[ad_1]
Constructing community and workload safety architectures could be a daunting job. It entails not solely selecting the best answer with the suitable set of capabilities, but in addition making certain that the options provide the appropriate degree of resilience.
Resilience is usually thought of a community operate, the place the community have to be sturdy sufficient to deal with failures and provide alternate paths for transmitting and receiving knowledge. Nonetheless, resilience on the endpoint or workload degree is regularly neglected. As a part of constructing a resilient structure, it’s important to incorporate and plan for eventualities by which the endpoint or workload answer would possibly fail.
After we study the present panorama of options, it often boils down to 2 completely different approaches:
Agent-Primarily based Approaches
When selecting a safety answer to guard utility workloads, the dialogue usually revolves round mapping enterprise necessities to technical capabilities. These capabilities sometimes embody security measures reminiscent of microsegmentation and runtime visibility. Nonetheless, one side that’s usually neglected is the agent structure.
Usually, there are two important approaches to agent-based architectures:
- Userspace putting in Kernel-Primarily based Modules/Drivers (in-datapath)
- Userspace clear to the Kernel (off-datapath)
Safe Workload’s agent structure was designed from the bottom as much as defend utility workloads, even within the occasion of an agent malfunction, thus stopping crashes within the utility workloads.
This robustness is because of our agent structure, which operates utterly in userspace with out affecting the community datapath or the appliance libraries. Subsequently, if the agent have been to fail, the appliance would proceed to operate as regular, avoiding disruption to the enterprise.
One other side of the agent structure is that it was designed to present directors management over how, when, and which brokers they wish to improve by leveraging configuration profiles. This method supplies the pliability to roll out upgrades in a staged vogue, permitting for mandatory testing earlier than going into manufacturing.
Agentless-Primarily based Approaches
The easiest way to guard your utility workloads is undoubtedlythrough an agent-based method, because it yields the perfect outcomes. Nonetheless, there are cases the place putting in an agent isn’t doable.
The principle drivers for selecting agentless options usually relate to organizational dependencies (e.g., cross-departmental collaboration), or in sure circumstances, the appliance workload’s working system is unsupported (e.g., legacy OS, customized OS).
When choosing agentless options, it’s vital to know the restrictions of those approaches. As an example, with out an agent, it isn’t doable to realize runtime visibility of utility workloads.
Nonetheless, the chosen answer should nonetheless present the required security measures, reminiscent of complete community visibility of site visitors flows and community segmentation to safeguard the appliance workloads.
Safe Workload affords a holistic method to getting visibility from a number of sources reminiscent of:
- IPFIX
- NetFlow
- Safe Firewall NSEL
- Safe Consumer Telemetry
- Cloud Movement Logs
- Cisco ISE
- F5 and Citrix
- ERSPAN
- DPUs (Information Processing Models)
… and it affords a number of methods to implement this coverage:
- Safe Firewall
- Cloud Safety Teams
- DPUs (Information Processing Models)
Key Takeaways
When selecting the best community and workload microsegmentation answer, at all times remember the dangers, together with the menace panorama and the resilience of the answer itself. With Safe Workload, you get:
- Resilient Agent Structure
- Software runtime visibility and enforcement with microsegmentation
- Numerous function set of agentless enforcement
Study extra about Cisco Safe Workload
We’d love to listen to what you suppose. Ask a Query, Remark Under, and Keep Related with Cisco Safety on social!
Cisco Safety Social Channels
Share:
[ad_2]