It is no secret that cybersecurity defenders struggle to keep up with the volume and craftiness of current-day cyber-attacks. A significant reason for the struggle is that security infrastructure has… Read more on Cisco Blogs

​[[{"value":"

It is no secret that cybersecurity defenders struggle to keep up with the volume and craftiness of current-day cyber-attacks. A significant reason for the struggle is that security infrastructure has yet to evolve to effectively and efficiently stymie modern attacks. The security infrastructure is either too unwieldy and slow or too destructive. When the security infrastructure is slow and unwieldy, the attackers have likely succeeded by the time the defenders react. When security actions are too drastic, they impair the protected IT systems to such an extent that the actions could be mistaken for the attack itself.

So, what does a defender do? The answer to the defender’s problem is a new security infrastructure — a fabric — that can autonomously create defenses and produce measured responses to detected attacks. Cisco has created such a fabric — Cisco Hypershield — that we discuss in the paragraphs below.

Foundational principles

We start with the foundational principles that guided the creation of Cisco Hypershield. These principles provide the primitives that enable defenders to escape the “damned-if-you-do and damned-if-you-don’t” situation we alluded to above.

Hyper-distributed enforcement

IT infrastructure in a modern enterprise spans privately run data centers (private cloud), public cloud, bring-your-own devices (BYOD) and the Internet of Things (IoT). In such a heterogeneous environment, centralized enforcement is inefficient as traffic must be shuttled to and from the enforcement point. The shuttling creates networking and security design challenges. The answer to this conundrum is the distribution of the enforcement point close to the workload.

Cisco Hypershield comes in multiple enforcement form factors to suit the heterogeneity in any IT environment:

Tesseract Security Agent: Here, security software runs on the endpoint server and interacts with the processes and the operating system kernel using the extended Berkeley Packet Filter (eBPF). eBPF is a software framework on modern operating systems that enables programs in user space (in this case, the Tesseract Security Agent) to safely carry out enforcement and monitoring actions via the kernel.
Virtual/Container Network Enforcement Point: Here, a software network enforcement point runs inside a virtual machine or container. Such enforcement points are instantiated close to the workload and protect fewer assets than the typical centralized firewall.
Server DPUs: Cisco Hypershield’s architecture supports server Data Process Units (DPUs). Thus, in the future, enforcement can be placed on networking hardware close to the workloads by running a hardware-accelerated version of our network enforcement point in these DPUs. The DPUs offload networking and security processing from the server’s main CPU complex in a secure enclave.
Smart Switches: Cisco Hypershield’s architecture also supports smart switches. In the future, enforcement will be placed in other Cisco Networking elements, such as top-of-rack smart switches. While not as close to the workload as agents or DPUs, such switches are much closer than a centralized firewall appliance.

Centralized security policy

The usual retort to distributed security enforcement is the nightmare of managing independent security policies per enforcement point. The cure for this problem is the centralization of security policy, which ensures that policy consistency is systematically enforced (see Figure 1).

Cisco Hypershield follows the path of policy centralization. No matter the form factor or location of the enforcement point, the policy being enforced is organized at a central location by Hypershield’s management console. When a new policy is created or an old one is updated, it is “compiled” and intelligently placed on the appropriate enforcement points. Security administrators always have an overview of the deployed policies, no matter the degree of distribution in the enforcement points. Policies are able to follow workloads as they move, for instance, from on-premises to the native public cloud.

Figure 1: Centralized Management for Distributed Enforcement

Hitless enforcement point upgrade

The nature of security controls is such that they tend to get outdated quickly. Sometimes, this happens because a new software update has been released. Other times, new applications and business processes force a change in security policy. Traditionally, neither scenario has been accommodated well by enforcement points — both acts can be disruptive to the IT infrastructure and present a business risk that few security administrators want to undertake. A mechanism that makes software and policy updates normal and non-disruptive is called for!

Cisco Hypershield has precisely such a mechanism, called the dual dataplane. This dataplane supports two data paths: a primary (main) and a secondary (shadow). Traffic is replicated between the primary and the secondary. Software updates are first applied to the secondary dataplane, and when fully vetted, the roles of the primary and secondary dataplanes are switched. Similarly, new security policies can be applied first to the secondary dataplane, and when everything looks good, the secondary becomes the primary.

The dual dataplane concept enables security administrators to upgrade enforcement points without fear of business disruption (see Figure 2).

