Constructing community and workload safety architectures generally is a daunting process. It includes not solely choosing the proper answer with the suitable set of capabilities, but in addition guaranteeing that the options provide the proper degree of resilience.
Resilience is usually thought of a community operate, the place the community should be sturdy sufficient to deal with failures and provide alternate paths for transmitting and receiving knowledge. Nonetheless, resilience on the endpoint or workload degree is ceaselessly neglected. As a part of constructing a resilient structure, it’s important to incorporate and plan for eventualities wherein the endpoint or workload answer would possibly fail.
Once we look at the present panorama of options, it normally boils down to 2 completely different approaches:
Agent-Based mostly Approaches
When selecting a safety answer to guard software workloads, the dialogue typically revolves round mapping enterprise necessities to technical capabilities. These capabilities sometimes embody safety features resembling microsegmentation and runtime visibility. Nonetheless, one facet that’s typically neglected is the agent structure.
Typically, there are two major approaches to agent-based architectures:
- Userspace putting in Kernel-Based mostly Modules/Drivers (in-datapath)
- Userspace clear to the Kernel (off-datapath)
Safe Workload’s agent structure was designed from the bottom as much as shield software workloads, even within the occasion of an agent malfunction, thus stopping crashes within the software workloads.
This robustness is because of our agent structure, which operates utterly in userspace with out affecting the community datapath or the applying libraries. Due to this fact, if the agent have been to fail, the applying would proceed to operate as regular, avoiding disruption to the enterprise.
One other facet of the agent structure is that it was designed to provide directors management over how, when, and which brokers they need to improve by leveraging configuration profiles. This method offers the pliability to roll out upgrades in a staged trend, permitting for mandatory testing earlier than going into manufacturing.
Agentless-Based mostly Approaches
One of the best ways to guard your software workloads is undoubtedlythrough an agent-based method, because it yields the perfect outcomes. Nonetheless, there are cases the place putting in an agent shouldn’t be doable.
The principle drivers for selecting agentless options typically relate to organizational dependencies (e.g., cross-departmental collaboration), or in sure circumstances, the applying workload’s working system is unsupported (e.g., legacy OS, customized OS).
When choosing agentless options, it’s vital to know the restrictions of those approaches. As an example, with out an agent, it’s not doable to attain runtime visibility of software workloads.
Nonetheless, the chosen answer should nonetheless present the required safety features, resembling complete community visibility of site visitors flows and community segmentation to safeguard the applying workloads.
Safe Workload affords a holistic method to getting visibility from a number of sources resembling:
- IPFIX
- NetFlow
- Safe Firewall NSEL
- Safe Shopper Telemetry
- Cloud Stream Logs
- Cisco ISE
- F5 and Citrix
- ERSPAN
- DPUs (Information Processing Items)
… and it affords a number of methods to implement this coverage:
- Safe Firewall
- Cloud Safety Teams
- DPUs (Information Processing Items)
Key Takeaways
When choosing the proper community and workload microsegmentation answer, at all times take note the dangers, together with the risk panorama and the resilience of the answer itself. With Safe Workload, you get:
- Resilient Agent Structure
- Software runtime visibility and enforcement with microsegmentation
- Various characteristic set of agentless enforcement
Study extra about Cisco Safe Workload
Â
We’d love to listen to what you assume. Ask a Query, Remark Under, and Keep Linked with Cisco Safety on social!
Cisco Safety Social Channels
Share:
