ZSCALER WHITE PAPER

Combating Advanced
Persistent Threats (APTs)
with Cloud Sandboxing

GET THE BENEFITS OF COMPLETE SANDBOXINGIN A CLOUD-FIRST WORLD© 2021 Zscaler, Inc. All rights reserved.

ZSCALER WHITE PAPERTHE NEED FOR SANDBOXINGHow can the enterprise efficiently protect itself against previously unforeseen threats, especially when
dealing with highly mobile and unpredictable end-users? Signature-based approaches depend on anunderstanding of patterns that suggest an attack, and therefore are incapable of detecting threatsthat are not already being searched for by these systems. A zero-day threat is an attack that exploits
a previously unknown vulnerability, meaning that the attack occurs on day zero of awareness of theexploit. Signature-based security methods are futile in preventing zero-day threats because zero-day
threats obviously lack threat histories and known patterns that can be detected.
Blacklisting, whitelisting, anti-virus systems, intrusion detection systems (IDS) and intrusion prevention
systems (IPS) are measures for catching “known threats” that have previously been observed and haveunique characteristics that can be monitored to protect end users. These protections are all signature
based, in that they involve searching for known patterns within executable code. Preventing attacks
with these approaches therefore requires a clear knowledge of the threat history.
Enterprises also increasingly face advanced persistent threats (APTs) that may leverage previously
unknown attack techniques and vulnerabilities. Attacks are increasingly multi-part and sophisticated,sometimes combining APTs and zero-day threats. Sandboxing, which uses behavior analysis, is an
important technique for identifying previously unknown threats because this approach does not relyon signatures. Well-executed behavioral analysis can also result in low false-positives compared totraditional pattern matching or signature-based approaches because suspicious activity is observed
over a period of time and confirmed. With sandboxing solutions, a binary file is permitted to run in
a controlled environment, and its behavior is monitored and analyzed. Identification of suspicious
behavior—such as the downloading of malware, accessing the file system, logging keystrokes, etc. —allows for the identification of malicious content, even if the sample or techniques leveraged have neverbeen previously observed.

© 2021 Zscaler, Inc. All rights reserved.

ZSCALER WHITE PAPER

LEVERAGING A CLOUD ARCHITECTURE FOR BEHAVIORAL ANALYSIS
Zscaler, the cloud security leader, combines the benefits of behavioral analysis with the reach of aSaaS-based service to collect and analyze binary files from global clouds, analyze them centrally andensure that all customers benefit when even a single malicious file is identified.

Traditional Sandbox

Zscaler Cloud Sandbox

HQ

MOBILE

Alert

Sandbox

BRANCHMOBILE

BRANCH

HQ

Limited Capacity with no SSL inspection
Limited Capacity with no SSL
inspection

Unlimited Capacity with full SSL inspection
Unlimited Capacity with full SSL
inspection• Users off network go unprotected• Sandbox allows files to pass and infect• Threat data is often localized and not shared• Easily scale across all users/locations• Inline architecture holds file until clean• Cloud effect shares blocks to all customers

Appliance-based APT approaches are limited to protecting employees in the office and are insufficientfor protecting the enterprise; road warriors and home-based workers remain exposed to APTs and zeroday attacks. When sandboxing is part of a comprehensive and multi-faceted cloud security solution—as
opposed to just being offered as a point product—it is not limited to simply being a detective control
highlighting malicious files that were downloaded, but may not have succeeded in compromising end
user machines.
Zscaler’s advanced security solution provides full SSL inspection and inline blocking; firewalls andtap-mode sandbox appliances can not accomplish this. It provides continuous coverage for any user,anywhere, and Zscaler’s advanced security solution scans every packet, every byte, every time—forboth inbound and outbound traffic. It scans all communications to block botnets calling home, cookie
stealing and anonymizers, and it provides vulnerability shielding. Zscaler also generates dynamic
risk scores based on content and behavior to block zero-day threats. Zscaler has numerous industry
partnerships to ensure access to real-time feeds of known compromises, and every transaction islogged in detail for forensic analysis.
© 2021 Zscaler, Inc. All rights reserved.

ZSCALER WHITE PAPER

ADVANTAGES OF ZSCALER’S CLOUD SANDBOX
Zscaler identifies and catches threats via a sandboxed analysis of binaries. Zscaler’s Cloud Sandbox
includes behavioral analysis, which delivers three key differentiators in the market:
Protection of ALL users, including mobileUnlike appliance-based alternatives, Zscaler’s Cloud Sandbox protects all users, including the difficult
to follow mobile user, from APTs. By delivering sandboxing from the cloud, protection is alway on andplaced closest to the user regardless of location or connection. On or off network, the users connects
to the Zscaler Cloud Platform and Sandboxing solution first before accessing the Internet, so all trafficis always being inspected. This architecture far surpasses traditional data center sandbox approaches,as these appliances
go blind once the users drops off the corporate network.
Immediate Protection with the Cloud EffectGlobal, unified collection of samples across the Zscaler Cloud Platform ensures that even a single
targeted attack against a single victim can automatically improve security protection for all customers
globally. Once a threat is confirmed, all Zscaler customers receive worldwide protection from it. We callthis the Cloud-effect, and it easily out-paces appliance approaches to keep users safe from new andemerging threats as they are discovered across the globe.
Greater Context for Threat Protection
The integration of big data, static analysis and behavioral analysis provides a fuller context for threatprotection. By combining behavioral analysis and big data analysis, Zscaler enhances traditional
behavioral analysis techniques. In traditional behavioral analysis, a sample is analyzed in isolation. Inthat scenario, while behavioral analysis would uncover the fact that a given sample requested a specific
URL when executed, the behavioral analysis engine would have no way of knowing if the request
was benign or malicious. Zscaler is able to further interrogate this information by comparing it to all
historical transactions to ensure that the behavioral analysis engine benefits from the latest intelligencederived from mining the overall Zscaler cloud.

