Cisco DNS-layer Security

Thank you Rachel. Hello, everyone. I'm Nikisa Teammorien. I'm on the Cisco security product team. Happy Wednesday to all of you and thank you so much for taking the time out of your schedule to join us today for our umbrella DNS layer security product update webinar. We have a great.00:04Agenda packed for the planned for this session today. We're gonna be 1st talking about some new AI driven capabilities, and then we're gonna be talking about some new upgrade paths that are available for all of you where you can get more capabilities at NO extra cost. Great way to maximize the value that you're getting.00:24Out of your existing umbrella subscription.00:43Okay, so before we take a closer look at the agenda for our session today, I'd like to start with a friendly preface to this presentation. So today we're gonna be sharing our latest DNS security innovations. These innovations are available and active in the productivity.00:51Day and you are already enjoying them as an umbrella DNS customer. Additionally, 2nd half of our presentation today, we're gonna be talking about optional upgrade paths that you can take at, at NO additional cost. And what I want to make sure you are all aware of is that.01:11You know, upgrading your umbrella DNS subscription is completely voluntary, but we do think you will, you will be interested in making the move over to secure access that is our evolution of Cisco umbrella. You're gonna get more features, same costs, and we're gonna make it really.01:32Be easy for you to move. So definitely want to encourage you all to consider it.01:51Alright, so now let's take a look at our journey forward for our session today. We're gonna start with a brief, but important administrative update. This is around the AWS S3 bucket key rotation. You may have seen messages about this in our umbrella newsletter or your.02:01Dashboard, Phil is gonna be talking about this in a moment here. And then from there we're gonna look at how you're stopping more threats or stopping more threats with our new DNS security innovations. So we're gonna look at what's new with our AI driven DNS tunneling mitigation. And then my colleague Curtis.02:21Is gonna talk to us about the detection of adversary domain generated algorithms.02:41So again, these capabilities are now available in the product. You're already getting access to them, NO added cost. From there we're gonna talk about the SSE evolution at Cisco. I'm gonna give you guys the lay of the land, make sure you're aware of, of what's new, and then we're gonna talk specifically about how you can get.02:47Access to a new cloud DLP capability as well as malware scanning at NO extra cost. And then we'll wrap up by taking a look at our new upgrade manager and how it can simplify your evolution to secure access if that's something that you're interested in.03:07As Rachel mentioned, please do put your questions in the Q and A window and we're happy to answer those questions throughout the session. And with that, I will hand it over to my colleague Phil, for the update around S3 bucket key rotation.03:27Thanks Nigisa. Just a quick bit of housekeeping, everyone. We've implemented a policy since early May this year, where we will have mandatory key rotation for any Cisco managed S3 buckets for, for your logging storage.03:43It's.04:04Really, it's all about security. Bucket keys are very different than passwords and they are something that should be rotated periodically. So we've implemented this across the board. If you self manage your own S3 buckets, there's NO change there. You get to use whatever requirements you have for.04:05Rotation or whatever your own policies are for, you know, data retention and, and user access. So NO change there, but for the buckets that we are hosting on your behalf, we've implemented key rotation. This is something that you could do manually if you really want, but.04:25The intent was that you can use our API to rotate, rotate these keys for you. You can automate this with a script. We have sample scripts available for you. It's pretty plug and play for for pretty much anyone who's using it and works really well with, with logging through sims like Splunk who might be some of our favorites.04:42These days for obvious reasons but for others as well.05:02So if you need any more information, we have a few posts in the knowledge base about this. Once again, some sample code to make this as easy as possible for you to implement, and hopefully hopefully you enjoy the the added level of security and hopefully it you know minimizes the amount of administrative.05:06Overhead in keeping your most important data safe.05:26Oh alright and now on to more or things that I think are more exciting, we've added some new innovations in our DNS security for everyone, and that includes everybody on umbrella, using using our DNS resolvers. We've added.05:32Some real time AI based detections for DNS tunneling, which, we're able to enforce with sub millisecond latency and a really significant improvement in both our detection rate and in our false positive rate. And we'll talk a little bit later about DGA.05:50Detection that we've also extended this year.06:10We can do alright intro slide. Alright, so, really I'm probably gonna spend more time defining the problem than than talking about the solution. But when you think about DNS protection, typically, you have.06:14Some device or service that's trying to make a connection over the internet. And the 1st thing that it'll do before establishing that connection is make a DNS look up. And then that goes out to our DNS resolvers. We go through the process of recursing for you. So, you know, one question comes.06:32Going to us means that we will either answer from cash or we will chase down delegations across numerous authoritative name servers