Figure 2: Cisco Hypershield Dual Dataplane

Complete visibility into workload actions

Complete visibility into a workload’s actions enables the security infrastructure to establish a “fingerprint” for it. Such a fingerprint should include the types of network and file input-output (I/O) that the workload typically performs. When the workload takes an action that falls outside the fingerprint, the security infrastructure should flag it as an anomaly that requires further investigation.

Cisco Hypershield’s Tesseract Security Agent form factor provides complete visibility into a workload’s actions via eBPF, including network packets, file and other system calls and kernel functions. Of course, the agent alerts on anomalous activity when it sees it.

Graduated response to risky workload behavior

Security tools amplify the disruptive capacity of cyber-attacks when they take drastic action on a security alert. Examples of such action include quarantining a workload or the entire application from the network and shutting down the workload or application. For workloads of marginal business importance, drastic action may be fine. However, taking such action for mission-critical applications (for example, a supply chain application for a retailer) often defeats the business rationale for security tools. The disruptive action hurts even more when the security alert turns out to be a false alarm.

Cisco Hypershield in general, and its Tesseract Security Agent in particular, can generate a graduated response. For example, Cisco Hypershield can respond to anomalous traffic with an alert rather than a block when instructed. Similarly, the Tesseract Security Agent can react to a workload, attempting to write to a new file location with a denial rather than shutting down the workload.

Continuous learning from network traffic and workload behavior

Modern-day workloads use services provided by other workloads. These workloads also access many operating system resources such as network and file I/O. Further, applications are composed of multiple workloads. A human security administrator can’t collate all the applications’ activity and establish a baseline. Reestablishing the baseline is even more challenging when new workloads, applications and servers are added to the mix. With this backdrop, manually determining anomalous behavior is impossible. The security infrastructure needs to do this collation and sifting on its own.

Cisco Hypershield has components embedded into each enforcement point that continuously learn the network traffic and workload behavior. The enforcement points periodically aggregate their learning into a centralized repository. Separately, Cisco Hypershield sifts through the centralized repository to establish a baseline for network traffic and workloads’ behavior. Cisco Hypershield also continuously analyzes new data from the enforcement points as the data comes in to determine if recent network traffic and workload behavior is anomalous relative to the baseline.

Autonomous segmentation

Network segmentation has long been a mandated necessity in enterprise networks. Yet, even after decades of investment, many networks remain flat or under-segmented. Cisco Hypershield provides an elegant solution to these problems by combining the primitives mentioned above. The result is a network autonomously segmented under the security administrator’s supervision.

The autonomous segmentation journey proceeds as follows:

The security administrator begins with top-level business requirements (such as isolating the production environment from the development environment) to deploy basic guardrail policies.
After initial deployment, Cisco Hypershield collects, aggregates, and visualizes network traffic information while running in an “Allow by Default” mode of operation.
Once there is sufficient confidence in the functions of the application, we move to “Allow but Alert by Default” and insert the known trusted behaviors of the application as Allow rules above this. The administrator continues to monitor the network traffic information collected by Cisco Hypershield. The monitoring leads to increased familiarity with traffic patterns and the creation of additional common-sense security policies at the administrator’s initiative.
Even as the guardrail and common-sense policies are deployed, Cisco Hypershield continues learning the traffic patterns between workloads. As the learning matures, Hypershield makes better (and better) policy recommendations to the administrator.

This phased approach allows the administrator to build confidence in the recommendations over time. At the outset, the policies are deployed only to the shadow dataplane. Cisco Hypershield provides performance data on the new policies on the secondary and existing policies on the primary dataplane. If the behavior of the new policies is satisfactory, the administrator moves them in alert-only mode to the primary dataplane. The policies aren’t blocking anything yet, but the administrator can get familiar with the types of flows that would be blocked if they were in blocking mode. Finally, with conviction in the new policies, the administrator turns on blocking mode, progressing towards the enterprise’s segmentation goal.

The administrator’s faith in the security fabric — Cisco Hypershield — deepens after a few successful runs through the segmentation process. Now, the administrator can let the fabric do most of the work, from learning to monitoring to recommendations to deployment. Should there be an adverse business impact, the administrator knows that rollback to a previous set of policies can be accomplished easily via the dual dataplane.

Distributed exploit protection

Patching known vulnerabilities remains an intractable problem given the complex web of events — patch availability, patch compatibility, maintenance windows, testing cycles, and the like — that must transpire to remove the vulnerability. At the same time, new vulnerabilities continue to be discovered at a frenzied pace, and attackers continue to shrink the time between the public release of new vulnerability information and the first exploit. The result is that the attacker’s options towards a successful exploit increase with time.

