Cloud Proxy (Cloud-based Proxy) คืออะไร?
Cloud Proxy หรือ Secure Web Gateway (SWG) แบบ Cloud-native เป็น Proxy Server ที่โฮสต์บน Cloud Infrastructure (ไม่ใช่ On-premises Appliance) ทำหน้าที่เป็น Intermediary (ตัวกลาง) ระหว่าง User/Device กับ Internet — ตรวจสอบ, กรอง, และปกป้อง Traffic ทั้ง Inbound และ Outbound
🏢 ผู้ให้บริการ Cloud Proxy / SWG หลัก (Major Vendors)
| Vendor / Platform | Product Name | Key Differentiators | Target Market |
|---|---|---|---|
| Zscaler | Zscaler Internet Access (ZIA) | Largest Cloud Proxy, 150+ Data Centers, Full SSL Inspection at Scale, Zero Trust Exchange, CASB, DLP, Browser Isolation, Deception | Enterprise, Global, Regulated |
| Netskope | Netskope Security Cloud (SWG + CASB + DLP) | Data-centric Approach, Deep API Integration with SaaS (Office 365, Google, Slack, Box), Advanced DLP, Cloud Exchange | Enterprise, Cloud-first |
| Palo Alto Networks | Prisma Access (SASE) | Converged Network + Security (SD-WAN + FW + SWG + CASB + DLP), Single Pass Architecture, Global Network | Enterprise, Branch, Hybrid |
| Cisco (Umbrella) | Cisco Umbrella (SIG - Secure Internet Gateway) | DNS-layer Security First, Proxy (Selective/Full), CASB, DLP, Remote Browser Isolation, Talos Intel | Enterprise, Mid-market, MSP |
| Cloudflare (One) | Cloudflare One (Zero Trust / SWG) | Edge Network (300+ Cities), Warp Client, Browser Isolation, Email Security, DDoS, CDN Integration | Cloud-native, Developer-friendly, SMB-Enterprise |
| Forcepoint | Forcepoint ONE (SWG + CASB + DLP + RBI) | Human-centric Risk-adaptive Protection, Data-first Classification, Behavioral Analytics | Enterprise, Data Protection Focus |
| Fortinet | FortiSASE / FortiProxy (Cloud) | Integration with FortiGate/FortiClient, Single OS (FortiOS), ASIC Acceleration | Fortinet Shop, Hybrid |
| Menlo Security | Menlo Security Platform | Browser Isolation First (No Proxy Decryption Needed), Cloud Proxy, DLP | High Security, Isolation Focus |
| iboss | iboss Zero Trust SSE | Containerized Architecture, Distributed Gateway, No Backhaul | Distributed Workforce, Education |
| Broadcom (Symantec) | Symantec Web Security Service (WSS) | Legacy Proxy Leader, ICAP, DLP, CASB, Integrated with Endpoint | Legacy Symantec Customers |
| Microsoft | Microsoft Entra Internet Access (Global Secure Access) | Integrated with Entra ID, Conditional Access, Defender for Cloud Apps, Global Network | Microsoft 365/Entra Ecosystem |
| Chrome Enterprise Premium / BeyondCorp Enterprise | Browser-native, Zero Trust, Device Trust, Data Protection | Chrome/Workspace Shops |
🔬 Zscaler Deep Dive: ทำไมจึงเป็น Market Leader?
