WHITE PAPER

United Kingdom Secure by
Design Zscaler Capabilities& Internal Alignment©2024 Zscaler, Inc. All rights reserved.

Introduction

Affected parties and timelines

The United Kingdom’s (UK) Secure by Design

For all central government departments and(SbD) strategy is a proactive approach aimed

arm’s-length bodies (ALBs), adherence to the UK

at bolstering the cyber resilience of the UK

SbD principles is mandatory for any new services

government and fostering enhanced collaborationor significant modifications to existing services

among organizations. While not an assurance

subject to the digital and technology spend

process or certification, the UK SbD frameworkcontrols approval process. This ensures that these

operates as a set of guiding principles intended

services integrate the requisite security measures

to consistently deliver robust security measuresmandated by the UK government.

across the entire lifecycle of UK government
services. Positioned as a foundational element
within overarching government strategies such

Implementation priority have been categorized
into two distinct groups:

as the Government Cybersecurity Strategy• Group 1 comprises ministerial departments,

and Transforming for a Digital Future, the

ALBs responsible for managing government

SbD initiative sets the stage for integrating

Critical National Infrastructure (CNI), and entities

cybersecurity best practices into digital service

overseeing priority government services.

delivery and fortifying service resilience. Central
to the UK SbD strategy are ten distinct secure by
design principles, comprising a comprehensive
suite of 46 specific activities. While mandatoryfor government departments and arm’s-length
bodies (ALBs), these principles remain optional• Group 2 encompasses all remaining ALBs andother central government organizations.
While it is encouraged for all organizations to
expeditiously adopt the SbD principles, theCabinet Office will engage with each entity

for other segments of the UK public sector.

individually to establish tailored implementation

As a trusted partner to the UK public sector,

Digital and Data Office (CDDO) will be prioritized

Zscaler is deeply committed to not only assistingfor Group 1 organizations, facilitating their swift

UK government departments, ALBs, and otherand effective adoption of the SbD principles.

schedules. Notably, support from the Central

public sector entities in the implementationof these principles but also aligning its service
offerings with the defined SbD principles

Security by design principles

internally as well. Through this commitment,

The UK SbD principles have been established to

Zscaler aims to contribute to the overarchingprovide foundational guidelines that emphasize

objective of enhancing the UK’s cybersecurity

integrating security measures into the design

posture and ensuring the delivery of secure andand development of systems, applications,resilient digital services across the UK public

and products from the outset. These principles

sector landscape.

aim to proactively address security risks andvulnerabilities, rather than retrofitting security as
an afterthought.

©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

02

Zscaler has built its services with security byManagement, VP of Cloud Operations, and thedesign in mind, both in its service capabilities as

VP of Global Compliance oversee the integration

well as the way in which its services are operated.

of security measures during product development

Zscalers alignment with each of the UK SbD ten

and operations, ensuring compliance with ISO(10) foundational principles can be found below.

27001 and SOC 2 standards as a minimum
baseline. Risk management is handled through a

PRINCIPLE 1
Create Responsibility for
Cybersecurity Risk

structured risk assessment process, with highrisk items requiring documented treatment plans
and management review. Third-party vendor
relationships are managed with thorough due

Objective: Assign risk owners to be accountablediligence and legal oversight to ensure adherence

for managing cybersecurity risks for a service

to security and privacy standards. The privacy

throughout its lifecycle. These must be seniorteam ensures compliance with data protection

stakeholders with the experience, knowledge andlaws and serves as a liaison for privacy-related

authority to lead on security activities.

inquiries. These measures collectively fortify

Zscaler Capability Support: While Zscaler

Zscaler’s security posture, ensuring security is a
responsibility throughout the organization.

doesn’t directly create information security
programs and assign organizational responsibility,
Zscaler services offer invaluable insights toaid senior leadership in decision-making.

PRINCIPLE 2
Source Secure Technology Products

Leveraging Monte Carlo simulation, Risk360

Objective: Where third-party products are used,

empowers organizational leaders to assess andperform security due diligence by continually

mitigate financial risks associated with potential

assessing platforms, software, and code forthreats, facilitating the establishment of robust

security vulnerabilities. Mitigate risks and sharesecurity programs and leadership structures.

findings with suppliers to help them improve

Through its dashboarding capabilities, seniorproduct security.

stakeholders access visibility into risk scores,
contributing factors, and actionable insights

Zscaler Capability Support: Leveraging

across multiple categories like workforce, third

automated engines, Zscaler Risk360 analyzes

parties, applications, and assets. Moreover,real-time data from various sources, including