Cisco Hypershield provides a neat solution to the problem of vulnerability patching. In addition to its built-in vulnerability management capabilities, Hypershield will integrate with Cisco’s and third-party commercial vulnerability management tools. When information on a new vulnerability becomes available, the vulnerability management capability and Hypershield coordinate to check for the vulnerability’s presence in the enterprise’s network.

If an application with a vulnerable workload is found, Cisco Hypershield can protect it from exploits. Cisco Hypershield already has visibility into the affected workload’s interaction with the operating system and the network. At the security administrator’s prompt, Hypershield suggests compensating controls. The controls are a combination of network security policies and operating system restrictions and derive from the learned steady-state behavior of the workload preceding the vulnerability disclosure.

The administrator installs both types of controls in alert-only mode. After a period of testing to build confidence in the controls, the operating system controls are moved to blocking mode. The network controls follow the same trajectory as those in autonomous segmentation. They are first installed on the shadow dataplane, then on the primary dataplane in alert-only mode, and finally converted to blocking mode. At that point, the vulnerable workload is protected from exploits.

During the process described above, the application and the workload continue functioning, and there is no downtime. Of course, the vulnerable workload should eventually be patched if possible. The security fabric enabled by Cisco Hypershield just happens to provide administrators with a robust yet precise tool to fend off exploits, giving the security team time to research and fix the root cause.

Conclusion

In both the examples discussed above, we see Cisco Hypershield function as an effective and efficient security fabric. The innovation powering this fabric is underscored by it launching with several patents pending.

In the case of autonomous segmentation, Hypershield turns flat and under-segmented networks into properly segmented ones. As Hypershield learns more about traffic patterns and security administrators become comfortable with its operations, the segments become tighter, posing more significant hurdles for would-be attackers.

In the case of distributed exploit protection, Hypershield automatically finds and recommends compensating controls. It also provides a smooth and low-risk path to deploying these controls. With the compensating controls in place, the attacker’s window of opportunity between the vulnerability’s disclosure and the software patching effort disappears.

Want to learn more about Cisco Hypershield? Check out Tom Gillis’ blog on Cisco Hypershield: A New Era of Distributed, AI-Native Security.

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

InstagramFacebookTwitterLinkedIn

"}]]  Cisco Hypershield is a new security infrastructure — a fabric — that can autonomously create defenses and produce measured responses to detected attacks, making security defenders' jobs easier.  Read More Cisco Blogs 

Today we introduced the most consequential security product in Cisco’s history: Cisco Hypershield. It’s a cloud-native, AI-powered approach to highly distributed security for AI-scale data centers tha… Read more on Cisco Blogs

​[[{"value":"

Today we introduced the most consequential security product in Cisco’s history: Cisco Hypershield. It’s a cloud-native, AI-powered approach to highly distributed security for AI-scale data centers that’s built into the fabric of the network.

It’s the most radically different security innovation I’ve been a part of in my career. Part of the Cisco Security Cloud, Cisco Hypershield literally turns the network security model upside down, bringing the power of hyperscaler security and connectivity to the enterprise.

Security for the Age of AI

AI is ushering in an era of digital abundance. When every person in every job function has AI assistants and organizations are moving at machine scale, our world of 8 billion will feel like we have the capacity of 80 billion.

To accommodate the additional digital capacity required, our public and private data centers are being reimagined. And Cisco is at the heart of how data centers are being reimagined: how they are connected, how they are secured, how they are operated, and how they are scaled.

And data centers are changing in two major ways. Infrastructure is changing: CPUs are being supplemented with GPUs and DPUs that specialize in functions like AI workload processing and I/O operations at throughput levels that modern AI-scale data centers need. And applications are changing: they’re being broken into thousands of microservices that run in different containers and clouds – highly distributed, all talking to each other.

In this new world, we need to reimagine security at AI scale. And we need to do it now, because this evolution of data centers and applications isn’t waiting for us.

How can we reimagine security?

Billions spent on cyber security, and we are still falling behind in many ways.

The fact is, securing everything is hard. And the unprecedented scale of modern applications, AI workloads, and devices just makes everything harder. For instance, I was recently in India and the country is rolling out 250 million smart power meters, each of which has the potential to be exploited. This is just one example of scale that creates tactical challenges for securing everything. Consider the challenges:

Segmentation is hard when applications become hyper-distributed and are continually changing.
Patching is hard because it takes a long time to test, schedule, and deploy a patch to remove a vulnerability. And it’s getting harder to keep up because attackers are compressing the time between when they know about a vulnerability to when they start exploiting it; it might take just a few days or even less.
Upgrades are hard because, like patches, they involve manual testing and deployment. Upgrades are especially hard when they involve mission-critical infrastructure like an oil rig or a medical robot, some of which can’t even be upgraded.

