Constructing a Resilient Community and Workload Safety Structure from the Floor Up

Constructing community and workload safety architectures is usually a daunting process. It entails not solely selecting the best answer with the suitable set of capabilities, but in addition guaranteeing that the options provide the best degree of resilience.

Resilience is commonly thought of a community perform, the place the community should be sturdy sufficient to deal with failures and provide alternate paths for transmitting and receiving knowledge. Nonetheless, resilience on the endpoint or workload degree is incessantly neglected. As a part of constructing a resilient structure, it’s important to incorporate and plan for situations during which the endpoint or workload answer may fail.

After we look at the present panorama of options, it normally boils down to 2 completely different approaches:

Agent-Primarily based Approaches

When selecting a safety answer to guard utility workloads, the dialogue typically revolves round mapping enterprise necessities to technical capabilities. These capabilities usually embody safety features comparable to microsegmentation and runtime visibility. Nonetheless, one facet that’s typically neglected is the agent structure.

Usually, there are two principal approaches to agent-based architectures:

• Userspace putting in Kernel-Primarily based Modules/Drivers (in-datapath)
• Userspace clear to the Kernel (off-datapath)

Safe Workload’s agent structure was designed from the bottom as much as defend utility workloads, even within the occasion of an agent malfunction, thus stopping crashes within the utility workloads.

This robustness is because of our agent structure, which operates utterly in userspace with out affecting the community datapath or the applying libraries. Due to this fact, if the agent have been to fail, the applying would proceed to perform as regular, avoiding disruption to the enterprise.

One other facet of the agent structure is that it was designed to present directors management over how, when, and which brokers they need to improve by leveraging configuration profiles. This method gives the pliability to roll out upgrades in a staged vogue, permitting for needed testing earlier than going into manufacturing.

Agentless-Primarily based Approaches

One of the simplest ways to guard your utility workloads is undoubtedlythrough an agent-based method, because it yields one of the best outcomes. Nonetheless, there are cases the place putting in an agent isn’t attainable.

The principle drivers for selecting agentless options typically relate to organizational dependencies (e.g., cross-departmental collaboration), or in sure circumstances, the applying workload’s working system is unsupported (e.g., legacy OS, customized OS).

When choosing agentless options, it’s essential to grasp the constraints of those approaches. For example, with out an agent, it isn’t attainable to attain runtime visibility of utility workloads.

Nonetheless, the chosen answer should nonetheless present the required safety features, comparable to complete community visibility of site visitors flows and community segmentation to safeguard the applying workloads.

Safe Workload gives a holistic method to getting visibility from a number of sources comparable to:

• IPFIX
• NetFlow
• Safe Firewall NSEL
• Safe Shopper Telemetry
• Cloud Circulation Logs
• Cisco ISE
• F5 and Citrix
• ERSPAN
• DPUs (Information Processing Items)

… and it gives a number of methods to implement this coverage:

• Safe Firewall
• Cloud Safety Teams
• DPUs (Information Processing Items)

Key Takeaways

When selecting the best community and workload microsegmentation answer, at all times have in mind the dangers, together with the menace panorama and the resilience of the answer itself. With Safe Workload, you get:

• Resilient Agent Structure
• Software runtime visibility and enforcement with microsegmentation
• Numerous characteristic set of agentless enforcement

Study extra about Cisco Safe Workload

 

---

We’d love to listen to what you suppose. Ask a Query, Remark Under, and Keep Linked with Cisco Safety on social!

Cisco Safety Social Channels

Instagram
Fb
Twitter
LinkedIn

Share: