5.3 Cloud App Control & Inline CASB

5.3 Cloud App Control & Inline CASB

Architectural Premise: As enterprise workloads migrate to Software-as-a-Service (SaaS), traditional URL filtering is insufficient. Blocking an entire domain like box.com or onedrive.com halts corporate operations, while allowing it unconditionally opens massive data exfiltration vectors. ZIA Cloud App Control acts as an inline Cloud Access Security Broker (CASB), providing deep Layer 7 application visibility, Shadow IT discovery, granular functional controls (e.g., allow viewing documents while blocking uploads), and multi-tenant restriction header injection.

---

1. Shadow IT Discovery & SaaS Risk Profiling (CARA)

In modern enterprises, business units frequently adopt unsanctioned SaaS tools without IT or InfoSec approval—a phenomenon known as Shadow IT. ZIA automatically identifies, catalogs, and assesses every SaaS application accessed across the corporate network.

+-----------------------------------------------------------------------------+
|                   SHADOW IT DISCOVERY & GOVERNANCE FLOW                     |
+-----------------------------------------------------------------------------+

  1. INLINE DISCOVERY: ZIA Public Service Edge passively inspects all SaaS traffic
  2. RISK PROFILING: CARA calculates 0-100 Risk Score across 40+ attributes
  3. CLASSIFICATION: Applications tagged as Sanctioned, Unsanctioned, or Discovered
  4. POLICY ACTION: Enforce granular functional controls or tenant restrictions
  5. CONTINUOUS AUDIT: Monitor Shadow IT trends in Cloud App Insights

Cloud Application Risk Assessment (CARA) Scoring

Zscaler maintains a dynamic database of tens of thousands of SaaS applications, evaluating each on a 0 to 100 Risk Index based on objective security criteria:

+-----------------------------------------------------------------------------+
|                      ZSCALER SaaS RISK INDEX (0 - 100)                      |
+-----------------------------------------------------------------------------+
|  [ 0 - 39: Poor / High Risk ]  --> Immediate Shadow IT threat; block/isolate|
|  [ 40 - 69: Medium Risk ]      --> Restrict functional actions / DLP inspect|
|  [ 70 - 100: Good / Low Risk ] --> Sanctioned enterprise-grade applications |
+-----------------------------------------------------------------------------+

---

2. Cloud App Categories & Granular Functional Actions

ZIA groups SaaS applications into functional categories, enabling administrators to define targeted access controls across entire classes of tools or specific applications:

+-----------------------------------------------------------------------------+
|                       MAJOR CLOUD APP CATEGORIES                            |
+-----------------------------------------------------------------------------+
|  * AI & ML Tools: ChatGPT, Claude, Microsoft Copilot, Gemini, Midjourney    |
|  * Collaboration: Microsoft Teams, Slack, Zoom, Cisco Webex, Miro          |
|  * Cloud Storage: OneDrive, Google Drive, Box, Dropbox, SharePoint         |
|  * Social Media: LinkedIn, X (Twitter), Facebook, Instagram, Reddit        |
|  * Webmail: Microsoft Exchange Online, Gmail, Outlook.com, Yahoo Mail       |
|  * Developer Tools: GitHub, GitLab, Bitbucket, AWS Management Console       |
+-----------------------------------------------------------------------------+

Granular Functional Action Matrix

Unlike traditional firewalls that only permit or deny IP addresses, ZIA decrypts HTTPS sessions and inspects the underlying REST API methods, JSON payloads, and HTTP parameters. This enables granular functional controls:

+-----------------------------------------------------------------------------+
|                     GRANULAR FUNCTIONAL ACTIVITY ENGINE                     |
+-----------------------------------------------------------------------------+

   User Action:         HTTP Method / API Inspection:      Policy Verdict:
   ---------------------------------------------------------------------------
   [ View / Browse ]    GET /drive/v2/files/123            ==> ALLOWED
   [ Download File ]    GET /drive/v2/files/123?alt=media  ==> ALLOWED
   [ Post / Comment ]   POST /api/v1/conversations/posts   ==> ALLOWED
   [ Upload File ]      POST /drive/v2/files/upload        ==> BLOCKED (DLP)
   [ Share / Invite ]   PUT /drive/v2/permissions/user     ==> BLOCKED