IMPLEMENTING ZSCALER ADVANCED SECURITY
With Zscaler, behavioral analysis is not a separate offering, but rather an enhancement of an alreadypowerful advanced security suite. Zscaler Enforcement Nodes (ZENs) are continually collecting
suspicious binary files and delivering them to the central behavioral analysis engine. Samples are
executed and monitored in controlled environment and malicious behaviors are recorded and analyzed.
Collected metadata is compared to intelligence sources, and malicious files are blocked at ZENs.
This is accomplished through an automated, six-step process:1. Fast Pre-Processing – Pre-processing ensures that files are quickly classified to identify those thatwill benefit from behavioral analysis. Files are divided into those that are portable executable files andthose that aren’t, and the portable executable files are then parsed to ensure that they areappropriately formed.

© 2021 Zscaler, Inc. All rights reserved.

ZSCALER WHITE PAPER

2. Obfuscation Detection – Malware often leverages file formats called “packers” to obfuscate filecontent and further complicate reverse engineering of the sample. Static analysis techniques areapplied to identify those portable executable files that have been packed and identify the packer thathas been leveraged. Packed files must first be unpacked before additional static analysis can beapplied, and identifying the packer used can assist in identifying particular malware families.
3. Static Analysis – Applying static analysis to unpacked samples can identify malicious samples andbypass the need to conduct behavioral analysis, which is less efficient due to the fact that samples
must be permitted to execute.
4. Malware Categorization – When static analysis techniques uncover malware, the samples are
named and categorized. Malicious samples are gathered to ensure that new static analysis checks areadded to the overall process to continually improve detection rates.
5. Context-Based Behavioral Analysis – Unpacked portable executable files not already flagged as
malicious are delivered to the behavioral analysis engine. Files are executed in a controlled environment
and monitored for malicious behavior. Meta data retrieved during the process—such as requested
URLs—are also compared to other Zscaler data sources. This hybrid approach ensures that files are notanalyzed in isolation, but instead benefit from previous analysis and data collected from data mining
efforts and partner data feeds. An overall risk score is calculated based on this analysis to help policy
and configuration rules decide what to do with the files.
6. Forensic Analysis/Blocking – Transaction reports are generated for forensic analysis, and threats
are blocked for all users on the Zscaler Security Cloud.

Zscaler’s Cloud Sandbox includes behavioral analysis, which is delivered through an automated, six-step process.

© 2021 Zscaler, Inc. All rights reserved.

ZSCALER WHITE PAPERCONCLUSION
The enterprise will continue to encounter APTs that leverage previously unknown attack techniquesand vulnerabilities. Sandboxing is essential for protection against APTs. Appliance-based solutions areinsufficient for protecting enterprise resources that are highly mobile and platform independent. Zscaler
Cloud Sandbox offers an innovative, cloud-based solution that allows the enterprise to successfully
combat APTs with context-based behavioral analysis. Organizations can integrate big data andbehavioral analysis to protect enterprise resources and ensure the protection of all users, including
mobile. The result is the enterprise can gain immediate global protection once a global threat isconfirmed and build greater context to enable advanced threat protection.

ABOUT ZSCALER
Zscaler™ enables organizations to securely transform from the old world of IT, which focused on
securing the internal network, to the world of cloud and mobility, where the Internet is the newcorporate network. Zscaler delivers the inbound and outbound gateway stacks as a service, providing
secure access to the Internet and applications in the data center or cloud. Each day, the Zscaler cloud
processes more than 160B requests, blocking 100M+ threats for 5,000 organizations in 185 countries,and the ThreatLabZ research team provides continuous protection from new and evolving threats. Visit
www.zscaler.com.

CONTACT US

FOLLOW USZscaler, Inc.
110 Rose Orchard Way
San Jose, CA 95134, USA+1 408.533.0288+1 866.902.7811

facebook.com/zscaler

www.zscaler.com

blog.zscaler.com

linkedin.com/company/zscaler
twitter.com/zscaler
youtube.com/zscaler© 2021 Zscaler, Inc. All rights reserved. Zscaler™, SHIFT™, Direct-to-Cloud™, ZPA™, ByteScan™, Pagerisk™,Nanolog™, PolicyNow™, and The Internet is the new network™ are trademarks or registered trademarks ofZscaler, Inc. in the United States and/or other countries. All other trademarks are the property of their respective
owners. This product may be subject to one or more U.S. or non-U.S. patents listed at www.zscaler.com/patents