Zscaler Outages Highlight Risk of Cloud-based Cybersecurity

Recent outages at Zscaler underscore the need for companies to be prepared for such downtime. The week before one of the disruptions, Zscaler warned customers that there could be packet loss because of damaged cables that could impact transoceanic routes. Forrester Research VP and research director for security and risk Merritt Maxim noted, “Cloud products and services are not necessarily more susceptible to outages than on-prem equivalents, [but] the issue is often that because of this perception, organizations do not properly assess all possible causes of cloud outages and develop mitigation plans in response to these threats.”

Note

• All cloud services have Service Level Agreements that specify a percentage of downtime that if exceeded results in some reduction of your next month’s bill – SLAs don’t cover the cost of your business interruption. Those SLAs also have fairly complex terms and conditions that often exclude certain types of traffic (such as streaming) or unusually high volumes of business traffic. So, decisions on fail open (allow traffic to bypass outage) vs. fail closed, as well as backup plans, need to be in place and tested in advance for all cloud based security services and any business critical cloud services. SLAs should be reviewed by contracts, legal and security.
• Understand what the impact of outages are for outsourced services. When you purchased Zscaler or AWS, you definitely paid for a higher service level, but did you factor in the impact of outages, to include you not being able to affect the recovery with just-in-time resources or equipment? Make sure that you’ve considered contingencies, particularly for services which represent entry points to your business systems. Make, and document, decisions to allow interruptions, or work-arounds. Test those workarounds. Review regularly as more services get moved to external providers.

Read more in

• Zscaler’s Cloud-Based Cybersecurity Outages Showcase Redundancy Problem