WHITE PAPER

Zscaler For Users
Healthcare Deployment
Strategy© 2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

Contents
Summary			3

Use Cases			3

Common Use Cases for Zscaler in Healthcare Environments			4
Access clinical apps without MPLS			

5

EHR Community Programs			

6

Remote Workforce / VPN Replacement			

8Mergers and Acquisitions		

9

Patient or Clinical Mobile Devices		

11

Patient and Clinical Kiosk/Shared Workstation		

12

Remote Radiology		14
Points of Integration		

15

Sample Integration		16
Imprivata		
16
CrowdStrike			

17

Rubrik17© 2024 Zscaler, Inc. All rights reserved.

2

Summary
This document is intended to discuss the use cases most commonly seen in healthcare and thedeployment strategy with Zscaler for those use cases.

Intended audience
Typical Audiences
Roles

Responsibilities

Security Manager

Leader who oversees security measures within an organization. Security managers with a focus
on cybersecurity manage IT teams and develop strategies for cybersecurity efforts. They may
also write rules and regulations regarding cybersecurity decisions.

Network Security Engineer

Helps implement security measures that apply to connections to the network and how a computer protects its information over the internet.

Security Engineer

Implements important security measures across an organization. The security engineer may
troubleshoot new security measures. They often coordinate the response to breaches in security and help the IT team develop solutions for avoiding those breaches in the future.

IT Administrator

General IT Administrator or user responsible for a specific domain included in a Zscaler deployment.

Application Director

Responsible for the delivery of applications throughout the healthcare facility. These include
end user productivity applications, EPR systems, and Electronic Medical Record systems which
include all aspects of patient care.

Application Analyst

Responsible for the configuration and integration of applications across the continuum of care.
Examples of these include EMR, PACs, cardiology, and speech recognition applications.

Use cases
In healthcare, use cases can be grouped into two separate descriptions:• Clinical use cases - Clinical is defined as anything that can impact a patient while they are being
cared for. Any service outage or degradation assumes the highest priority to restore any services that
impact direct patient care.

• Non-clinical use cases - Non-clinical is defined as roles that are not directly impacting patient care.
In most cases, electronic medical record (EMR) software that is deployed has a heavy influence on theother supporting applications for the EMR platform. Organizations must create an application delivery
strategy by understanding user requirements and how applications are consumed at the point of care while
also maintaining compliance and security standards.

© 2023 Zscaler, Inc. All rights reserved.

White Paper

3

Most healthcare providers deliver EMR platform software in the form of published applications via
traditional VDI environments. They may publish these from an on-prem data center or through a directconnection to a cloud-hosted provider. In some cases, these published applications will be deployed sothey are internet-facing. Zscaler’s zero trust approach eliminates the need for external facing applications
such as EMRs by utilizing Zscaler Private Access (ZPA). We connect the user to the application, not the
network.
We also offer posture control, context, inline DLP, Secure Web Gateway, NGAV, firewalling, SSL
decryption, and other security products all wrapped under a single umbrella. This means users can accesstheir applications not just from anywhere but securely to avoid breaches and data leakage. This eliminates
the need for point solutions by offering consolidation and end-to-end visibility.

Common use cases for Zscaler in healthcare environments
Common Use Cases
Use case

Description

Nurse Kiosk

Central location for care team members to meet and discuss rounding and patient care needs.
EMR access is typically through a shared workstation with a tap-and-go login

Patient RoomPatient room typically uses a device such as an iPad to access applications or care notes in aneffort to deliver a personalized patient experience.

Medical Imaging

Use for diagnostics of radiology or other medical images. Typically require specialty hardware
for image review. Subject to review and certification by the FDA to ensure lossless images.

Clinical Research

Research related to AI/ML, genomics, population health, and others. Though the EMR is leveraged by researchers, the most time is spent extracting and working with the data from the
EMR and integrating them into an enterprise data warehouse. Can be contracted doctors andnot employees.

Non-Clinical Staff

Diverse application needs–includes groups such as IT, HR, finance, etc.

Non-Clinical Kiosk

Used in reception and front desk areas. Patients can self-register, pay bills, and do other controlled activities related to their medical visit.

Remote Workforce

Anyone outside of direct network connectivity such as rural doctor offices, mobile doctors,
work from home, etc.

M&A

Hospitals that are buying other hospitals and need to integrate them into existing environments.