Zscaler เป็นพัฒนาต้นแบบและนำตลาด Cloud Proxy / SWG มา >15 ปี (ก่อตั้ง 2008) แนวคิดหลัก: Zero Trust Exchange — "Never Trust, Always Verify" ไม่ขึ้นอยู่กับ Network Location
Zscaler Architecture: Proxy-based (Full SSL Inspection at Scale)
- Inline Proxy: User Traffic → Zscaler Enforcement Node (PoP) → Inspect (SSL Decrypt) → Policy Enforce → Forward to Destination
- Single Pass Architecture: ทุก Security Service (FW, SWG, CASB, DLP, Sandbox, RBI) รันใน Single Pass — Low Latency
- Global Cloud (150+ Data Centers): User Connect ใกล้ที่สุด (Low Latency) — No Backhaul to HQ
- Unlimited SSL Inspection: ไม่จำกัด Port/Throughput — Flat Price per User
- No Appliance: 100% Cloud, No Hardware to Manage/Patch
Zscaler Services (Modules)
| Module | Function |
|---|---|
| ZIA (Zscaler Internet Access) | SWG: URL Filtering, Malware Protection, SSL Inspection, Cloud Firewall, DNS Security, RBI |
| ZPA (Zscaler Private Access) | ZTNA: App Segmentation, No VPN, App Connector, Micro-segmentation |
| ZDX (Zscaler Digital Experience) | DEM: User Experience Monitoring, Hop-by-hop Visibility, ISP/Last-mile/ App Health |
| Zscaler CASB | SaaS Security: Discovery, DLP, Threat Protection, Configuration Audit (Office 365, Google, Slack, Salesforce, GitHub, AWS, Azure, GCP) |
| Zscaler DLP | Data Loss Prevention: Exact Match, Regex, Dictionary, OCR, Fingerprinting, Cloud/Endpoint/Email/Channel |
| Zscaler Deception | Decoys, Honeypots, Credential Lures, Active Directory Deception |
| Zscaler Workflow Automation | SOAR-lite: Playbooks, Integrations (ServiceNow, Jira, Splunk, SIEM, Ticketing) |
⚙️ Cloud Proxy ทำงานอย่างไร? (How It Works)
- Traffic Redirection: User/Device ส่ง Traffic ไป Internet → Traffic ถูก Redirect ไป Cloud Proxy (via PAC File, Proxy Auto-Config, Forward Proxy Settings, GRE/IPsec Tunnel, Agent/Client, Browser Extension, DNS Forwarding)
- Authentication & Identity: Proxy ระบุ User/Device Identity (SAML/SCIM/AD Sync, Kerberos, Header Injection, Client Cert, ZPA App Connector)
- Policy Lookup: Match Traffic กับ Policy Engine (User/Group, Department, Location, Device Posture, Time, App/Category, Risk Score)
- SSL/TLS Inspection (Decrypt): Proxy สร้าง Certificate On-the-fly (Trusted Root CA ต้อง Deploy ไป Client) → Decrypt HTTPS → Inspect Payload
- Threat Prevention: AV Scan (Streaming), Sandbox (Suspicious Files), IPS Signatures, Threat Intel Feeds, C2 Callback Detection
- Data Protection (DLP): Scan Content (Regex, Dictionary, Fingerprint, OCR) → Block/Quarantine/Alert/Encrypt
- URL/Category Filtering: Allow/Block/Caution/Isolate ตาม Category (Gambling, Adult, Malware, Phishing, C2, Newly Registered Domains)
- Logging & Analytics: Log ทุก Transaction (Allowed/Blocked) → SIEM / Log Analytics / Zscaler Nanolog Streaming Service (NSS) / ZDX
- Forward to Destination: Re-encrypt (ถ้า HTTPS) → Forward → Receive Response → Inspect Response → Return to User
🔐 SSL/TLS Inspection: หัวใจของ Cloud Proxy สมัยใหม่
- >90% ของ Web Traffic เป็น HTTPS — ไม่ Decrypt = ไม่เห็น Threat/Data
- Cloud Proxy ทำ Man-in-the-Middle (MitM) แบบ Legitimate — Proxy มี CA Certificate ที่ Trusted โดย Client (Deploy via GPO/Intune/Jamf/MDM)
- Certificate Pinning / HSTS / HPKP อาจทำให้ Inspection ล้มเหลว — ต้องมี Bypass List (Microsoft 365, Windows Update, Banking, Health, Certificate Transparency Logs)
- Performance: Zscaler ใช้ Streaming Scan (ไม่ Buffer ทั้งไฟล์) + ASIC/FPGA Acceleration ใน Data Center
📋 Deployment Models (วิธีส่ง Traffic ไป Cloud Proxy)
| Method | คำอธิบาย | Pros | Cons |
|---|---|---|---|
| Forward Proxy (Explicit) | Browser/OS ตั้งค่า Proxy IP:Port (PAC/WPAD) | Simple, Transparent to Apps | User เปลี่ยนได้, Non-browser Traffic Miss |
