In today’s world, applications are everywhere and can be hard enough to manage, let alone secure. Cisco Secure Workload enables customers to have visibility and control into all their applications and provide automated policy to quickly and efficiently improve security policy.
Cisco Secure Workload main use cases:
• Microsegmentation: Cisco Secure Workload enables security teams to implement a secure, zero-trust model for workloads using microsegmentation. It automates the policy generation for microsegmentation using unsupervised machine learning and near real-time application behavior analysis. It normalizes this policy based on the priority and hierarchy before enforcing it. These policy elements are enforced for an application using the operating system firewall capabilities such as ipsets and iptables, in the case of Linux servers, and the Windows Filtering Platform or Windows advanced firewall, in the case of Microsoft Windows servers. This approach delivers a stateful and consistent segmentation across multicloud data centers at scale. It also allows you to minimize lateral movement in case of security incidents. Additionally, in a virtualized and container environment, this mechanism ensures that segmentation policy moves with the workload, allowing increased application mobility without the need for an infrastructure-specific segmentation policy. As application dependencies and communication patterns evolve, Cisco Secure Workload helps ensure that the policy is updated automatically.
• Workload anomalous behavior detection: Data center workloads are deployed for a specific activity or a function. Therefore, workload behavior could be baselined and proactively detect anomalous behaviors. To achieve this, Cisco Secure Workload monitors the process and communication activities on the workloads. It can detect various malicious behavior activities like:
o Privilege escalations
o Shell-code executions
o MITRE-identified techniques and tactics
o Side-channel attacks
o Unseen commands
In this way, security operations can quickly identify indicators of compromise and take remediation steps to minimize the impact.
• Reducing the attack surface: Attack surfaces are introduced in the data center due to vulnerabilities associated with the software packages, OS versions, and due to the stale ports and processes running in the environment. Cisco Secure Workload, in real time, identifies the full inventory of all software packages installed on the workloads and provides the ability to detect common vulnerabilities and exposures associated with these packages. It also provides actionable security insight where administrators can define policies to quarantine or restrict communication of workloads when certain vulnerabilities are detected. Additionally, it also identifies those open ports with process bindings that are not used. This concrete information helps administrators determine if something can be safely shutdown to reduce the exposure.