---

3. Tenant Restrictions (M365, Google Workspace, Box)

The Multi-Tenant SaaS Dilemma

In modern enterprises, employees use Microsoft 365 or Google Workspace for daily work. However, when an employee navigates to login.microsoftonline.com or accounts.google.com, they can log in using their personal account (e.g., user@outlook.com or user@gmail.com) or a competitor's tenant, and upload sensitive intellectual property.

Traditional firewalls cannot solve this because the domain and certificate match legitimate corporate SaaS endpoints.

ZIA Tenant Restriction Header Injection

ZIA solves this dilemma by decrypting the TLS handshake, intercepting the authentication request, and injecting cryptographically validated tenant headers into outbound HTTP requests:

+-----------------------------------------------------------------------------+
|               TENANT RESTRICTION HEADER INJECTION MECHANICS                 |
+-----------------------------------------------------------------------------+

  1. User initiates login to https://login.microsoftonline.com
  2. ZIA Public Service Edge decrypts TLS session (SSL Inspection Required)
  3. ZIA injects proprietary HTTP request headers:
     * Restrict-Access-To-Tenants: "globalcorp.com, globalcorp.onmicrosoft.com"
     * Restrict-Access-Context: "72f988bf-86f1-41af-91ab-2d7cd011db47"
  4. Microsoft Identity Platform inspects headers:
     * User attempting login with @globalcorp.com ===> PERMITTED
     * User attempting login with @personal-outlook.com ===> REJECTED (HTTP 403)

Tenant Restriction Header Formats

[!IMPORTANT] Prerequisite for Tenant Restrictions: SSL/TLS Deep Inspection MUST be enabled on authentication domains (e.g., login.microsoftonline.com, accounts.google.com). If SSL inspection is bypassed, ZIA cannot inspect or inject headers into the encrypted HTTP request stream, rendering Tenant Restrictions completely ineffective.

---

4. Generative AI Governance & Prompt Controls

The explosive adoption of Generative AI (GenAI) platforms (ChatGPT, Claude, Microsoft Copilot, Gemini, Perplexity) introduces acute data loss and intellectual property risks. Employees inadvertently paste proprietary source code, internal financial models, and customer PII into prompts.

ZIA provides dedicated Generative AI Governance capabilities:

+-----------------------------------------------------------------------------+
|                     GENERATIVE AI POLICY ARCHITECTURE                       |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [1] Sanctioned vs. Unsanctioned GenAI Routing:                             |
|      Allow corporate enterprise instances (e.g., Microsoft Copilot with     |
|      Enterprise Data Protection); block public consumer AI tools.           |
|                                                                             |
|  [2] Functional Activity Controls:                                          |
|      Allow engineers to View/Query prompts; Block File Attachments/Uploads. |
|                                                                             |
|  [3] Real-Time Prompt DLP Inspection:                                       |
|      Inspect text payloads in flight; block prompts matching regex patterns |
|      for source code, API keys, Social Security Numbers, or credit cards.   |
|                                                                             |
|  [4] User Coaching & Acceptable Use Interstitials:                          |
|      Display caution interstitials educating staff on responsible AI use.   |
|                                                                             |
+-----------------------------------------------------------------------------+

---

5. Practical Configuration Walkthrough: Enterprise CASB Policy

Scenario: GlobalCorp mandates the following cloud security policy:

1. Sanctioned cloud storage is Microsoft OneDrive / SharePoint (Company Tenant: globalcorp.com).
2. Unsanctioned personal cloud storage (Dropbox, Box, Google Drive) must be restricted to View/Download only; Uploads and Sharing are blocked.
3. Public Generative AI tools (ChatGPT, Claude) are blocked for all standard users, but permitted with prompt DLP scanning for R&D staff.
4. Microsoft 365 logins to non-corporate tenants are strictly blocked.

Production CASB Configuration Table