EHR Community Connect

Larger hospital networks can license EHR software to smaller hospitals for less cost than astandard EHR deployment. This is usually a use case for smaller than 200-bed hospitals.

© 2023 Zscaler, Inc. All rights reserved.

White Paper

4

Access clinical apps without MPLS
External Apps

Internal/Private Apps

Secondary Datacenter

Internet

SaaS

Primary Datacenter

PublicCloud

RouterAllowedApplications

AllowedApplications

BlockedApplications

BlockedApplications

SIPA Applications

FW
Cloud Protection via APIOOB CASB / CSPM SSPM / CIEMCore

TLS Tunnel
TLS Tunnel

Federated identity

Logging

LegendGood Traffic
Bad Traffic
GRE/IPsec Tunnel to Zscaler
TLS Tunnel to Zscaler
Identity Based Access

IT/OT Access

Clinic / Hospital

General Flow
Source IP Based Traffic
Zscaler Client Connector App
Zscaler Private Service Edge
Zscaler App Connector
Primeter router/SD-WAN
Zscaler Z Connector

Zscaler provides a solution called Zscaler Private Access (ZPA) that enables secure access to clinicalapplications like Electronic Medical Records (EMR) without the need for an MPLS circuit. To access clinicalapplications, you need to deploy a ZPA Connector within your network, which can be deployed via alightweight VM or a physical RHEL machine. The connector acts as a secure bridge between your local
network and the Zscaler cloud. It establishes an outbound connection from your network to the
ZPA service.
You can then define specific access policies based on user identity, device posture, and other contextual
factors. ZPA integrates with your existing identity provider (IdP) or uses its built-in authentication
mechanism to verify user identities before granting access. This ensures that only authorized users canaccess the clinical applications. This also allows provisioning to be fast and simple. Zscaler Client Connector
can auto-enroll with ZPA and auto-login, taking out steps between the clinician and the client.
© 2023 Zscaler, Inc. All rights reserved.

White Paper

5When a user requests access to a clinical application, the ZPA Connector establishes an encrypted
connection to the Zscaler cloud. The cloud acts as a proxy and forwards the request to the targeted
application. This way, the application is not exposed to the public internet. Your user’s session will only beconnected to the applications they have access to and will not be allowed to move laterally throughout
the network.

EHR Community Programs
EHR Community Programs are programs through an EHR vendor in which they give the ability to allow
larger hospital networks to license out the EHR platform to other smaller hospitals. The goal is to decrease
the cost of an EHR implementation for a smaller hospital network while also giving the host hospital theability to do a chargeback model. In this particular case, the host hospital would be responsible for all of
the SLAs and support for the buying hospital.
Hosting Hospital

Secondary Datacenter
Primary Datacenter
RouterFW
Core

TLS Tunnel

Federated identity

Logging

Z-Tunnel 2.0
External Apps:
All Ports and Protocols

TLS TunnelInternal Apps

LegendGood Traffic
Bad Traffic
GRE/IPsec Tunnel to Zscaler
TLS Tunnel to Zscaler
Identity Based Access
General Flow
Source IP Based Traffic
Zscaler Client Connector App
Zscaler Private Service Edge

Buying Hospital
Zscaler App Connector
Primeter router/SD-WAN
Zscaler Z Connector© 2023 Zscaler, Inc. All rights reserved.

White Paper

6

Zscaler offers two solutions to ensure these hospitals get onto the host hospital’s infrastructure safely.
The first is a standard Zscaler Private Access use case. The host hospital would deploy an app connector
within their data center while giving out Zscaler Client Connector to the buying hospital. This will allow
the hospital to get onto the network and launch an EHR without ever needing an external facing gateway.
You will still need to deploy an EHR to their best practices usually done through a published application but
this will eliminate the need for a VPN or an external-facing portal. As most customers print within an
EHR, you will need to set up either Local Virtualized Printing in which the EHR sends a PDF document to
the local machine to print via a local printer or, a local printer setup within the EHR.
Hosting Hospital

Secondary Datacenter
Primary Datacenter
RouterFW
Core

TLS Tunnel

Federated identity

Logging

LegendGood Traffic

Buying Hospital

Bad Traffic
GRE/IPsec Tunnel to Zscaler
TLS Tunnel to Zscaler
Identity Based Access
General Flow
Source IP Based Traffic
Zscaler Client Connector App
Zscaler Private Service Edge
Zscaler App Connector
Primeter router/SD-WAN
Zscaler Z Connector

If your company has the need to use IoT devices that cannot have the Zscaler Client Connector installedon them, then the second option you have for deployment would be to utilize Zscaler Zero Trust SD WAN
with Z Connector. This solution requires either a small lightweight appliance to be installed in a virtualized
environment either KVM or VMware ESXI or the new hardware form factor. This will create a tunnel
from your host hospital to the buyer hospital. You will require a router at both ends as well to receive thistraffic, however, it does not need to be an MPLS circuit.

