Cyber safety and web filtering
Zscaler Security
The platform that keeps student internet access safe and appropriate at school, and what it does, and doesn't do, once the MacBook comes home.
Zscaler is the cyber security and web filtering platform used by Catholic Education, Diocese of Wollongong (CEDoW) and St Francis Catholic College to protect staff, students, devices and data across our networks.
In plain terms, it is what makes sure that when a student opens a browser at school, they reach safe and appropriate content, and that harmful sites, malware and phishing attempts are stopped before they load.
It operates at both the device level and the network level, which means protection travels with the MacBook onto our network rather than depending on a single filter at the school's front door.
Three components work together. All are installed automatically during device enrolment.
A digital certificate authority certificate that allows Zscaler to inspect encrypted web traffic for threats.
A small app that runs quietly in the background and routes the Mac's internet traffic through Zscaler's protection while at school.
The service that does the actual filtering, security inspection and logging (see below).
Sign in as soon as you're prompted
After the Client Connector installs, your child must sign in. Zscaler hands them to the College's Okta login page, which asks for their username only: just the username, with no @ and nothing after it.
Until they sign in, Zscaler blocks the Mac's internet connection entirely. This is called Zero Trust Connectivity and it is working as designed, not a fault. It catches out a lot of families during setup.
The Client Connector app sits in the Applications folder, and shows as a small cloud icon in the menu bar at the top of the screen. Opening it shows whether Internet Security is active for the network the Mac is currently connected to.
For student safety, CEDoW restricts the Client Connector so that students cannot disable the service or uninstall the app. If the app is behaving oddly, please contact the IT team rather than attempting to remove it.
ZIA works alongside the Client Connector and is how the College secures, filters and logs internet traffic on our network.
By default it is enforced only while a device is on the College network. While active, it:
The point of filtering isn't to restrict for its own sake. It's to help students stay engaged and focused in class, and to keep harmful material away from them during the school day.
The short answer
No. Zscaler filtering is not active at home. Once the device leaves the College network, Internet Security switches off and ZIA no longer filters or logs anything.
The CA Certificate stays installed and the Client Connector keeps running in the background, but the filtering service itself is inactive. This means apps and websites that are blocked at school will be accessible at home.
You can verify this yourself: open the Client Connector app while at home and check that Internet Security shows as OFF.
We are upfront about this because families sometimes assume the school's filtering follows the device home. It does not. Managing internet use at home remains a family responsibility, and your home router, internet provider or a family safety app are the tools for that.
If you'd like filtering at home too
We know that helping children build healthy technology habits can be difficult and ongoing. If you think your family would benefit from having Internet Security and ZIA enabled on your child's device 24/7, this can be arranged. Please contact your child's Year Coordinator to discuss it. It's a request we're glad to support, and more families take it up than you might expect.
Zscaler Security is an integral part of the College's cyber security infrastructure and is closely tied to our Learning and Wellbeing frameworks. As with the Jamf Pro MDM Profile, it is a compulsory component of enrolment at St Francis Catholic College.
Removing or bypassing Zscaler
Failing to install, or attempting to remove, disable or modify any Zscaler component breaches the CEDoW Student Responsible Use of Technology Agreement. It also prevents the device from accessing the College network and the services needed for learning. Deliberate attempts to bypass filtering, including VPNs and proxy tools, will result in disciplinary action.
Filtering is a safety net, not a substitute
No filtering system catches everything, and none replaces our students choosing to respect themselves, others and property in how they use technology. Please read the CEDoW Student Responsible Use of Technology Agreement in Compass with your child.
No. Zscaler only filters and logs traffic while the device is connected to the College network. Home browsing is not visible to the College at all.
Have your child log a support request with the exact web address and the subject or task it's needed for. Legitimate educational sites caught by a category filter can usually be allowed. It's a common and reasonable request. Teachers can also request this ahead of a lesson.
Not noticeably. The Client Connector is lightweight and the filtering happens in Zscaler's cloud, not on the Mac. If the device feels slow, it's more likely storage, a macOS update running, or too many browser tabs. Let us take a look.
The CA certificate allows Zscaler to inspect encrypted (HTTPS) traffic for threats on the College network. Without it, most modern web traffic couldn't be checked for malware or filtered. It's standard practice in schools and enterprises, operates only while the device is on our network, and is governed by CEDoW's privacy obligations.
Open the Client Connector from the menu bar cloud icon and check whether sign-in is required. That's the cause nine times out of ten. On the Okta page, enter the username only: a full email address will be rejected. If it still fails, restart the Mac, then log a support request with a photo of the error.
Not on the College network. VPNs and proxy tools interfere with Zscaler and are treated as attempts to bypass filtering, which is a breach of the Responsible Use Agreement.
For anything not covered here, contact your child's Year Coordinator or raise a request via the IT Support page.
