Cisco's new SecureX security architecture adds context-aware capabilities to the Cisco ASA Firewall and adds the AnyConnect VPN Client to the Cisco Security Intelligence Operations.
Cisco is rethinking its
long-term security strategy in light of the consumerization of workplace
technology that's changing work patterns and presenting new security
challenges.
Cisco's new SecureX
framework is consolidating a number of formerly separate security technologies,
including its ASA firewall appliances, TrustSec service, IronPort scanning,
management tools and suite of cloud services. Cisco unveiled the newly
consolidated security product framework at the RSA security conference in San
Francisco in mid-February.
By combining independent
products, Cisco has a complete view of who is trying to access the network,
what type of device is used, where the device is physically located and what
services are requested, Kevin Kennedy, Cisco's product line manager, told
eWEEK.
"We are baking security into
the fabric," he said.
The security model has to
adjust to the new reality, in which business users employ their own
mobile
devices to access corporate resources, Kennedy said. Users are logging in
from anywhere at anytime. With more
cloud
and
virtualization
deployments, there are more endpoints to protect, he said.
The language of security
needs to change from just protecting IP addresses and ports to using a
higher-level policy language that correlates to business rules and definitions,
Kennedy said. SecureX emphasizes context-aware security-enforcement elements
that are available regardless of what the actual infrastructure looks like. It
will be available for both virtual and physical products, he said.
The firewall and a network intrusion-prevention
system will remain the cornerstones of network security, according to Kennedy.
As part of the SecureX announcement, Cisco added new context-aware capabilities
to its ASA firewall appliance, which would combine with information from
TrustSec for network information and the Cisco SIO (Security Intelligence
Operations) cloud service for threat analysis, Kennedy said.
Cisco SIO is a global
service that gathers information from the customer networks, correlates threat
information and provides
actionable
intelligence back to the customers, Kennedy said. The service started with
e-mail security data and later added Web threats, firewall and
intrusion/prevention information, Kennedy said.
In addition to the new rules
from the ASA products, the SIO cloud service will also start receiving
information from the AnyConnect VPN client software under the new framework,
Kennedy said.
"The more data we get, the
better we protect our customers," he said. The collected data will be used to
improve rules that are published back to the devices. Cisco currently pushes
more than 800,000 rules every day, he said, such as botnet traffic rules for
the ASA and network traffic patterns.
The SIO collects data from
Cisco's IPS (Intrusion Prevention System) and firewall devices, and has
information on over 700,000 scanning elements, Kennedy said. With AnyConnect,
SIO would be collecting data from as many as 150 million endpoint-scanning
elements, he said. TrustSec collects network-intelligence data from Cisco's
Catalyst and Nexus switches.
Cisco envisions integrating
with more platforms, adding more applications and expanding capabilities,
Kennedy said. It will take "years to fully build out" SecureX, as Cisco tries
to figure out how to solve security problems, said Kennedy.
"We will be providing a
management capability that combines both the new context-aware [function and
manages] existing firewall rules," Kennedy said.
Cisco envisions third-party
providers extending and improving SecureX with additional plug-ins and
additional platform integration, Kenney said. The SecureX architecture will
have APIs available to service providers, a software development kit for
developers and a Cisco-supported developer ecosystem, Kennedy said.
Email
Print