© 2023 Zscaler, Inc. All rights reserved.

White Paper

7

Remote workforce / VPN replacement
External Apps

Internal/Private Apps

Secondary Datacenter

Internet

Primary Datacenter

PublicCloud

SaaS

RouterAllowedApplications

SIPA Applications

AllowedApplications

BlockedApplications

FW

BlockedApplications

Cloud Protection via APIOOB CASB / CSPM SSPM / CIEMCore

TLS Tunnel
TLS Tunnel

Federated identity

Logging

LegendBrowser Isolation
HTTPS HTML5

Z-Tunnel 2.0
External Apps: All Ports and Protocols

TLS TunnelInternal Apps

Good Traffic
Bad Traffic
GRE/IPsec Tunnel to Zscaler
TLS Tunnel to Zscaler
Identity Based Access
General Flow
Source IP Based Traffic
Zscaler Client Connector App
Zscaler Private Service Edge
Zscaler App Connector
Primeter router/SD-WAN
Zscaler Z Connector

WFA
Employees

AgentlessContractors© 2023 Zscaler, Inc. All rights reserved.

White Paper

8

Zscaler leverages a cloud-native architecture, meaning it operates entirely in the cloud without theneed for on-premises infrastructure. This eliminates the complexity and maintenance associated with
VPN hardware and software, reducing costs and providing scalability. Zscaler also provides access toyour cloud-based applications without the need to route through your internal data center. While some
applications such as a cloud-hosted EMR platform may have a direct connection in an effort to lock down
access to only on-prem connections, Zscaler can connect directly to that cloud provider and provide
native access.
VPN hardware can create a bottleneck of performance issues or single points of failure, Zscaler’s global
cloud infrastructure ensures scalability and high performance. It can handle increased user demand
and traffic without affecting the user experience. Additionally, the distributed architecture reduces thedependency on a single point of failure, providing high availability.
Unlike VPNs that provide network-level access, Zscaler’s ZTNA enables granular access control to
specific applications or resources, reducing the attack surface. Zscaler’s ZTNA solution enforces strict
security policies based on user identity, device health, and other contextual information. It verifies eachconnection request, ensuring that only authorized users and devices can access specific applications or
resources. Additionally, Zscaler’s cloud-based platform performs real-time threat analysis and applies
advanced security controls to protect against malware, zero-day exploits, and data exfiltration.

Mergers and acquisitions
The traditional approach of mergers and acquisitions often requires things such as new security
assessments, integrating target and parent networks, application access predicated on network access,and domain joining. This can lead to increased lateral movement threats from parent to target hospitals,
longer lead times due to needing to integrate the network first, and collaboration or application accessbeing delayed.
Zscaler ZTNA allows for accelerated time to value by providing network access via a zero trustarchitecture to your parent network from the target network. With ZTNA, you are able to mitigate andcontrol risks by using posture controls within the administrator console. Zscaler allows the ability tosimplify the solution by reducing the many integration points of security tools such as firewall rule sets,
VPN access, device settings, etc.
We achieve this by first deploying a Zscaler tenant, Client Connector, and App Connector to sit in linewith user traffic. We can then use real traffic data to identify the usage level of key applications. This
leads to implementing and enabling access policies around these retained applications. You then are able
to optimize staffing and consolidate point solutions. Finally, you would be able to expand or collapse your
Zscaler integration tenant.

© 2023 Zscaler, Inc. All rights reserved.

White Paper

9Logical design of mergers and acquisitions using Zscaler
Buyer Datacenter

Acquired Datacenter

Secondary Datacenter

Secondary Datacenter

Primary Datacenter

Primary Datacenter

RouterRouter
FW

FW

Core

Core

TLS Tunnel

TLS Tunnel

Federated identity

Logging

LegendZ-Tunnel 2.0
External Apps:
All Ports and Protocols

TLS TunnelInternal Apps

Good Traffic
Bad Traffic
GRE/IPsec Tunnel to Zscaler
TLS Tunnel to Zscaler
Identity Based Access
General Flow
Source IP Based Traffic
Zscaler Client Connector App
Zscaler Private Service Edge
Zscaler App Connector
Primeter router/SD-WAN
Zscaler Z Connector© 2023 Zscaler, Inc. All rights reserved.

