Cisco Secure Workload Reviews

When we onboarded Cisco Secure Workload, the usual use case was to discover internal application dependencies and create a dependency map for Cisco ACI. As the network team, we chose to implement ACI in a network-centric mode rather than an application-centric mode. However, we soon realized that Cisco Secure Workload's capabilities extend far beyond discovering dependency maps.

We use it for internal micro-segmentation. After evaluating it, we began using the agent-based solution across our server estate to protect our internal servers from each other and internal users. Today, our primary use case for the product is micro-segmentation within our internal network.

Cisco Secure Workload is an agent-based solution that allows you to install the agent on physical servers and virtual machines in your own data center and on VMs in cloud environments like AWS, Oracle Cloud, or Azure. This flexibility is a key advantage over other solutions, such as NSX-based products, which may be tied to specific vendors or technologies. 

With Cisco Secure Workload, we can effectively implement micro-segmentation regardless of where the application resides, whether in the cloud or on-premises. This solution enables us to segregate the entire application estate, including servers, databases, and user access, using the agent-based micro-segmentation capabilities of Tetration. The Tetration Agent leverages the local firewall on the operating system, whether it’s the Windows Firewall or a Linux firewall on a VM.

The only use case I can see that makes sense is micro-segmentation. I think there are other use cases for it. The main purpose of the product is to do micro-segmentation by collecting IP. That could be done by installing an agent, and then you have all the communication coming in and out. You could also use some flow sensors installed in the network that receive a copy of the traffic and then report that back to the system.

No matter where you're getting the flow from, the system calculates all those flows. You know what the front end, the middleware, the back end, the database, and so on are so that you can group them. The system's strength is actually in proposing the policy. So, all web servers need to have HTTPS access to it.

Then, you can start building the policy for your application. When you have a policy, you can push that situation for self-service, which means you're trying out the policies you created in a real environment. Then, you can spend time trying to see if you have any escaped traffic, which means you have traffic that does not match the policy. If you were in enforcement mode, that traffic would be dropped. So you have a period where you can monitor if you have done the correct mode, seen all the traffic, and so on. That could be for a couple of weeks, that could be a month, or it could be half a year, depending on the criticality and how important your system actually is.

From my point of view, the strength is the policy proposal you're receiving. It's really good. That's the biggest challenge for everybody - creating a policy you could use in Cisco Secure Workload itself. You could also export it and use it in your firewall if you want to do that if you have a Cisco firewall setup. But you could also use it in every other enforcement part. I'm seeing what people are struggling with in companies - to actually restructure your CMDB data correctly, then get a policy that you can use in your network. I think that the tool is good at that.

There's room for improvement when it comes to Cisco Secure Workload. A couple of internal areas could be refined a little bit. They are trying to solve it, depending on where you suppose the agent is. Suppose you have the agent on both the server and the client, which could be the front-end server or web server connecting to the. In that case, if those two are communicating on RPC, the server can look into its configuration. It could go down and find the configuration file on the FTP server and then set the policies to it. But there are a lot of different FTP servers out there. It's also a complex case for the tool to support all FTP servers.

Some things are related to Windows, Unix, Linux, and IBM AIX. We have been working on all platforms, but the support for IBM AIX isn't that good compared to normal operating systems. Support is much better for Windows compared to IBM AIX.

We have an on-premises deployment.

The most valuable feature of this solution is security. We check processes on the different components of the virtual machines.

Our primary use case of this solution is to analyze traffic. We have a route cluster of 2,500 nodes right now just in case the application is facing any delay or latency we wanted to have the visibility. It allows for insight into our data center.

With the analysis we have, we are only looking at the features of application sales and our books during the month. What we really needed was to know how the traffic flow is and what the latency is. We have a server team which comes back to us and they complain about the latency that our app is facing and we are not able to determine what the issue is. They want to back the network itself and we end up substituting nothing. With Tetration insight, we are able to get that latency on our level accounts and we are able to determine whatever the issue is with the application latency itself.

We have many use cases for Cisco Tetration. Examples of this are micro-segmentation and the visibility of applications.

The most valuable feature is micro-segmentation, which can be used to deploy endpoint security along with the visibility of application and connection matrix

This product is simple to deploy, and provides visibility of connectivity between the endpoints/application.

Usually, when somebody has a big Cisco shop, they'll deal with Cisco solutions.

I used to be a big fan of Cisco Secure Workload and Cisco Tetration Platform. I used to really like it. However, the product has undergone significant modifications since then. Certain pieces of it have been moved into Cisco SD-Access, and the original DVR of the network functionality has been moved. As a result, the product has changed a lot since I was most familiar with it.

Regarding features, it's quite similar to scanning tools as it catalogs vulnerabilities and identifies their locations on your endpoints within the network. It operates on an agent-based system and uses a catalog and scoring function to determine where known vulnerabilities exist.

The primary use case for us and our clients is to give the auditors the tools and the view on the network that we're in sync and that we're audible in what we do.

Instead of proving that all the access control lists are in place and all the EPGs are correct, we can just point the auditor to a dashboard and point out that there aren't any escaped conversations. It saves an enormous, enormous amount of time.

The solution is used for data communication and consultancy for ECS.

The product provides multiple-device integration.