Security Concepts · Topic 2 of 8
Comparing Security Deployments
Compare network, endpoint and application security, agent and agentless protection, antivirus, SIEM and SOAR, containers and cloud security deployments.
- 5 min
- Includes a diagram
- Network controls see many hosts. Endpoint controls see deep local detail.
- Agent-based protection gives depth. Agentless protection gives easy deployment and a shallower view.
- Legacy antivirus depends on signatures and misses new malware.
What it is
A security deployment is the choice of where a control runs and how it is managed.
Controls can sit on the network, on the endpoint or inside the application. They can use an installed agent or work without one. They can run on premises, in containers or in the cloud.
Each choice trades visibility, cost and effort. The exam asks you to compare them, not to configure any single product.
How it works
Each deployment type sees a different part of the environment, so they work best together.
Network, endpoint and application security
| Type | Where it runs | Example | Strength |
|---|---|---|---|
| Network security | On the wire or at the edge | Firewall, IPS, web and email gateways | Sees traffic for many hosts at once |
| Endpoint security | On the laptop, server or phone | Antimalware, host firewall, EDR | Sees files, processes and local activity |
| Application security | In or in front of the app | Web application firewall, code scanning | Understands application logic and input |
Network tools cannot see inside encrypted traffic without extra help. Endpoint tools see activity before it is encrypted, but only on hosts that have them.
Agent-based and agentless protection
An agent-based control installs software on each host. It sees deep local detail and keeps working when the host is off the corporate network. It needs deployment, updates and some CPU and memory.
An agentless control works without installing software. It may read logs, query a hypervisor or cloud API, or watch network traffic. It is quick to roll out and suits devices that cannot run an agent, but its view is shallower.
Legacy antivirus and antimalware
Legacy antivirus relied mainly on signatures, which are known patterns of bad files. It is fast and accurate for known malware.
It struggles with new or changed malware, because there is no signature yet. Modern antimalware adds behaviour monitoring, reputation and machine learning to catch what signatures miss.
SIEM, SOAR and log management
Log management collects and stores logs from many sources in one place. It helps with retention and search.
A SIEM (security information and event management) system adds correlation and alerting. It links events from different sources, so a failed login on a server and an odd connection from the same host can raise one alert.
A SOAR (security orchestration, automation and response) platform acts on alerts. It runs playbooks, which are automated steps such as enriching an alert, opening a ticket or blocking an address.
| Tool | Main job |
|---|---|
| Log management | Collect, store and search logs |
| SIEM | Correlate events and raise alerts |
| SOAR | Automate the response to alerts |
Container and virtual environments
Virtual machines and containers share hardware, so traffic between them may never cross a physical switch. A network sensor on the physical wire can miss it.
Containers are short lived and numerous. Security often includes scanning images before they run, limiting what each container may do, and sending container logs to a central place. A weakness in the host or a shared image can affect many containers.
Virtual networks need virtual security tools, such as a virtual firewall, or hypervisor features that mirror traffic to a sensor.
Cloud security deployments
In the cloud, security is a shared responsibility. The provider secures the underlying infrastructure, and the customer secures what it puts there, such as data, identities and configuration.
Common cloud controls include:
- Identity and access management to control who can do what
- Cloud firewalls and security groups to filter traffic
- Cloud workload and configuration monitoring
- Logging from cloud services into the SIEM
Cloud logs and APIs are often the main source of visibility, because there may be no physical network to tap.
What to remember for the exam
Seven facts cover most questions on this topic.
- Network controls see many hosts. Endpoint controls see deep local detail.
- Agent-based protection gives depth. Agentless protection gives easy deployment and a shallower view.
- Legacy antivirus depends on signatures and misses new malware.
- Log management stores logs, a SIEM correlates them, and SOAR automates the response.
- A playbook is a set of automated response steps.
- Traffic between virtual machines or containers on one host may bypass physical sensors.
- Cloud security is a shared responsibility between provider and customer.
Match the verb to the tool. Collect and store means log management, correlate and alert means SIEM, and automate response means SOAR.
Common mistakes
These four errors appear often.
Confusing a SIEM with SOAR. A SIEM finds and raises the alert. SOAR takes automated action on it.
Assuming the network tools see everything. Encrypted traffic and host to host traffic inside a hypervisor can be invisible to them.
Calling signature antivirus enough on its own. Signatures only cover known threats.
Thinking the cloud provider secures everything. The customer remains responsible for data, access and configuration.
An agentless design cannot protect a host that has no network path, log feed or API for the tool to use.
Check yourself
Work through these three questions.
What is the difference between a SIEM and a SOAR platform?
A SIEM correlates events and raises alerts. A SOAR platform runs playbooks that automate the response to those alerts.
Why can legacy antivirus miss new malware?
It relies mainly on signatures of known threats. A new or changed sample has no signature yet.
Why can a network sensor miss traffic between containers on one host?
Traffic between virtual machines or containers on one host may never cross a physical switch, so a sensor on the physical wire does not see it.
Topic 2 of 8 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.