White Paper

10Patient or clinical mobile devices
Logical design of mobile devices using Zscaler
External Apps

Internal/Private Apps

Secondary Datacenter

Internet

SaaS

Primary Datacenter

PublicCloud

RouterAllowedApplications
BlockedApplications

AllowedApplications
BlockedApplications

SIPA Applications

FW
Cloud Protection via APIOOB CASB / CSPM SSPM / CIEMCore

TLS Tunnel
TLS Tunnel

Federated identity

Logging

LegendGood Traffic
Bad Traffic
GRE/IPsec Tunnel to Zscaler
TLS Tunnel to Zscaler
Identity Based Access

MDM Solution

General Flow
Source IP Based Traffic
Zscaler Client Connector App
Zscaler Private Service Edge
Zscaler App Connector
Primeter router/SD-WAN
Zscaler Z Connector© 2023 Zscaler, Inc. All rights reserved.

White Paper

11

Zscaler also offers Client Connector for IOS and Android devices. The app acts as a secure gateway,
redirecting all internet traffic from the device through the Zscaler cloud. This ensures that all datatransmitted to and from the mobile device is inspected and protected. Zscaler’s cloud-based Secure
Web Gateway (SWG) provides web filtering and threat protection capabilities. It enforces security
policies, blocks malicious websites, and scans web content for malware or other threats.
Zscaler’s DLP features help prevent data leakage from mobile devices. It monitors outgoing traffic andapplies policies to detect and prevent the unauthorized transmission of sensitive data, such as personal
health information (PHI) and confidential documents. This ensures compliance with data protection
regulations. Zscaler also leverages advanced threat intelligence and real-time analysis to detect and blockmalware, phishing attacks, and other threats on mobile devices. The traffic passing through the Zscaler
cloud is inspected for known malicious patterns, suspicious behavior, and zero-day threats, providing an
additional layer of security.
Zscaler integrates with Mobile Device Management (MDM) solutions to enforce security policies andmanage mobile devices more effectively. This integration allows IT administrators to apply devicelevel controls, such as password requirements, device encryption, or remote wipe capabilities, ensuring
devices meet security standards.

Patient and clinical kiosk/shared workstation
Zscaler can secure kiosk/shared workstations by installing Zscaler Client Connector on them. Often, thesewill be machines either in the waiting room or in a patient’s room that a nurse will log into. These kiosks
typically have a limited set of applications that they have installed but require protection from outside
threats. Email, web browsing, and using an EMR can be done on most kiosks in a patient’s room or at anurses’ station on the floor. By utilizing Zscaler Client Connector, paired with ZPA and ZIA, we can ensurea safe and secure connection between the workstation and any internet destination such as public cloud,private cloud, or web browsing.
Zscaler offers session management capabilities that help control and monitor user sessions on sharedworkstations or kiosks. Administrators can set session timeouts, enforce session termination upon
inactivity, and track user activity to prevent unauthorized access or misuse. Zscaler’s Secure Web
Gateway (SWG) inspects web traffic from shared workstations or kiosks. It applies web filtering policies
to block access to malicious or inappropriate websites, SWG also scans web content for malware,
protecting shared workstations from downloading infected files. Zscaler’s Cloud Firewall enforces firewall
rules and blocks unauthorized connections. The Cloud Firewall adds an additional layer of security to theshared environment.
Zscaler’s DLP features can help prevent data leakage from shared workstations or kiosks. It monitors
outgoing traffic and applies policies to detect and prevent the unauthorized transmission of sensitive
data, such as patient information or confidential documents. DLP also ensures compliance with dataprotection regulations.

© 2023 Zscaler, Inc. All rights reserved.