Risk360 streamlines operations by delivering

third-party products, to provide actionable

comprehensive risk measurement, actionableinsights and guided investigative workflows

recommendations, and real-time metrics acrossfor risk mitigation. This enables customers to

Zscaler services, alongside external vulnerability

conduct thorough security reviews before productsoftware integration.

implementation. Additionally, Zscaler’s suiteof capabilities, including internet-facing attack

Zscaler Internal Conformance: Zscaler assigns

surface reduction and zero trust architecture,

clear responsibilities for cyber risk management

strengthens third-party risk management efforts

throughout its organizational structure. Senior

by minimizing attack vectors and preventing

stakeholders, including the VP of Productlateral movement. Risk360 further enhances risk©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

03

quantification and visualization, empowering

Zscaler Capability Support: Zscaler provides

leaders to make informed decisions balancing

customers with a risk-centric approach tosecurity and usability, with intuitive reporting andcybersecurity. Utilizing the Zscaler Risk360

the ability to analyze top cybersecurity risk drivers

platform, which utilizes automation to gather

in depth.

real-time data from both internal and external

Zscaler Internal Conformance: Internally, Zscaler
upholds the SbD principle of Source Secure
Technology Products by conducting thoroughsecurity assessments on all third-party entities
handling customer data. This includes ensuring
ISO 27001 or SOC 2 certification for data
centers storing customer data and performing
due diligence on sub-processors to validate
their security and privacy practices. Zscaler’s
Third-Party Risk Management program covers
various assessment areas such as businessresiliency, cybersecurity, and legal compliance.
Additionally, Zscaler tracks vendor informationand security issues, conducts annual security
reviews, and mandates written commitments tosecurity controls and data protection obligations.
Through its Systems and Services Acquisition
policy, Zscaler follows documented processes
to communicate security needs, review vendor
commitments, and assess risks regularly. Zscaler

sources. Customer’s are provided with a risk
score ranging from 0 to 100, enabling leaders toestablish their project’s risk appetite and compare
their security posture with industry benchmarks
over time. Risk360 facilitates the visualizationof a customer’s zero trust journey score, aidingorganizations in quantifying their risk appetite for
digital services. Detailed reports, such as the CISO
board reports and AI-powered cybersecurity
maturity assessments, offer insights into anorganization’s cyber risk posture and highlightareas for improvement. Additionally, Risk360
allows customers to analyze their risk using
frameworks like MITRE ATT&CK, enabling theassessment of an organization’s security postureand estimation of financial exposure. Intuitive
visualization and reporting capabilities empower
leaders to filter and analyze top cybersecurity risk
drivers, facilitating informed security decisions
and streamlined reporting processes.

manages security and usability through a defined

Zscaler Internal Conformance: Zscaler

risk assessment process, encompassing risk

implements a comprehensive risk-driven

identification, analysis, and evaluation, with a risk

approach to cybersecurity internally, supported

treatment plan mandated for high-risk scenarios

by a formal risk assessment and treatment planand ongoing management oversight to ensure

process. This process entails identifying assets,

effective risk mitigation.

threats, and vulnerabilities through extensive
research and communication, aligning with the

PRINCIPLE 3
Adopt a Risk-Driven Approach

National Institute of Standards and Technology

Objective: Establish the project’s risk appetite andrisk scenarios requiring a detailed treatment

maintain an assessment of cybersecurity risks

plan. The management review team oversees

to build protections appropriate to the evolving

progress against treatment plan targets andthreat landscape.

exceptions. Additionally, Zscaler utilizes a third-©2024 Zscaler, Inc. All rights reserved.

(NIST) 800-30 standard. Zscaler’s risk analysis
involves assigning values to risks, with high-

WHITE PAPER

04

party vendor program to manage subcontractors,

Zscaler Internal Conformance: Zscaler implements

ensuring adherence to security standards anda separation of duties model to prevent theprivacy practices. Due diligence is performed

misuse of authorized privileges and mitigate theon subcontractors, and contractual obligations

risk of collusion. This model ensures that specificregarding security controls and data protection

rights are assigned to users based on theirare documented. Zscaler’s ThreatLabz Researchdefined job duties, with a focus on preventing

team conducts expert-led research on emerging

individuals from simultaneously authorizing

threats, sharing findings to enhance industry-

security-related accounts and administrativewide cybersecurity. Compliance efforts alignaccounts. Additionally, Zscaler conducts a

Zscaler products with internationally recognizedroutine business impact analysis (BIA) to assess

standards such as ISO 27001 and SOC 2,

the implications of significant changes in thefostering customer confidence. Lastly, Zscaler

environment, with BIA validation included as part

maintains a risk register evaluated annually as partof the annual SOC 2 audit, thereby ensuring thatof its ISO 27001 certification.

security processes remain relevant, effective, andeasy to comprehend.

