Ricoh strengthened its global security for 45,000 users with zero trust architecture.

Introduction

The transition to zero trust is more than just a security measure; it also means rebuilding the important foundation that supports a company's digital transformation. Ricoh Company, Ltd., which is promoting a global transformation into a digital services company, has taken the step of fundamentally reviewing its security using Zscaler products, as traditional perimeter defense has reached its limits. While solving various issues such as addressing VPN vulnerabilities, establishing remote work environments, and speeding up M&A, Ricoh has built a company-wide zero trust environment, successfully enhancing its competitiveness as a global company while protecting customer data.

As a digital services company, we decided to transition to a zero trust environment.

Ricoh Company, Ltd. (hereinafter referred to as “Ricoh”) has been developing and producing familiar products such as multifunction devices and printers, and has consistently supported office operations since its founding in 1936. Ricoh has expanded into roughly 200 countries, with approximately 80,000 employees across the group conducting business. The company's consolidated sales exceeded 2.3 trillion yen in 2024, with 63.1% of that coming from overseas sales, solidifying its position as a global company. 

In recent years, Ricoh has expanded its service business and is promoting a transformation into a digital services company. As part of this effort, the company has restructured its organization from a traditional vertical business division structure to functional and purpose-based business units (BUs). Mr. Hiroki Kobayashi states, “With these transformations, the role of IT is also changing.”

“In response to the growing demand for digital transformation (DX) among our customers, the Ricoh Group itself is also working to strengthen its digital infrastructure. In particular, strengthening the security of our IT infrastructure is the most important issue. As the amount of customer data we handle has been increasing, we needed to raise our security level,” says Mr. Kobayashi.

As part of this initiative, Ricoh decided to move away from traditional perimeter defense and transition to a zero trust environment. The reasons behind this decision were to support the rapid increase in remote work due to the COVID-19 pandemic and to resolve urgent issues such as vulnerabilities of Virtual Private Networks (VPNs).

The rapid increase in remote work strained VPN resources and increased the human resources required for maintenance and operation. At the same time, the expansion of cloud environments has eliminated the need to store and process all data within in-house data centers as was the case in the past. On the other hand, a new issue emerged in the form of differences in security levels between inside and outside the company.

The most serious issue occurred in 2021, when a serious vulnerability was found in the VPN service a customer was using, which allowed unauthorized code to be executed without authentication. It took a week to provide a security patch, and during that time, emergency response to security risks, including 24-hour monitoring, was necessary.

Mr. Kobayashi reflects, “This experience was the deciding factor in our transition to a zero trust environment.”

The deciding factor for Zscaler was whether it could achieve a smooth transition for 45,000 users.

What Ricoh placed emphasis on in building a zero trust environment was a smooth transition from its existing VPNs, a robust global support system, and stable operation after implementation. After comparing multiple products and services, the company decided to implement Zscaler. Ricoh's European units had already implemented and were operating Zscaler, making it a strong candidate from the perspective of global solution standardization. Mr. Ryo Mizoguchi explains the technical advantages of Zscaler as follows.

“Zscaler's Zscaler Client Connector (ZCC) can coexist and be used in conjunction with other companies' VPN clients by properly configuring traffic separation. The most important thing is that no disruption of end-user operations is caused. We also highly valued the fact that client installation and operational management are relatively easy. In addition, the fact that the system integrators and network vendors that supported the implementation had experience with Zscaler gave us peace of mind.”

Mr. Tomoaki Tsunogai says that a number-of-users-based billing model was more suitable than a data usage-based billing model for a large organization with 45,000 users. An investigation after implementation revealed that data usage was more than double the initial estimate. Mr. Tsunogai reflects, “If we had implemented a data usage-based service, it would have resulted in a significant increase in costs.”

Mr. Michio Shindo says he felt reassured by Zscaler's extensive support system.

“The fact that they were able to respond face-to-face when a problem arose dispelled any concerns we had at the time of implementation. There were no language or response issues, which are common with foreign vendors, and the careful support provided by their Japanese subsidiary was a great source of reassurance.”

The last line of defense in security is manpower. Gradual roll-out and employee autonomy led to achievements.

The implementation of Zscaler proceeded in three stages of preliminary preparation, starting roll-out, and management and promotion, and was completely rolled out for 40,000 users in about six months. Mr. Mizoguchi reflects on the process as follows.

"During the preliminary preparation, we tested connections with core systems while carefully examining the impact of changes to the source IP address. The roll-out began with the IT department, followed by the entire group outside of Ricoh Japan, and finally Ricoh Japan itself. Particularly, the roll-out to Ricoh Japan, which we determined to be difficult due to the high number of employees using smartphones, began with PCs and then expanded to smartphones."

Furthermore, Mr. Kobayashi says that the most important innovation of the implementation was security education.

“For the roll-out of Zscaler, we adopted a method that requires each user to install the agent on their own device. It might be more efficient to distribute it collectively from the IT department, but the last line of defense in security is manpower. Thanks to the security education we had been working on for some time, our employees took the implementation as their own responsibility and responded proactively. This was the biggest factor in the success of the roll-out.”

Achieved both user convenience and security Contributed to speeding up M&A processes

The benefits of implementing Zscaler are wide-ranging. One of the most notable benefits is the visualization of security. Suspicious communications that were previously difficult to identify have become clearer, which will be useful directly in planning future countermeasures.

In addition, by integrating Zscaler logs with the extended detection and response (XDR) system, grasping and analyzing company-wide security status was made possible. This improved forensic capabilities such as identifying the cause and visualizing the scope of impact when an incident occurs, greatly enhancing response capabilities.

Operational efficiency has also improved significantly. Mr. Tsunogai says, “Previously, we managed multiple security systems, such as VPNs and network devices, in parallel, and two service managers were required even for VPN management alone. After implementing Zscaler, VPN management can be sufficiently handled by one person, allowing us to allocate human resources to other tasks.”

From the business aspect, a secondary benefit, the speeding up of the M&A process, was also achieved. With the implementation of Zscaler, it became possible to immediately establish a secure communication environment regardless of the security level of the counterpart company. In addition, whereas previously individual security devices had to be installed and managed at each location, Zscaler enabled their centralized management, significantly improving cost efficiency.

Furthermore, end-user convenience has also improved dramatically. Mr. Kobayashi says, “Previously, it was necessary to turn the VPN connection on and off, but that is no longer necessary. We can now maintain a high level of security without requiring users to take care of security measures, which is a major achievement.”

The key to strengthening security measures is cooperation with a reliable partner.

Ricoh will continue to promote the further strengthening of its zero trust environment based on Zscaler. First, it is making thorough utilization of the functions that have already been implemented, and is currently rolling out zero trust to 400 locations in Japan. Furthermore, it is standardizing security solutions globally, which used to differ between regions, to achieve both standardized security levels and cost optimization at the same time.

Mr. Kobayashi talks about Ricoh’s future security strategies as follows.

“Security is extremely complex, and it is not realistic for a company to handle everything on its own. In the manufacturing industry in particular, it is important to focus on your core areas while building a security system in collaboration with reliable partners. This is the path Ricoh has chosen, and we believe it will be the key that supports our future growth.”