Now, imagine you had a solution that could understand everything your applications are doing. Then you could have AI define granular segmentation rules for you and keep them updated as things evolve.

Imagine you had a way to find vulnerabilities and automatically shield them from being exploited. You’d be protected even before you get the chance to patch.

Imagine your security infrastructure could upgrade itself. You’d save countless hours and eliminate the coordination and downtime of upgrade testing and deployment windows.

We designed Cisco Hypershield to do all this and more. It is built for the age of AI, for the cloud, in software, and with a distributed architecture that means you can put security wherever you need to….in the cloud, in the data center, on a factory floor, or a hospital imaging room.

Cisco Hypershield is built on modern building blocks like eBPF, hardware acceleration, and AI.

Co-created by our new teammates from Isovalent along with Meta, eBPF allows a lightweight agent to peer into the heart of the operating system, without actually being there. It sits in the user space but has a kernel-level effect. This gives Cisco Hypershield full visibility into every software process and every I/O operation your distributed applications are running in any Kubernetes container or VM. It’s the default mechanism for connecting and protecting cloud-native workloads used by the hyperscalers.
Hardware acceleration. Cisco Hypershield takes advantage of DPUs and other hardware accelerators in servers and other network infrastructure. This means you can place high-performance security control points not just in distributed containers and VMs, but in hardware that sits close to the workloads they’re protecting.
By designing Cisco Hypershield from the ground up to leverage the power of AI, it’s orders-of-magnitude more autonomous than other security solutions. With this AI-first focus in mind, we’re excited about our partnership with NVIDIA. We are working together to co-create security-specific AI models, and we’re optimizing our Cisco Security products for NVIDIA’s technology.

Bringing security to the workloads

What the Cisco Hypershield architecture delivers is a coordinated fabric of thousands of distributed security enforcement points throughout your entire environment, across both public and private clouds. It brings security to the workloads, not the other way around.

And this architecture allows us to do some truly incredible use cases that weren’t possible until now, such as:

Autonomous segmentation that draws upon ongoing visibility of network flows, process behaviors, and application changes to define granular segmentation rules that can protect against lateral movement. And as things change over time, Cisco Hypershield refines and updates these rules dynamically.
Distributed exploit protection that determines if you have a high-risk vulnerability in your environment and delivers a compensating control that can be deployed to block attackers from exploiting the vulnerability – before you have a chance to patch, and maybe even before you know about the vulnerability.
Self-qualifying upgrades that use a shadow data path to test upgrades and policy changes against a mirror of live traffic, compare and confirm the results using AI, and move all the flows to the latest version – all without any downtime.

I’m incredibly excited about the launch of Cisco Hypershield. I’m so proud of our team for delivering this incredible innovation that will help make the world a safer place.

To learn more about it, please read Tom Gillis’ blog about the technology and the key customer use cases we’re solving for. And keep your feedback coming!

Additional resources

Read Tom Gillis’ blog: Cisco Hypershield: A New Era of Distributed, AI-Native Security
Read Craig Connor’s blog: Cisco Hypershield: Reimagining Security
Read the Press Release:  Cisco Reimagines Security for Data Centers and Clouds in Era of AI

"}]]  Introducing Cisco Hypershield, a cloud-native approach to highly-distributed security for data centers that’s AI-powered and built into the fabric of the network.  Read More Cisco Blogs 

Cisco XDR is a leader in providing comprehensive threat detection and response across the entire attack surface. We’ll be showcasing new capabilities that will give security teams even more insight, a… Read more on Cisco Blogs

​[[{"value":"

Cisco XDR is a leader in providing comprehensive threat detection and response across the entire attack surface. We’ll be showcasing new capabilities that will give security teams even more insight, automation, and control over your environment at RSA Conference 2024, which is in San Francisco from May 6-9.

Cutting-Edge Innovations in Cisco XDR

At the heart of these innovations is the Cisco AI Assistant in XDR. This powerful tool empowers security analysts of all skill levels to make faster, more informed decisions about evolving threats. The Cisco AI Assistant gives analysts contextual insights, guided responses, and best next steps. Combined with AI-automated workflows, security teams can work smarter and more efficiently.

We will also show Cisco Identity Intelligence capabilities. Cisco XDR can detect and respond to sophisticated identity-based attacks with accuracy and speed by incorporating identity as a source of telemetry. The depth of Cisco’s visibility, combined with Talos threat intelligence, gives security teams a significant advantage in identifying and mitigating the most advanced threats.

