Zero Trust Network Access: “Unlocking the core principals of Skyhigh

private access“

May 2023
Komal Grover
Professional services consultant
 Hybrid Work Model: Changing the Security
Landscape
• Remote and hybrid work scenarios are transforming the
workplace.
• IT security must change to meet the needs of this new
reality.

• Traditional security can lead to:

• Bypassing on-premises security
• Malware intrusion
• Data loss

2
 VPN as a Security Target

57% 2000%
of cyberattacks occurred increase in VPN attacks as
while using a VPN 4 companies embrace a hybrid
workplace 5

3
4
Forbes, Business VPN Users Safety, March 6, 2023
5
Help Net Security, VPN Attacks Up, June 15, 2021
VPN Access Limitations

VPN
Implicit trust
Network-level access
No contextual access
No content-malware
inspection
Unscalable and no support for
BYOD

4
4
 The Era of Zero Trust

• Zero Trust is the term for an evolving set of cybersecurity

paradigms that move defenses from static, network-based
perimeters to focus on users, assets, and resources.

• A Zero Trust Architecture uses zero trust principles—

ZERO
including “never trust, always verify”—to plan industrial
and enterprise infrastructure and workflows.

TRUST • 60% of organizations will embrace Zero Trust as a starting

point for security by 2025.

5
8
Gartner Unveils the Top Eight Cybersecurity Predictions, June 21, 2022
ZTNA: How It Works

6
6
Introducing Skyhigh Private
Access

7
 Skyhigh Private Access

Client based access

Clientless access

8

Scalable Cloud Capacity
• Skyhigh service provides infinite
scalability
• No on-prem appliances
• Reduce MPLS-costs
• User connects to the nearest PoP,
to improve user experience
• Allows access with an agent or
agentless
Data-Aware ZTNA
More Private Apps Outside
the Datacenter
• No backhauling. Remote users
connect to the applications hosted
in public cloud from our global
network of PoPs
• Low latency
• The private applications are
invisible to internet
Adhere to Zero Trust
Principles
• Tailored access policies (Identity,
application, context and dynamic
device posture)
• Secures the data flow using RBI,
DLP and Advanced Threat
protection
• Access to individual resources is
granted on a per-session basis
Gain Visibility About How Data Is Used – The Ideal use cases

Skyhigh Private Access provides: Secure access for managed and unmanaged devices Unified policy across
web, SaaS, and private applications from a fully converged platform managed by a single console.

Integrated Data Loss Prevention (DLP) scanning and seamless Remote Browser Isolation (RBI) integration
for robust data protection.

Antimalware scanning and emulation-based sandboxing to prevent malware from being uploaded to private
apps

Provides auto discovery and application access visibility that helps to identify applications accessed by a
user/set of users to provide granularity in the application access.

10
Understanding the
architecture

11
 Private access architecture
Distributed Routing Table

Internet Internet Connector 1

Encrypted Tunnel Encrypted Tunnel

Intranet

Geo1 – PoP1 Geo2 – PoP2

Internet
En

Engg App
cr

Connectivity HR App
yp

hr.acme.com engg.acme.com
te

Options
d
Tu
n ne
l

Internet Connector 2

Encrypted Tunnel Intranet

End User
Device

Geo3 – PoP3

HR App Mfg App

hr.acme.com mfg.acme.com
 Private Access Workflow
Customer IaaS environment

Manage Connectors Marketing App

Connector Group <> Application mkt.skyhigh.com
PA
Connector 1
App List
Device Info K8S Container
TCP, RDP, SSH, HTTPs
Application
Customer Corporate Net – Site 1

HR App
Client-initiated
hr.skyhigh.com
Secure Channel

SWG DLP RBI Malware Private Access

(ZTNA) PA Engineering App
Skyhigh & GTI
Connector 2 eng.skyhigh.com
Client Proxy

Connector-initiated
Secure Channel
Customer Corporate Net – Site 2
hr.skyhigh.com

SCP checks if this is a HR App

PA application hr.skyhigh.com

C1234567890.wgcs.skyhighcloud Connector 2/3 PA Marketing App

Connector 3 mark.skyhigh.com
Skyhigh cloud
configuration for Private
access

14
Ease of Installation: Connector Installation Script

Connector installation
• Download the PoP package
• extract the package to get the
installation script : infra.sh
• Run the script with the
required parameters

15
Getting the provisioning key

16
Status of the deployed connectors

17
Creating an applications for managed and unmanaged devices

18
Creating access policies

19
Smooth SAML integration with all IDPs

20
Web Security ZTNA RBI CASB Network Security UBA Central Management
Enabling Remote
Working

Use case: Access to SSE (Landing Portal)

21
22
Private access analytics

23
Thank You!

www.skyhighsecurity.com