White Paper

12

Logical design of kiosk machines using Zscaler
External Apps

Internal/Private Apps

Secondary Datacenter

Internet

SaaS

Primary Datacenter

PublicCloud

RouterAllowedApplications

AllowedApplications

BlockedApplications

BlockedApplications

SIPA Applications

FW
Cloud Protection via APIOOB CASB / CSPM SSPM / CIEMCore

TLS Tunnel
TLS Tunnel

Federated identity

Logging

LegendZ-Tunnel 2.0
External Apps:
All Ports and Protocols

TLS TunnelInternal Apps

Good Traffic
Bad Traffic
GRE/IPsec Tunnel to Zscaler
TLS Tunnel to Zscaler
Identity Based Access
General Flow
Source IP Based Traffic
Zscaler Client Connector App
Zscaler Private Service Edge
Zscaler App Connector
Primeter router/SD-WAN
Zscaler Z Connector© 2023 Zscaler, Inc. All rights reserved.

White Paper

13Remote Radiology
Zscaler Private Access offers the capability to allow radiologists to do reads remotely without the needfor a traditional VPN solution. The benefit to utilizing Zscaler Private Access is a user is not connectedto the network. They are connected only to the application they are assigned regardless of where thatapplication lives. This can lead to faster performance, increased security posture and network hop
visibility.
Secondary Datacenter
Primary Datacenter

PublicCloud

RouterDirect Connect

FW
Core

TLS Tunnel
TLS Tunnel

Federated identity

Logging

LegendZ-Tunnel 2.0
External Apps:
All Ports and Protocols

TLS TunnelInternal Apps

Good Traffic
Bad Traffic
GRE/IPsec Tunnel to Zscaler
TLS Tunnel to Zscaler
Identity Based Access
General Flow
Source IP Based Traffic
Zscaler Client Connector App
Zscaler Private Service Edge
Zscaler App Connector
Primeter router/SD-WAN
Zscaler Z Connector© 2023 Zscaler, Inc. All rights reserved.

White Paper

14

Faster performance comes from a few different variables within the Zscaler platform. The user firstconnects to the closest Zscaler cloud to them ex: user in Maine will connect to a Boston Zscaler Cloud.
The Zscaler App Connector is then adjacent to the application whether in the datacenter or a cloud
hosted solution ex: Datacenter in Seattle will connect to the Seattle Zscaler Cloud. Zscaler then stitches
these two connections together offering faster and more reliable connections then a user to datacenter
VPN direct link. As the micro tunnel that Zscaler creates for the PAC’s application only contains thenecessary ports and protocols the tunnel is not saturated with other traffic that can impede performance.
Testing of this functionality with a user in Maine connecting to Boston via a VPN and via Zscaler Private
Access showed a 30% increase in performance by utilizing Zscaler Private Access.
Increased security posture comes from connecting the user to the application, not the network.
The user is first checked for posture, identity, and context. If the user meets the required criteria they
are able to connect to the application. Since the user is not on the network they are unable to do a
network scan, ping, and an nslookup will return a synthetic Zscaler IP. The Zscaler App Connector talks
outbound on port 443 to the Zscaler cloud eliminating the public attack surface of the application.
Increased visibility and hop by hop analysis of the application by utilizing Zscaler Digital Experience
allows for the helpdesk team to proactively see how an application, connection, and user are performing.
The helpdesk teams can then identify a problem such as latency, wifi proximity, wifi channel saturation,
isp outages, application response time, etc. This allows for helpdesk to increase their MTTR (mean time
to resolution).

Points of integration
Identify:
Zscaler uses identity providers such as Okta, Ping, Azure Active Directory, ADFS, and others to provision
and authenticate users. Zscaler supports up to 16 different SAML IdPs per organization. You have two
methods to provision users within the Zscaler console for provisioning users SAML Auto-Provisioning
and System for Cross-domain Identity Management (SCIM).
SAML Auto-Provisioning allows you to provision users based on an authentication event. When a userchanges group or adds groups, the database will be updated upon authentication request by that user.
SAML Auto-Provisioning is supported by most IdPs out of the box and requires limited configuration.
The disadvantage is that users will not be deleted automatically when using SAML Auto-Provisioning.
System for Cross-domain Identity Management (SCIM) offers the ability to auto provision users without
the need for an authentication event. SCIM APIs will talk back to the IdP and the Zscaler Admin portal
to update users’ information, including deprovisioning users. The disadvantage of SCIM is it is notsupported by all IdPs.

© 2023 Zscaler, Inc. All rights reserved.