Accelerate the SOC

There are many ways to engage with Cisco at RSAC 2024. Some highlights include:

Kicking off the event on Monday, May 6 is our keynote “The Time is Now: Redefining Security in the Age of AI”, which is presented by Jeetu Patel, Cisco EVP & GM of Security & Collaboration and Tom Gillis, SVP & GM of the Security Business Group.Additional speaking sessions on AI, security, networking, and more can be found on our web page.

SecOps Innovation Luncheon

On Tuesday, May 7, executives, Talos researchers, and SecOps experts will highlight new innovations that are tipping the scale in favor of defenders.  Learn about transforming your SOC with Cisco + Splunk and innovations around AI and Identity.  Register to join us!

Demos/Presentations:

Visit Cisco booths N-5845 and S-926 for demos and presentations from security experts, including:

Accelerate the SOC: Cisco + Splunk
Detect and Stop Breaches
See the SOC of the Future
Give your Admins Superpowers with the Cisco AI Assistant
Identity: Defending the New Perimeter

SOC Dashboard

Our live threat display on the RSAC wireless network (formerly Threat Wall) is back. Attendees can join Cisco engineers for a security briefing and tour to see the SOC Dashboard in action. Space is limited so reserve your spot today!

Don’t miss this opportunity to witness how Cisco innovation will shape the security industry in the years to come. See you there!

Visit our website for more details: Cisco at RSA Conference™ 2024

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!

Cisco Security Social Channels

InstagramFacebookTwitterLinkedIn

"}]]  Discover the new Cisco XDR capabilities that will give security teams even more insight, automation, and control over your environment at RSA Conference 2024.  Read More Cisco Blogs 

The Cisco team will be attending Hannover Messe next week, and we’re excited to network with our customers and industry leaders!  We’ll be exchanging ideas, learning about their needs, and showing the… Read more on Cisco Blogs

​[[{"value":"

The Cisco team will be attending Hannover Messe next week, and we’re excited to network with our customers and industry leaders!  We’ll be exchanging ideas, learning about their needs, and showing them how Cisco Industrial IoT’s high-performance, secure networking portfolio can help them reach the full potential of Industry 4.0.

I have the chance to meet with manufacturing customers every day. Lately, I have been hearing that they have built substantial operations over the years using what was available at the time, only to be left with disparate systems that are difficult to scale and secure. Now, they want to revamp them and lay a foundation for smart manufacturing and future growth. At the same time, they want to leverage data to improve efficiency, reduce costs, and grow profitability by embracing new innovations such as artificial intelligence, cloud computing, software virtualization, autonomous guided vehicles, and more. However, that comes with some enormous challenges:

Factory networks often lack the robustness, performance, and automation required to modernize. Manufacturers want to add new machines, build new production lines, support broader use of cloud resources, and leverage AI technologies and virtualization to align with the Fourth Industrial Revolution, but they need help.
While in the past, manufacturers could mitigate risk using a patchwork of single function “point products” from a variety of vendors, their security architecture has become so complex to manage and scale that it is now one of the primary obstacles for continued growth and innovation throughout the Industrial IoT space.
Unreliable wireless connectivity on the factory floor limits the ability to increase automation using autonomous vehicles, robots, and mobile tooling.

Figure 1: Pillars of smart manufacturing

We offer high-performance, resilient networks that support smart manufacturing initiatives. Our ruggedized industrial networking portfolio is made for OT environments and use cases.  It employs the same proven enterprise-grade architecture and security that IT teams are already familiar with, and helps build a consistent end-to-end architecture, leveraging existing IT knowledge and investments. To that end, we are leveraging our data center expertise to bring virtualization to the plant floor.

“To increase security, decrease support requirements, and improve flexibility, Audi is developing its Edge Cloud for Production (EC4P) platform with the help of Cisco. EC4P virtualizes production assets and relies on software-defined networking that provides a scalable, resilient, secure, and deterministic network.” – Dr. Henning Löser, Head of Production Labs, Audi

Our solutions provide secured operations through a unified security and networking architecture. We help customers eliminate the cost and complexity of managing point security products by embedding advanced OT security as a software feature throughout our industrial networking portfolio. The same network that connects industrial assets can provide OT visibility, threat detection, zero-trust zone segmentation, and secure remote access, eliminating the need for dedicated hardware for each function.