PRINCIPLE 4
Design Usable Security Controls
Objective: Perform regular user research and

PRINCIPLE 5
Build in Detect and Respond Security

implement findings into service design to makeObjective: Design for the inevitability of security

sure security processes are fit for purpose andvulnerabilities and incidents. Integrate appropriate

easy to understand.

security logging, monitoring, alerting, andZscaler Capability Support: Zscaler offers arobust set of capabilities to embody the secure

response capabilities. These must be continuallytested and iterated.

by design principle of Design Usable Security

Zscaler Capability Support: Zscaler’s Nanolog

Controls by ensuring security processes are

Streaming Service (NSS) facilitates seamlessboth effective and user-friendly. Zscaler’s cloudcommunication between Zscaler cloud andsecurity services feature a multidimensional

third-party security solution devices, enablingrole-based access control system that

real-time streaming of logs to customers’

supports hierarchical administration and scope

SIEM systems through VM-based or Cloudcustomization, allowing for the restriction

NSS options. Zscaler Cloud IPS, integratedof organizational and functional access andwith technologies like firewalls and sandboxes,

obfuscation of usernames. Additionally, Zscaler’s

provides comprehensive threat protection against

Risk360 tool provides customers with detailed

various attacks, leveraging custom and industry-

cost estimates of their organization’s risk,

leading signatures for real-time monitoring andemploying financial loss quantification and Montepolicy enforcement. Moreover, organizations canCarlo modeling to present a range of potential

proactively identify and remediate vulnerabilities

financial outcomes, thereby empowering

using Zscaler capabilities such as ZIA’s Advanced

organizations with quantifiable data for informed

Threats Protection and Mobile Malware

decision-making in business case scenarios.

Protection policies, while Risk360 offers insights©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

05

into the external attack surface and lateralprovides mappings to security risk frameworks

propagation risk, enabling informed decisions tolike MITRE ATT&CK and NIST CSF, ensuring thatenhance an organization’s security posture.

security controls are implemented and operating

Zscaler Internal Conformance: Zscaler
continuously monitors business activities andsystem infrastructure components to identify
potential security threats and vulnerabilities
internally. Through logging and monitoring tools,
Zscaler tracks system performance and alerts
IT operations of any unusual activity or service

effectively. Through its native, multi-tenant cloudand proxy-based architecture for full inspectionof encrypted traffic at scale, Zscaler ensures
optimal performance, reliability, and strong
security, meeting the needs of organizations
seeking to implement flexible and adaptive
security architectures.

requests. Weekly vulnerability assessments

Zscaler Internal Conformance: Zscaler’sand annual penetration tests are conducted to

ISO 27001 and SOC 2 certifications ensure

address weaknesses in the environment. An

that their change management policies andIncident Response Plan (IRP) ensures efficient

procedures are rigorously audited, emphasizing

management of cyber incidents, with defined

the confidentiality of information. These

incident types and procedures for resolution andcertifications mandate formal operational

investigation to prevent recurrence. Zscaler’schange management processes, clear roles

Information Security Risk Assessment Plan drives

and responsibilities, and segregation of duties.

planned third-party risk assessments at defined

Production and development environments areintervals against industry recognized security

segregated, and all changes, whether routine orframeworks, including ISO 27001 and SOC 2.

emergency, require approval and documentation.
Additionally, Zscaler maintains high-level

PRINCIPLE 6
Design Flexible Architectures

deployment requirements, including testing,

Objective: Implement digital services and update

impact assessments, documentation of system

legacy components to allow for easier integration

changes, and version control for all software.

of new security controls in response to changes

Through these processes, Zscaler ensures thatin business requirements, cyberthreats anddigital services can be effectively implemented

vulnerabilities.

and updated to integrate new security controls in

Zscaler Capability Support: Zscaler’s Zero Trust
Exchange is designed for performance, scalability,

management approval, establishment of restartpoints, code review by information security,

response to changes in business requirements,
cyberthreats, and vulnerabilities.

and flexibility, enabling organizations to easily
integrate new security controls in response tochanges in business requirements, cyberthreats,and vulnerabilities. Zscaler leverages sharedservices internally and integrates with various“best in class” services to optimize overall
security posture. Additionally, Zscaler’s Risk360©2024 Zscaler, Inc. All rights reserved.

