When it Involves Compliance Necessities, Topology Issues!


Once I take a look at the evolution of community safety and the way IT and safety practitioners have protected the community for the final 30 years, I can’t assist however discover how conventional community safety enforcement factors (insert your favourite firewall right here) are nonetheless used to safe networks and workloads. They’ve advanced to supply a various set of options (i.e., IPS, decryption, software detection) to deeply analyze site visitors coming out and in of the community to guard workloads. Nonetheless, whereas firewalls are very succesful home equipment, it has been confirmed that they don’t seem to be sufficient to maintain malicious actors at bay, particularly if these actors handle to breach the firewall defenses and transfer laterally within the community. However why is that this?

We’re within the digital period, the place the idea of the perimeter is not contained to a location or a community phase. To offset this new actuality and supply a extra tailored-based coverage management for safeguarding workloads, distributors have moved safety nearer to the workload.

There are two approaches to do that -, utilizing agent or agentless methods to construct a micro-perimeter across the workloads.

Which strategy is the proper one to take? Nicely, this relies on a number of components, together with organizations, kind of software, or staff construction. So, let’s begin untangling this.

The problem(s)

Essentially the most direct strategy to guard purposes is to put in software program brokers on each workload and name it a day. Why? As a result of then each workload has its personal micro-perimeter, permitting entry to solely what is critical.

Nonetheless, it’s not all the time attainable to put in a software program agent. Maybe it’s a mainframe software or a legacy working system that requires fine-grained insurance policies resulting from a compliance mandate. Or software workloads which might be within the cloud and the agent set up is solely not attainable resulting from organizational constraints.

And this isn’t the one problem or consideration for selecting your strategy. The groups or teams that comprise any firm typically have totally different safety necessities from one another, resulting in the triad problem: folks, processes, and know-how.

Let’s begin with folks (coverage proprietor) and course of (coverage execution). Often, every group has its personal set of distinctive necessities to guard its software workloads, and an outlined course of to implement these necessities within the coverage. To assist this, a instrument (know-how) is required, which should adapt to every group’s wants and needs to be able to defining a typical coverage throughout agent and agentless workloads.

To start out unwrapping this, that you must ask your self:

  • What are we defending?
  • Who’s the proprietor of the insurance policies?
  • How is coverage execution performed?

For example:

Say you wish to shield a finance software (what) utilizing an agent-based strategy (how), and the proprietor of the insurance policies is the App Workforce/Workload Workforce (who). On this state of affairs, so long as the appliance doesn’t break and the staff can proceed to deal with coding, that is typically a suitable strategy. Nonetheless, when implementing the frequent coverage, the interpretation from human language to machine language tends to generate additional guidelines that aren’t essentially required. This can be a frequent byproduct of the interpretation course of.

Now, let’s assume that in your group the safety of a legacy software (what) is tasked to the Community/NetSec staff (who) utilizing an agentless enforcement strategy with community firewalls (how) as a result of on this case, it’s not attainable to put in software program brokers as a result of unsupported legacy working system. As within the first instance, additional guidelines are generated. Nonetheless, on this case, these pointless additional guidelines create detrimental penalties due to firewall guidelines auditing necessities for compliance mandates, regardless that they’re a part of the frequent coverage.

Topology because the supply of reality – pushing solely what’s required

Cisco Safe Workload has been addressing the folks, course of, and know-how challenges since its inception. The answer embraces each approaches – putting in software program brokers on workloads no matter kind issue (bare-metal, VM, or container) or by utilizing agentless enforcement factors resembling firewalls. Safe Workload adapts to every group’s wants by defining the coverage, such a zero belief microsegmentation coverage, to successfully apply micro-perimeters to software workloads in assist of the zero belief strategy. All inside a single pane of glass.

Nonetheless, as defined within the instance above, we nonetheless wanted to align our coverage to the compliance wants of the Community/NetSec staff, solely utilizing the coverage guidelines which might be required.

To sort out the extra guidelines problem, we requested ourselves, “What’s the most effective technique to push insurance policies right into a community firewall utilizing Safe Workload?”

The reply boiled all the way down to a typical idea for Community/NetSec groups – the community topology.

So how does it work?

With Safe Workload, the time period topology is intrinsic to the answer. It leverages the topology idea utilizing a assemble named “Scopes”, that are completely infrastructure agnostic, as proven in Determine 1.

It permits you to create a topology tree in Safe Workload primarily based on context, the place you’ll be able to group your purposes and outline your coverage by utilizing human intent. For instance, “Manufacturing can not speak to Non-Manufacturing” and apply the coverage following the topology hierarchy.

The Scope Tree is the topology of your software workloads throughout the group, however the hot button is that it may be formed for various departments or organizational wants and tailored to every staff’s safety necessities.

The idea of mapping a workload Scope to a community firewall known as “Topology Consciousness.”

Topology Consciousness allows the Community/NetSec groups to map a selected Scope to a particular firewall within the community topology, so solely the related set of insurance policies for a given software is pushed to the firewall.

So, what does this execution seem like? With the Scope mapping achieved, Safe Workload pushes the related coverage to the Cisco Safe Firewall by means of its administration platform, Safe Firewall Administration Middle (FMC). To keep up compliance, solely the required coverage guidelines are despatched to FMC, avoiding the additional pointless guidelines due to Topology Consciousness. An instance of that is proven in Determine 2:

Key takeaways

Operationalizing a zero belief microsegmentation technique shouldn’t be trivial, however Safe Workload has a confirmed monitor report of creating this a sensible actuality by adapting to the wants of every persona resembling Community/NetSec admins, Workload/Apps homeowners, Cloud Architects, and Cloud-Native engineers – all from one answer.

With topology consciousness, you’ll be able to:

  • Meet compliance and audit necessities for firewall guidelines
  • Shield and leverage your present funding in community firewalls
  • Operationalize your zero belief microsegmentation technique utilizing each agent and agentless approaches

For extra data on agentless enforcement please learn: Safe Workload and Safe Firewall Unified Segmentation Weblog

Need to study extra?  Discover out extra at by trying out our Safe Workload sources.


We’d love to listen to what you suppose. Ask a Query, Remark Beneath, and Keep Linked with Cisco Safe on social!

Cisco Safe Social Channels