“Gaining visibility into industrial assets is key to securing operations. The combination of Cisco Cyber Vision and Cisco industrial networking makes it simple to gain visibility at scale. It’s the foundation for a robust OT network and a comprehensive approach to IoT security.” – Dino Busalachi, CTO and co-founder, Velta Technology

Manufacturers can rely on us for uninterrupted wireless for critical applications and greater flexibility. Our wireless technologies provide reliable connectivity for mobile assets (AGVs, AMRs, tooling) and other critical applications, even in the presence of obstacles and RF interference. Our technology can also help factories reduce costs and installation time, because it eliminates the need for cable installation. Finally, Cisco industrial wireless technology makes it easier for manufacturers to reconfigure production lines and adapt to changes in process or demands of the quickly.

As manufacturers continue to leverage data to embrace AI/ML-driven industrial operations, secure their operations, and become more connected, we are proud to offer the high-performance industrial networking they need to enable reliable and secure connectivity between OT, IT, and analytical applications.

Be our guest at Hannover Messe

Are you planning to attend Hannover Messe? You can find us at Stand F18, Hall 15, where we’ll have several demo stations showing manufacturers how they can boost innovation and efficiency with a resilient, scalable, and flexible industrial network that only Cisco can offer! Our in-booth theater will feature short presentations running throughout the day on key topics of interest, such as cybersecurity, wireless technologies, sustainability, networking, and cloud analytical applications in manufacturing operations.

Come and see a fully operational automatic coffee packaging machine for a live demonstration of the power of a unified security and networking architecture. We would love to host you as our guest for a deeper discussion.

To learn more about our IoT solutions portfolio, read my interview with IIoT World or visit the Cisco Industrial IoT Networking website.

"}]]  A network is more than a collection of switches, routers, and access points. It is the foundation for a smart infrastructure that can unlock Industry 4.0 innovations.  Read More Cisco Blogs 

In an ever-evolving digital landscape, cybersecurity has become the cornerstone of organizational success. With the proliferation of sophisticated cyber threats, businesses must adopt a multi-layered… Read more on Cisco Blogs

​[[{"value":"

In an ever-evolving digital landscape, cybersecurity has become the cornerstone of organizational success. With the proliferation of sophisticated cyber threats, businesses must adopt a multi-layered approach to ensure the integrity of their digital assets and safeguard their sensitive information. Two leading players in this space, Cisco’s Duo Security and Cisco Identity Intelligence, have emerged as champions in Identity Threat Detection & Response. In this blog post, we will explore how Cisco Identity Intelligence seamlessly complements Cisco’s Duo Security to provide a comprehensive and robust cybersecurity strategy.

The Power of Identity Threat Detection & Response

Identity Threat Detection & Response (ITDR) has become a vital aspect of modern cybersecurity. It focuses on identifying anomalies in user behavior, detecting potential unauthorized access, and responding to security incidents promptly. Cisco’s Duo Security has established itself as a prominent solution in this domain, offering a range of features such as multi-factor authentication (MFA) and access controls that protect against unauthorized access.

Cisco Identity Intelligence: Elevating Cybersecurity Preparedness

Cisco Identity Intelligence brings an additional layer of protection to the table with its advanced capabilities in anomaly detection and behavioral analytics. This innovative technology analyzes user behavior patterns, device interactions, and network activities to identify even the subtlest deviations from normal behavior. This is particularly crucial in today’s threat landscape, where attackers are becoming increasingly adept at mimicking legitimate user actions.

How Cisco Identity Intelligence Complements Cisco’s Duo Security

Enhanced Anomaly Detection: While Cisco’s Duo Security provides robust MFA and access controls, Cisco Identity Intelligence takes it a step further by analyzing user activities in real time. By establishing a baseline of normal behavior, Cisco Identity Intelligence can swiftly identify any unusual actions, potentially preventing unauthorized access even after initial authentication.

Behavioral Analytics: Cisco Identity Intelligence’s AI-driven behavioral analytics can identify complex attack patterns that may go unnoticed by traditional security measures. By correlating data across multiple dimensions, Cisco Identity Intelligence helps security teams detect identity-related threats that could lead to data breaches or system compromise.
Holistic Threat Response: When integrated with Cisco’s Duo Security, Cisco Identity Intelligence enables a comprehensive threat response strategy. The combined capabilities of these two solutions allow organizations to not only prevent unauthorized access but also respond proactively to emerging threats, minimizing potential damage.
Adaptive Security: Cisco Identity Intelligence’s adaptive security approach means that it continuously learns from new data and adjusts its understanding of what constitutes normal behavior. This adaptability ensures that evolving attack techniques are promptly recognized and mitigated.