| Transparent Proxy (GRE/IPsec Tunnel) | Router/FW ส่ง Traffic ทั้งหมดไป Proxy Tunnel | All Traffic (Non-browser), No Client Config | Complex Routing, MTU Issues, Source IP Preservation |
| Agent/Client (Zscaler Client Connector, Netskope Client, Cisco Secure Client) | Lightweight Agent บน Endpoint ทำ Tunnel (DTLS/TLS) ไป Cloud | Full Visibility, Device Posture, Roaming, Off-network Protection | Deploy/Manage Agent, Resource Usage |
| Browser Extension | Extension จัดการ Proxy Settings + Certificate | Easy Deploy (Browser Managed), Per-browser | Browser Only, User Can Disable |
| PAC File (Proxy Auto-Config) | JavaScript Function คืนค่า Proxy สำหรับ URL แต่ละตัว | Flexible, Failover, Bypass Rules | Complex Logic, Caching Issues |
✅ Best Practices: การปรับใช้ Cloud Proxy ให้ได้ผลสูงสุด
- Phase 1: Monitor Only (Passive Mode) — Deploy Agent/PAC แต่ Set Policy = "Allow All + Log" → Baseline Traffic, Identify Apps, Find Breakage (Certificate Pinning, Legacy Apps)
- Phase 2: Selective SSL Inspection — Decrypt High-risk Categories (Newly Registered, Malware, Phishing, C2) + Bypass List (Banking, Health, Windows Update, Microsoft 365, Certificate Transparency)
- Phase 3: Full SSL Inspection + DLP/CASB — Enable DLP Policies (PII, PCI, PHI, Source Code), CASB API Connectors for Sanctioned Apps
- Phase 4: Zero Trust (ZPA/ZTNA) — Replace VPN with App-level Access, Micro-segmentation
- Certificate Management: Deploy Root CA Cert ไปทุก Endpoint (GPO, Intune, Jamf, MDM, SCCM) — Automate Renewal
- Bypass List Maintenance: Review Monthly — Remove Unnecessary Bypasses, Add New Critical Services
- Integration: SIEM (Splunk, Sentinel, Elastic), SOAR, Ticketing (ServiceNow, Jira), Identity (Entra ID, Okta, Ping), Endpoint (CrowdStrike, SentinelOne, Defender)
- User Experience Monitoring (ZDX/DEM): Measure Latency, Jitter, App Score — Correlate with Proxy Policy Changes
- Regular Policy Review: Quarterly — Remove Stale Rules, Tighten Over-permissive, Update Categories
- Threat Hunting on Proxy Logs: Beaconing, Data Exfiltration (Large Uploads to Rare Domains), Credential Theft Patterns, Living-off-the-Land Binaries (LOLBins) Download
❓ FAQ
Q: Cloud Proxy vs Traditional On-prem Proxy (Blue Coat, Websense, McAfee Web Gateway) ต่างกันยังไง?
A: Cloud Proxy = No Hardware, Elastic Scale, Global PoPs (Low Latency for Remote Users), Always Updated Threat Intel, No Maintenance/Patching, Subscription Model — On-prem = Capex, Fixed Capacity, Backhaul Latency, Manual Updates, Hardware Refresh Cycle
Q: Zscaler คือ Forward Proxy หรือ Reverse Proxy?
A: Forward Proxy (Outbound) — User → Zscaler → Internet. Zscaler ไม่ใช่ Reverse Proxy (Inbound: Internet → Zscaler → Internal App) — สำหรับ Inbound ใช้ ZPA (ZTNA) หรือ Cloud Connector
Q: Zscaler ใช้ SOCKS Proxy ไหม?
A: ไม่ — Zscaler ใช้ HTTP/HTTPS Proxy (Explicit/Transparent) และ DTLS/TLS Tunnel (Client Connector) — ไม่รองรับ SOCKS4/5
Q: Cloud Proxy รองรับ Non-HTTP Traffic (SSH, RDP, Gaming, Custom TCP/UDP) ไหม?
A: Traditional SWG/Proxy รองรับแค่ HTTP/HTTPS/DNS — สำหรับ Non-HTTP ต้องใช้ ZTNA (ZPA, Prisma Access, Netskope Private Access, Cloudflare Access) หรือ Cloud Firewall / SASE ที่รองรับ L4 Protocol Forwarding
Q: ค่าใช้จ่าย Cloud Proxy ประมาณเท่าไหร่?
A: Per User/Year Model — Zscaler ZIA: ~$50-120/user/yr (ขึ้นกับ Bundle: SWG, CASB, DLP, RBI, Sandbox) — Enterprise Volume Discount ใช้ได้ — คุ้มกว่า On-prem Appliance (Hardware + Maintenance + Power + Space + Staff)
สรุป: Cloud Proxy (SWG) เป็น Standard สำหรับ Hybrid/Remote Workforce — Zscaler เป็น Market Leader ด้วย Architecture Proxy-based, Global Scale, Full SSL Inspection ควร Deploy แบบ Phased (Monitor → Selective Decrypt → Full + DLP/CASB → ZTNA) พร้อม Certificate Management และ SIEM Integration