White Paper

15

Security Information Event Management (SIEM):
Zscaler seamlessly integrates with leading Security Information and Event Management (SIEM) solutions toenhance your security operations workflows. You can integrate Zscaler with supported SIEM solutions totransmit logs in real time. SIEM integration provides visibility in a centralized console and allows your teams
to leverage the solution’s existing security investigation workflows.
Endpoint Security:
Zscaler integrates with industry-leading endpoint solution partners to provide zero trust access control
based on device posture as well as enhance detection, investigation, and response capabilities—no matter
where users and apps are—through telemetry and intelligence sharing. We do this by deploying Zscaler
Client Connector alongside your cloud native EDR/EPP sensors. The endpoint sensor sends events to thecloud for adaptive machine learning based on posture. When an indicator of compromise data feeds into
the Zscaler Zero Trust Exchange, that event will help protect all users.
Mobile Device Management (MDM):
Companies use an MDM solution often to control a device whether corporate or BYOD. These devices
enroll into the MDM solution and get applications installed. Zscaler Client Connector can be deployed
fast and at scale through your chosen MDM solution. We support a wide variety of attributes such as“cloudname”, “domainname”, and “username” to make this deployment more seamless requiring limited
interaction from the end user. Companies may take this approach vs the traditional approach of having IT
install the software manually.

Sample Integration:
Imprivata
Imprivata is a market leader with their OneSign tap-and-go solution. This solution allows an IT
department to provision “kiosk machines” (type 2 Imprivata install) with generic service accounts logged
in to Windows. The nurse or doctor would walk up to the machine with their badge and tap it on thecard reader. This would then allow them to seamlessly run apps under their user context without everlogging into the machine in a traditional Windows OS fashion. Primary use cases in a clinical setting wouldbe Emergency Rooms, Operating Rooms, and many more patient care settings where quick access to an
application for a roaming clinician is required. At the same time, Imprivata improves operational efficiencyof the IT staff because workstations can be placed back into service compared to a non-Imprivata
workstation in the same deployment.
Zscaler Client Connector 4.4 now offers support for Type 2 (Shared Kiosk) Imprivata OneSign Installs.
These shared workstations will now be able to have their Imprivata digital identity interpreted adaptively
to ensure policy follows users from each device they may utilize throughout the day. Ex: Nurse Paul can’t
access dictation software or media streaming services. No matter what machine Nurse Paul logs into

© 2023 Zscaler, Inc. All rights reserved.

White Paper

16using Imprivata with Type 2 that policy will follow them and offer logging capabilities within the Zscaler
platform to show who was on a machine and what they did on that machine vs a generic service accountas often seen. Zscaler Client Connector 4.4 Seamless SSO with Imprivata Type 2 Workstations

CrowdStrike
Crowdstrike is an MQ leader in Endpoint Protection, which when utilizing their product and our products,
we can share threat intel, device posture, telemetry, and XDR-enabled threat detection.
Utilizing CrowdStrike’s Zero Trust Assessment (ZTA) we can block access for non-compliance and rogue
devices. CrowdStrike can gather new threat intelligence (IPs, Domains, and URLs) and share with Zscaler tocreate new block lists.
Zscaler advanced cloud sandbox intercepts inline and detects zero-day malware which then will share filehash with CrowdStrike Falcon to retrieve a list of impacted endpoints in the environment. Zscaler triggers
a response by requesting Falcon to quarantine the endpoint or by pivoting to Falcon console for further
investigation.
Zscaler shares telemetry with CrowdStrike to enable enhanced visibility and detection capabilities.
CrowdStrike initiates cross-platform response workflows by adding in the user gathered from telemetry
data to the restrictive group. Zscaler then can restrict that user access to selected critical applications
preconfigured for that group.

RubrikWith more distributed users and data, organizations are struggling to ensure that sensitive data is notaccidentally exposed or deliberately exfiltrated for double extortion attacks. One of the leading sources ofdata risk in organizations is the inadvertent transmission of sensitive data over the network. Furthermore,
malicious encryption of data can be a challenge without a way to keep data safe and make it fast and easy
to recover. Rubrik’s integration with Zscaler proactively identifies sensitive business data across enterprise,cloud, and SaaS environments so that it can be fingerprinted into an index to more easily and accurately
prevent data loss.

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss
by securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SSE-based Zero Trust Exchange is the world’s largest inline cloud security platform. Learn
more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134©2023 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,
ZIA™, Zscaler Private Access™, and ZPA™ areeither (i) registered trademarks or service marksor (ii) trademarks or service marks of Zscaler,Inc. in the United States and/or other countries.
Any other trademarks are the properties of theirrespective owners.

zscaler.com