Cloud Network, Application and Data Security with Multicloud Defense and Secure Workload

What it is

Cloud security covers the network, the application and the data, and two Cisco products address the first two in different ways.

Cisco Multicloud Defense places inspection gateways in your cloud networks, and applies one policy across several cloud providers. Cisco Secure Workload studies the traffic between workloads, and enforces microsegmentation on them. Data security then uses encryption and access controls, which the cloud platform provides.

How it works

Treat each layer separately, then see how the products fit.

Network security in the cloud

The cloud network is software defined, and uses constructs that map to familiar ideas.

Native controls are basic. They filter on addresses and ports, but they do not inspect content. For deeper inspection, such as intrusion prevention and web filtering, you add a firewall service or a virtual firewall.

Application and data security

Application security protects the app itself. A web application firewall (WAF) blocks attacks such as injection and cross-site scripting at the HTTP level, and API protection checks authentication, schema and rate. Secrets belong in a managed vault, not in code.

Data security protects the data wherever it sits. Encrypt data at rest and in transit, and manage keys in a key management service. Control who can read the data with least privilege, and use DLP to find sensitive data in storage and in transit.

Cisco Multicloud Defense

Multicloud Defense is a cloud delivered security service for public cloud environments. It has a management controller, delivered as a service, and gateways that you deploy into your cloud networks. The controller holds policy, and the gateways enforce it.

Gateways handle traffic in different directions.

• Ingress: inspects traffic from the internet into your applications.
• Egress: controls and inspects traffic that leaves your workloads for the internet.
• East and west: inspects traffic that moves between workloads and networks inside the cloud.

The service can apply intrusion prevention, TLS decryption, web application protection, FQDN filtering and data loss prevention. Policy is written once, and can use tags, so it follows workloads as they change. It supports the major public clouds, so you use one policy model rather than a different tool for each.

Cisco Secure Workload

Secure Workload focuses on the workloads themselves, in data centres and clouds. It collects telemetry from software agents on servers, and from network and cloud flow data. It then builds a map of which applications talk to which.

That map is called application dependency mapping. It shows real flows, so you can write policy that matches how the application behaves.

Secure Workload then supports microsegmentation. Microsegmentation applies allow rules between small groups of workloads, so a compromise cannot spread freely. The agents enforce policy using the host's own firewall, so enforcement works wherever the workload runs.

Other uses include:

• Vulnerability visibility: shows software and known weaknesses on workloads.
• Behaviour monitoring: detects processes or flows that deviate from the baseline.
• Policy testing: lets you see what a policy would block before enforcing it.

Choosing between them

Use Multicloud Defense when you need inspection at the edges of the cloud network, such as internet entry and exit. Use Secure Workload when you need fine grained control of east and west flows between workloads. They complement each other, since one works at the network boundaries and the other at the workload.