and come back with an answer to you and then hand that back.06:51And then the actual connection happens, whether that's web traffic over HTTP or HTTPS or, you know, could be an SSH session or FTP or or any other, you know, internet service. And I think if we advance through here, it should show an overlay. All right, so.07:03You know, the protection really happens at the DNS resolver, and thanks that's ok. The protection really happens at the DNS resolver, but the the bad stuff we're trying to prevent from happening happens much later if you think about things on a millisecond scale. Really the thing that you're trying to prevent is a subsequent transaction.07:22Of HTTP, HTTPS or or any other internet service. So that's usually what we think about for, for DNS protection, you know.07:42Block the DNS lookup and you're preventing bad things from happening down the line. So if we proceed through to the next slide, DNS tunneling kind of, you know, it's emerged, you know, probably close to 20 years ago now, at least in concept, but in practice it's becoming more and more prevalent.07:51This is kind of flipping the model on its head about where.08:10The bad things are actually happening and it's about encoding data inside a DNS query. And this passes right through firewalls because, and this is different by the way than just taking bad traffic and disguising it over port 53. This is encoding data.08:16Inside DNS lookups that are going to your normal recursive resolver. And because you're talking to your trusted recursive resolver, whether it's us or or some computing resolver or the one provided by your ISP, the firewall passes it through. The source and destination are.08:35Are good. The source is you and the destination is your preferred DNS resolver. So it matches all your firewall rules. It's a covert channel that is really sort of hidden almost taken off, it's taken off graphically inside the DNS request. And the data gets.08:53Assembled by the bad actor who's in control of a name server that's.09:12Down the line in that you never actually see a direct connection to. This has been utilized for data exfiltration command and control, full VPNs, reverse shells, basically any type of traffic that you can pass or tunnel through the internet can be incur.09:17Noted as DNS requests given enough time and volume.09:37It's been a real challenge for enforcement because missing detections allow bad actors to succeed while detecting incorrectly can block a lot of legitimate internet traffic. And challenges for detect for detection have been that.09:40A lot of legitimate DNS traffic will take the same form. There's a lot of legitimate reasons for, for grids and other sorts of encoded information to exist in the DNS. And just because you see something that's base 32 encoded doesn't necessarily mean that it's somebody trying to exfiltrate data or attack you. Additionally bas.09:59That actors use very short lived domains and ephemeral name servers when performing attacks like this, even shorter than a lot of the other threats that we target, and sometimes they can also be.10:19Very, very specific to the attack that they're operating. So unlike some other threats that are more widespread, we may have NO additional or prior information about the the evil name servers that are, that are participating in an attack like this. Traditional detection.10:32Really lacks the context of what's happening with the DNS request. So if you look at things like other mechanisms like firewalls, next gen firewalls, intrusion prevention, DLP, they either lack an understanding of what data could potentially be encoded in these DNS queries or they lacked the.10:52Context of DNS itself. If you're trying to look at these packets or or datagrams as they fly past you, it's like being in those.11:12Those money booths where you're just grasping at like individual dollar bills and you don't get much of anything. So let's proceed through the next slide and we'll kind of show the picture of what DNS tunneling looks like. I've registered evil.com and I've delegated that to a name server that I own.11:21And a DNS resolver performing its normal function when it's looking up a domain name will, will do a recursion. It DNS has a hierarchy. It's not actually a phone book of the internet. It's not all stored in one place. It's a series of delegations. So the route delegates to the name servers for.com and.11:41Dot com delegates the name servers for evil.com and it can be delegated further down through there through either C names or other other labels or zones. And as a resulter recurses through.12:01Yeah, we can go ahead. We can, we can do the animation. As a result of our recurses through, eventually it will talk to the name server for evil.com. So now if I go to compromise a client, whether that's through malware or maybe some sort of a hands on keyboard attack or or any other form of compromise.12:15I can do things like a database dump or a password dump, and I found out.12:35The password for, someone coincidentally named Curtis, NO relation to any colleagues. Their password might be 1234, and I can encode that using base 32 and then I can turn that into a domain name, which is a subdomain of evil.com that I own. So when that when a DNS.12:42Request is made for this domain name. It goes once again through the firewall and all the other detection engines that you have.13:02That just see a DNS transaction between your client and its resolver, and the resolver goes through and starts recursing. And now the bad thing actually happens as soon as the question is asked to evil.com. And as soon as that name is asked.13:10The owner and operator of evil.com has all the information they need to decode and, and hang on to that data and do whatever evil things they do with it. Take note that NO response is even required. A lot