Reduced False Positives: Cisco Identity Intelligence’s sophisticated engine minimizes false positives by understanding context and user intent. This helps security teams focus their efforts on genuine threats, reducing alert fatigue and streamlining incident response.

Conclusion

As the cyber threat landscape continues to evolve, the collaboration between leading cybersecurity solutions becomes imperative. Cisco’s Duo Security and Cisco Identity Intelligence collectively fortify an organization’s defense by combining multi-factor authentication, access controls, AI-driven anomaly detection, and behavioral analytics. This synergy creates a robust shield against identity-related threats and provides a holistic approach to cybersecurity.

Remember, in today’s digital age, a comprehensive cybersecurity strategy is not a luxury but a necessity. By embracing the combined power of Cisco’s Duo Security and Cisco Identity Intelligence, organizations can confidently navigate the complex realm of cyber threats and safeguard their digital assets with unwavering resolve.

For more information on the integration and to explore the capabilities of Cisco’s Duo Security, visit

https://duo.com/solutions

https://docs.oort.io/integrations/duo-security-integration

If you are interested in participating in a trial

https://docs.google.com/forms/d/e/1FAIpQLSe3UP29FHvpkNLxXqC2RJxv57cKraFK8XvAcoEdjBtX8AY-hw/viewform

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!

Cisco Security Social Channels

InstagramFacebookTwitterLinkedIn

"}]]  Explore the synergy of Cisco's Duo Security & Identity Intelligence, bolstering cyber defense with advanced threat detection & response capabilities  Read More Cisco Blogs 

World Creativity & Innovation Week annually celebrates problem-solving within the realms of economic, social, and sustainable development. It provides an ideal platform to showcase Cisco’s Global P… Read more on Cisco Blogs

​[[{"value":"

World Creativity & Innovation Week annually celebrates problem-solving within the realms of economic, social, and sustainable development. It provides an ideal platform to showcase Cisco’s Global Partner Engineer ecosystem, which holds a central role in communicating Cisco’s Artificial Intelligence (AI) differentiation. Our technical community is at the forefront, driving the development and deployment of AI-driven solutions. These solutions empower customers to revolutionize their businesses, elevate operational efficiency, and unlock fresh avenues for growth and innovation. These are just some of the ways in which Cisco and our partners are greater together.

Whether addressing network challenges or proactively optimizing performance and security, technology leaders trust Cisco’s AI solutions every day. Cisco isn’t just dabbling in AI; we’re fully immersed. Our comprehensive AI strategy permeates Cisco’s entire portfolio, providing a future-proof network that operates seamlessly and intelligently.

We distinguish our AI offering in several key ways:

Self-Healing Networks: Imagine a network that identifies and resolves issues before they impact your business. Cisco AI’s anomaly detection and automated remediation capabilities make this a reality. No more scrambling to diagnose and fix network problems – your network takes care of itself, freeing your IT team to focus on strategic initiatives.

Unparalleled Network Visibility: Cisco AI provides a holistic view of your network traffic, empowering you to make data-driven decisions. Gain insights into user behavior, application performance, and potential security threats. This deep visibility allows you to optimize network resources and ensure exceptional Quality of Service (QoS) for all users and applications.

Enhanced Security: Cybersecurity is an ever-evolving battleground. Cisco AI stays ahead of the curve by analyzing network activity for malicious patterns. This proactive approach allows you to identify and neutralize threats faster, minimizing risk and protecting your valuable data.

Streamlined IT Operations: Cisco AI automates repetitive tasks such as configuration management and troubleshooting. This frees your IT staff from mundane tasks, allowing them to focus on higher-level activities that contribute directly to business goals.

The Benefits are Clear: Increased Efficiency, Reduced Costs, and Unmatched Security

By implementing Cisco AI, partners will experience:

Reduced Downtime: Self-healing networks minimize downtime, ensuring business continuity and maximizing productivity.
Lower Operational Costs: Automated tasks and optimized resource allocation translate to significant cost savings.
Improved Security Posture: Proactive threat detection and mitigation minimize the risk of costly cyberattacks.

Ready to Elevate Your Network Experience?

Let this World Creativity & Innovation Week inspire you to take proactive steps in protecting your business from potential disruptions. Connect with a Cisco representative today to delve into how our AI-powered solutions can transform your network into an intuitive, self-healing system.

Embrace the future of networking with Cisco AI

We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with #CiscoPartners on social!

