the network edge with endpoint data.
STEP 2: Administrators quarantine and remediate threats with a cross-platform workflow
The correlation automatically identifies impacted endpoints within the entire environment and facilitatesa one-click trigger to the Falcon platform for rapid quarantine action. Alternatively, administrators
can pivot from the Zscaler console to the Falcon console with automatically populated data for furtherin-depth investigation.

AUGMENTING ZSCALER
INLINE BLOCKING WITH
CROWDSTRIKE THREATINTELLIGENCE
STEP 1: CrowdStrike adds indicatorsof compromise (IOCs) into Zscaler’scustom blocklist
When CrowdStrike intelligence identifies
a threat within a specific customer
environment, the threat is compared with
Zscaler’s threat database, and the resulting
delta is then automatically added to thecustomer’s Customer Block List in theZscaler platform. These include highconfidence threat data such as URLs, IPaddresses and domains. These shared
indicators of compromise (IOCs) in theKey Capabilities	
CrowdStrike integration with• The

Zscaler shares threat intelligence andenables automatic workflows to helporganizations reduce the number ofsecurity incidents — and, if an incident
does occur, delivers quick time-todetection and remediation.	integration provides the ability to• The

monitor device health and compliance
via ZTA scores and quickly remediate
gaps with Zero Trust access policy
control and inline blocking based on
CrowdStrike-detected IOCs. Together,CrowdStrike and Zscaler enable accessto applications and the internet withmaximally adaptive access control,
without hindering user productivity.

custom blocklist are in addition to theZscaler global threat feeds and are specificto a customer’s environment.
STEP 2: Zscaler uses new intel to block threat
Attempts to access such URLs/IPs/domains are proactively blocked inline by Zscaler as a result of the
sharing of IOCs. Zscaler Internet Access (ZIA) and CrowdStrike Falcon ensure the same threat vector isblocked inline by Zscaler before it can infect other endpoints.

©2022 Zscaler, Inc. All rights reserved.

Solution Brief4

CROWDSTRIKE FALCON LOGSCALE LOG MANAGEMENT INCREASES VISIBILITY
STEP 1: CrowdStrike Falcon® LogScale consumes Zscaler logs
CrowdStrike Falcon LogScale ingests various Zscaler logs into the Falcon platform, gaining network visibility.
STEP 2: CrowdStrike Falcon LogScale performs data correlation and analytics
The CrowdStrike Falcon LogScale platform takes the telemetry from Zscaler to perform data correlation andanalytics. This opens up a rich potential for threat hunting and investigation, as well as potential crossplatform triage and remediation

EXTENDED DETECTION AND RESPONSE WITH CROWDSTRIKE FALCON INSIGHT XDR™
STEP 1: Get comprehensive visibility across applications and endpoints
Falcon Insight XDR offers purpose-built XDR integration with Zscaler logs to funnel relevant security data atscale, achieving network and cloud applications visibility maximizing cross-platform sharing for accelerated
investigations and responses.
STEP 2: Detect advanced threats and respond effectivelyFalcon Insight XDR leverages security events identified from Zscaler logs to generate meaningful andactionable insights, speed up proactive threat hunting, and respond decisively to stop cyberattacks. Based ona new detection, CrowdStrike Falcon can trigger Zscaler Zero Trust Exchange to move a user to a restrictive
group, whereby adaptive access control policies can be applied, for example, access to an app by browser
isolation or network quarantine.

About Zscaler
Zscaler (Nasdaq: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data
loss by securely connecting users, devices, and applications in any location. Distributed across more than 150
data centers globally, the SSE-based Zero Trust Exchange is the world’s largest in-line cloud security
platform. Learn more at zscaler.com or follow us on Twitter @zscaler.

©2022 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,ZIA™, Zscaler Private Access™, and ZPA™ areeither (i) registered trademarks or service marksor (ii) trademarks or service marks of Zscaler,Inc. in the United States and/or other countries.
Any other trademarks are the properties of theirrespective owners.

We stop breaches.
About CrowdStrike
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with the world’s
most advanced cloud-native platform for protecting critical areas of enterprise risk — endpoints and cloud
workloads, identity, and data.
Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leveragesreal-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry fromacross the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat
hunting and prioritized observability of vulnerabilities.
Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid andscalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.

+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134

Learn more: https://www.crowdstrike.com/
Follow us: Blog | Twitter | LinkedIn | Facebook |InstagramStart a free trial today: https://www.crowdstrike.com/free-trial-guide/© 2022 CrowdStrike, Inc. All rights reserved.
CrowdStrike, the falcon logo, CrowdStrike Falcon
and CrowdStrike Threat Graph are marks owned
by CrowdStrike, Inc. and registered with theUnited States Patent and Trademark Office, andin other countries. CrowdStrike owns othertrademarks and service marks, and may use thebrands of third parties to identify their products
and services.

zscaler.com