Lock down web browsers on the remote devices Test web browsers to verify they are working as planned. SSL Decryption Setup Item Description Notes Date Complete Use of SSL Determine if and Document on how SSL Decryption Decryption how the agency will works with Zscaler: use SSL Decryption Setup of SSL If SSL decryption is Decryption going to be used configure SSL decryption in the admin tool and setup in the manner the agency has decided. Determine To use SSL The DET desktop group distributed the distribution of decryption an Zscaler certificate as a Group Policy to certificate agency will need to all DOA, DSPS and SASI staff for the IE deploy the SSL and Chrome browsers. Decryption Deploying the Zscaler Root Certificate certificate to the to Firefox is challenging, as the browser agency desktops. does not respect the system certificate The agency needs to store, and instead uses its own. One determine how this method to deploy the cert to Firefox certificate will be would be to use a batch file or script to distributed. replace the cert8.db file with a version that contains the Zscaler Root Certificate. Another way is to create user instructions and have each user using Firefox import the certificate. . SSL bypass list If an agency elects to dropbox - LogMeIn - . . - . . turn on SSL Office365 - . decryption Zscaler JoinMe - . recommends adding HSDC - certain sites to the Standard Bank - SSL bypass list. Google Drive (Desktop client) - . . Zscaler High-Level Testing Template:
Lock down web browsers on the remote devices Test web browsers to verify they are working as planned. SSL Decryption Setup Item Description Notes Date Complete Use of SSL Decryption Determine if and how the agency will use SSL Decryption Document on how SSL Decryption works with Zscaler: Setup of SSL Decryption If SSL decryption is going to be used configure SSL decryption in the admin tool and setup in the manner the agency has decided. Determine distribution of certificate To use SSL decryption an agency will need to deploy the SSL Decryption certificate to the agency desktops. The agency needs to determine how this certificate will be distributed. The DET desktop group distributed the Zscaler certificate as a Group Policy to all DOA, DSPS and SASI staff for the IE and Chrome browsers. Deploying the Zscaler Root Certificate to Firefox is challenging, as the browser does not respect the system certificate store, and instead uses its own. One method to deploy the cert to Firefox would be to use a batch file or script to replace the cert8.db file with a version that contains the Zscaler Root Certificate. Another way is to create user instructions and have each user using Firefox import the certificate. SSL bypass list If an agency elects to turn on SSL decryption Zscaler recommends adding certain sites to the SSL bypass list. dropbox - . LogMeIn - . . - . . Office365 - . JoinMe - . HSDC - Standard Bank - Google Drive (Desktop client) - . . Zscaler High-Level Testing Template:
Web%20Security%20Agency%20Setup%20Guide%20Template.docx