Cisco Partners Facebook  |  @CiscoPartners X/Twitter  |  Cisco Partners LinkedIn

"}]]  World Creativity & Innovation Week annually celebrates problem-solving within the realms of economic, social, and sustainable development. It provides an ideal platform to showcase Cisco’s Global Partner Engineer ecosystem, which holds a central role in communicating Cisco’s Artificial Intelligence (AI) differentiation.  Read More Cisco Blogs 

IDC is often asked why observability matters and how it benefits an organization.  A recent worldwide IDC survey (sponsored by Cisco) on full-stack observability (FSO) offers some answers.  Around 7… Read more on Cisco Blogs

​[[{"value":"

IDC is often asked why observability matters and how it benefits an organization.  A recent worldwide IDC survey (sponsored by Cisco) on full-stack observability (FSO) offers some answers.  Around 75% of the 2,062 global technology executives surveyed agree that their CEO and business leadership understand that complete visibility and control over infrastructure, network, applications, security, and digital experience is critical to digital business success. And with so much riding on the digital infrastructure, 47% of the respondents cited their average cost of an hour of downtime at $250,000 or more.  As the adoption of multiple clouds, application architectures, and digital transformation leads complexity to soar, executives realize that the need to deliver secure, high-performing digital experiences for employees, partners, and customers has never been more acute. As such, comprehensive full-stack observability is fast developing into a core tenet when building out a resilient and responsive digital infrastructure.

Full-stack observability is an opportunity for leadership teams to boost technology teamwork, productivity, and effectiveness across operations, DevOps, site reliability engineering, and security teams.  FSO empowers these teams through real-time visibility, data access, and AI-powered insights from vast amounts of data (metrics, logs, traces, and events) enabling a single source of truth. But it goes a step further by providing recommended actions enriched with business context to enable teams to proactively identify, prioritize, and resolve performance issues to deliver always-on, secure, and exceptional digital experiences. The ability to scale is crucial for customers and partners as new and custom FSO use cases emerge, expanding the value of the data for teams with unique requirements. Executives understand that their business architectures are now technology architectures and delivering great experiences is a major factor in generating sustainable revenue growth, customer adoption, and innovation.

Full-stack observability is also a customer journey. It often starts with a platform approach that uses application performance management capabilities as a core set of data.  A common second step is collecting data sources using open integrations from multiple clouds, infrastructures, security, and cloud-native applications to establish a foundation for observability use cases.  Customers and partners then typically identify new ways to use the data and analytics to solve performance problems, increasing adoption across technology teams. This approach allows those teams to enhance their monitoring, business risk observability, cost and workload optimization, AIOps, and DevSecOps capabilities to deliver always-on, secure digital experiences.

Defining Full-stack observability (FSO) benefits

Many FSO customers define their business benefits and outcomes; the IDC research highlights many of the critical themes that IT and business leadership teams should consider as drivers for investments in a platform approach for observability across the full stack. These are:

Focus on what matters most, in real time. Collaboration and improved proactive control points across security, IT operations, and SRE teams offer a pathway to improving and accelerating an organization’s security posture and service performance at the same time.
Accelerate mean time to identification and resolution. Observability platform adoption offers technology capabilities that unify traditionally fragmented data onto a single platform and apply analytic/AI models to improve team and process efficiencies that reduce business and customer risks.
Increase data TCO and expand use cases. The importance of solution extensibility empowers customers with the ability to ask and solve questions from a unified observability data model, unlocking data value and new use cases that are unique to every organization.
Improve security and IT operations processes and team collaboration. The rising influence and collaboration of security operations teams with IT operations teams can be accelerated using observability platforms.
Drive business outcomes, early and often. Observability provides IT leadership teams with a direct path for business leadership collaboration through conversations about the customer journey and experience and related value streams.
Expand partner opportunities. Service partners have opportunities with observability platforms through new use-case development and high interest in SaaS-delivered services.

About Cisco FSO solutions

Cisco helps customers to reimagine their applications, power hybrid work, secure their enterprise, transform their infrastructure and meet their sustainability goals. For full-stack observability, Cisco provides real-time visibility, insights, and recommended actions enriched with business context, enabling ops teams to proactively identify, prioritize, and resolve issues to deliver exceptional digital experiences. The Cisco Observability Platform correlates telemetry from data across multiple operations domains—including applications, multicloud infrastructure and cloud services, network, security, end users, the business, and more—to help teams understand risks and dependencies across environments, strengthen security, and optimize resources across the full stack before it impacts the business.

Learn more about Cisco FSO solutions

"}]]  As the adoption of multiple clouds, application architectures, and digital transformation leads complexity to soar, executives realize that the need to deliver secure, high-performing digital experiences for employees, partners, and customers has never been more acute. Cisco Full-Stack Observability can help.  Read More Cisco Blogs