PRINCIPLE 7
Minimize the Attack Surface
Objective: Use only the capabilities, software,data, and hardware components necessary fora service to mitigate cybersecurity risks whileachieving its intended use.
WHITE PAPER

06

Zscaler Capability Support: Zscaler provides

such as NIST 800-30, enable the identification,

comprehensive security features across its suite

analysis, and mitigation of potential risks,of services, designed to assist organizations

ensuring that security measures are continuallyin minimizing their attack surface. ZIA andevaluated and improved. Additionally, Zscaler’s

ZPA enforce traffic flows and provide security

Cloud Operations team meticulously manages

event and transaction logs for correlation andhardware decommissioning, maintaining strict

management, enabling organizations to monitor

control over the disposal process to prevent any

and mitigate potential threats effectively. The

residual security risks.

Zscaler Zero Trust Exchange ensures that users
are not placed on the network and applications
are never exposed to the internet, significantly
reducing the attack surface. Zscaler’s SSL

PRINCIPLE 8
Defend in Depth

inspection capabilities further enhance security

Objective: Create layered controls across a service

by decrypting HTTPS traffic to detect and block

so it’s harder for attackers to fully compromise

malicious content. Additionally, Zscaler’s Risk360

the system if a single control fails or is overcome.

and ZPC offerings enable continuous monitoring
and vulnerability detection, allowing organizations
to proactively address security risks. Throughdetailed documentation and administrator guides,
Zscaler supports organizations in configuring andmanaging their security settings effectively. Lastly,
ZDX provides device inventory tracking, ensuringthat service components are appropriately
identified and securely retired when necessary,
contributing to minimizing the attack surface.

Zscaler Capability Support: Zscaler provides
layered controls across its services, making it
challenging for attackers to fully compromise
systems. Through control by policy content
type, reputation-based blocking, content
scanning, advanced/multi-feature tools, andbehavioral analysis, Zscaler delivers a multifaceted approach to cyberthreat protection.
Zscaler Deception enhances this defense
strategy by proactively detecting and disrupting

Zscaler Internal Conformance: Zscaler ensuressophisticated threats with decoys and false userthat its service plane is accessible to the internet

paths, complementing the Zero Trust Exchange

while the management plane is off-network,

platform. Integration with endpoint protection

effectively reducing the potential attack vectors.

platforms like CrowdStrike or Carbon Black further

Rigorous scanning of all traffic for malware,enhances visibility and containment for advanced

coupled with comprehensive protection against

persistent threats, reducing threat dwell timeadvanced threats using patented Bytescan

and time to remediation. Furthermore, Zscaler’s

technology, enhances the security posture.

Risk360 provides mappings to security risk

Zscaler’s adherence to secure coding best

frameworks and reporting support for regulatory

practices, including static code analysis, quality

compliance, ensuring that security controls

assurance testing, and vulnerability scanning,are effectively implemented and operational.

further bolsters its defense mechanisms.

Together, these capabilities contribute to a

Moreover, Zscaler’s robust risk assessment andcomprehensive defense strategy that strengthensrisk treatment plan, based on industry standards

an organization’s resilience against cyberthreats.

©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

07

Zscaler Internal Conformance: Zscaler ensuresprograms of organizations. ZDX’s device

adherence to internationally recognized standards

and software inventory functionality enables

such as ISO 27001, SOC 2, and Cyber Essentials,

the identification of active vulnerabilities on

embedding diverse security controls throughout

associated devices, providing valuable insights

its service portfolio. Key components of

into potential security risks. Moreover, Zscaler’s

Zscaler’s multi-layer architecture include privacy

service scans all traffic bi-directionally forprotection at the web transaction, network, andmalware, employing heuristic analysis andadministrator levels, safeguarding customer

patented Bytescan technology to detect anddata through data segregation mechanisms.

mitigate advanced threats effectively. Zscaler’s

Zscaler’s incident management function,

ZIA Public Service Edges feature Single-Scan,

overseen by the Chief Security Officer, includes aMulti-Action technology, facilitating efficient

documented Incident Response Plan to efficiently

policy enforcement with minimal latency.

manage cyber incidents and minimize theirAdditionally, customers can leverage Zscaler’s

impact. Additionally, Zscaler conducts rigorous

embedded insights, reporting, logging,vulnerability assessments, penetration tests,

dashboards, and diagnostics to continuously

and developer training to identify and mitigate

monitor and analyze security posture, ensuringpotential vulnerabilities at various stages of theongoing confidence in the effectiveness ofdevelopment lifecycle, reinforcing the defense-

security controls. Through these capabilities,

in-depth strategy. These comprehensive

Zscaler empowers organizations to embedmeasures collectively strengthen Zscaler’s

continuous assurance into their security

resilience against cyberthreats and enhance its

operations, enhancing resilience against

ability to protect customer data andevolving cyberthreats.

infrastructure effectively.

PRINCIPLE 9
Embed Continuous Assurance
Objective: Implement continuous security
assurance processes to create confidence in theeffectiveness of security controls, both at the
point of delivery and throughout the operation lifeof the service.

Zscaler Internal Conformance: Zscaler conducts
information security and privacy risk assessments
regularly, complemented by an ongoing cycleof penetration testing performed by externalvendors. Furthermore, Zscaler’s complianceteam ensures alignment with internationallyrecognized standards such as ISO 27001, SOC 2,
and Cyber Essentials, providing customers withthe assurance of robust security measures. The
dedicated ThreatLabz Research team conducts

Zscaler Capability Support: Zscaler assists

expert-led research on emerging threats,

customers in ensuring the effectiveness ofleveraging expertise from 150+ world-classsecurity controls throughout the service

researchers and threat intelligence from vast data

lifecycle. ZIA’s Advanced Threats Protection

signals. Zscaler’s publicly available Cloud Activity

and Mobile Malware Protection policies provide

Dashboard offers real-time insights into global

robust defense against fraud, unauthorized

threat landscapes. Additionally, Zscaler employs

communication, and malicious apps, seamlessly

a range of tools for vulnerability scanning,

integrating into the vulnerability management

logging, monitoring, and intrusion prevention,©2024 Zscaler, Inc. All rights reserved.

WHITE PAPER

08

enabling proactive identification and mitigation of

considerations into the design, development, andsecurity threats. These comprehensive measures

deployment processes effectively.

underscore Zscaler’s commitment to continuous
security assurance and customer protection.

Zscaler Internal Conformance: Zscaler
implements robust configuration and change
management practices throughout all service

PRINCIPLE 10
Make Changes Securely

lifecycles. This includes adherence to the
Configuration Management Plan (CMP) andObjective: Embed security into the design,development, and deployment processes toensure that the security impact of changes is
considered alongside other factors.

the utilization of its internal ticketing system
to document and approve changes. The
responsibility for ensuring compliance with theseprocesses lies with key stakeholders such as
the CTO and VP of Engineering, who oversee

Zscaler Capability Support: Zscaler services aredevelopment, QA, deployment, SecOps, andequipped with intuitive interfaces to support

operations teams. Additionally, Zscaler employs

organizations in securely configuring theirboth manual and automated monitoring tools andservices according to industry best practices oremphasizes management involvement in day-to-

specific organization requirements. Furthermore,day operations, providing training and coaching

Zscaler’s Risk360 platform provides advanced

as needed. Furthermore, management conducts

risk management capabilities, offering aperiodic self-assessments to evaluate thecomprehensive view of risk across the customer’s

performance of control activities and processes,

environment. By gathering and quantifying risk

ensuring consistent application and effectivenessdata from various sources, including internalin mitigating risks. Each control activity isentities, configurations, and external attack

assigned a risk level based on the assessed levelsurface data, Risk360 empowers customers withof risk it addresses, determining the appropriate

actionable insights and recommendations throughlevel of scrutiny and testing to validate its efficacy.

intuitive workflows. Leveraging features like User

Overall, Zscaler’s approach prioritizes security

Risk Score and Configuration Risk Score, Risk360

throughout the organization’s processes andenables customers to measure and evaluate risk

operations, embedding security considerations

dynamically or integrate it into their overarching

into every stage of the design, development, andrisk register. This platform analyzes security data

deployment lifecycle.

in real-time, allowing customers to quantify risk
across key factors such as external attack surface,compromise likelihood, lateral propagation,and data loss, thereby embedding security

For additional information regarding the UK
Secure by Design Principles, please reach out to
our CISO team at Z-CISO@zscaler.com.

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient,resilient, and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks
and data loss by securely connecting users, devices, and applications in any location. Distributed acrossmore than 150 data centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline
cloud security platform. Learn more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134© 2024 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,
ZIA™, Zscaler Private Access™, ZPA™, Zscaler Digital
Experience, and ZDX™,and other trademarks listed at
zscaler.com/legal/trademarks are either (i) registeredtrademarks or service marks or (ii) trademarks orservice marks of Zscaler, Inc. in the United States
and/or other countries. Any other trademarks are theproperties of their respective owners.

zscaler.com