of times you'll see during a tunneling attack, that evil name server will respond.13:27With an X domain. It'll say NO such domain exists. Thanks for the information wink quink. Or they'll lie and they'll give you a falsified IP address or a text record full of grovely cook. And that could be establishing two way communication or it could just be trying to make it look like a benono.13:47Find destination on the internet because once again, most of the time when people think about DNS protection, they're thinking about IP addresses that are pointing them somewhere bad. They're more concerned about the return path than they are about information leaking out.14:07So, so we've so I think that's defined the problem pretty well. If you have any other questions, feel free to ask in Q and AI love talking about this stuff. What we've done is we've collected a lot of data with help from the Talos research division of Cisco. Very large, I think one of.14:21The largest private security research organizations in existence. They have massive data sets of known DNS tunneling traffic that they've collected over the years and we've trained.14:40A, a convolutional neural network on this data to look for these patterns of encoded DNS tunneling data. And we are now running in real time on the resolvers themselves natively in the resolver code.14:51This AI model that is looking for, this type of DNS tunneling traffic. So it's been trained on the data in all different forms and so it will accumulate in a cache as this DNS traffic goes by.15:11And, and compare that against its training data. And it has the ability to perform a real time block sub millisecond latency without ever having to make a reference externally to like an API call or or take a look at large data sets of, you know, known domains for allowing and blocking.15:29So we're able to make that determination without any other context, which is really.15:49Really fast and it's really powerful, and in our testing, let's see. Can we yeah let's go to the next slide. Oh yeah. So yeah, protected. So we're still protecting the resolver, but the bad stuff is happening in the.15:54During the recursion instead of somebody establishing an HTTP connection. So this happens at query time oh and how it maintains less than 20 millisecond response time. That's, that's our response time in average.16:10In total performing all the DNS functions. That's the checking through the AI model is sub one millisecond. But this is something that a lot of our competitors just don't have. For those who do have.16:27Protections for DNS tunneling. They're either performing their analysis offline after they collect logs and they do their processing centrally and then they turn that into a list and then distribute that out. Even if you can do that as fast as possible, it creates a lot of lag time. There's problems with, you know.16:43Scale both big and small, where really targeted attacks may not be picked up right away, and there's just overall lag.17:03And there's a lot of other ways that have been attempted and you might even see in documentation for some of the competitors, they'll say, well, we'll do rate limiting or we'll just look for a large number of NX domain responses or maybe we'll try to write a regular expression to handle it, but in practice that's just not a very effective way.17:12By yet, at catching these sorts of attacks that are very nuanced and constantly evolving.17:32If anybody really wants to do a deep dive and hear about how we took pytorch and wrote our own implementation in C to implement the tensor Algebra and got it like 90 % faster by writing it in C, feel free to take a look at our recent DNS Orc presentation that David and day Hon.17:39Put together. It's a real, I mean it is a thrilling 45 min presentation if you're really into the stuff like I am, but that's not what this webinar is all about. Let's see, do we have one more slide after this? Yeah, but the great news is.17:57You don't have to think about any of this. This is already implemented now as of January of this year in the DNS tunneling VPN category. So this runs alongside our other detection types, our heuristics and are more sort of like traditional list based detections that are fed by.18:14Talos research, so.18:34This part of the engine just running in isolation has improved over our previous model from 88 to 99.1 % im improvement in in detections and we've reduced our false positive rates significantly, which means I mean, it's less disruptive, so we're able to be much more aggressive in what we're catching.18:36And we're still exceptionally performant. We will see on a typical day, we will catch about 500 legitimate DNS tunneling detections every second. And that's a big help and and big shout out to the Cisco Talos research team and in collaboration with our DNS resolver pla.18:56Platform team that really started with this as a hackathon project and helped turn this into a reality. We're really, really proud of all the work that they've done.19:16And there's more, I'd love to hand this over to Curtis who's gonna be able to talk about how we took this and have now applied it to DGA algorithms as well. Thanks Phil. Yeah, thanks for still not changing your password Curtis. We've delivered this presentation a few times already and it's still.19:261234I think I would learn. You think I would learn. Alright, so diving in a little bit to the DGA. So just to kind of set the stages, you know, what a DGA is and what the problem is, is effectively dgas quite often will go hand in hand with you know a DNS tunneling attack. So essentially.19:46That's what they are, is there an algorithm that generates new domains, you know.20:06Programmatically so that it can effectively become resilient. So, you know, rather than relying on a singular or hard coded type domain, they generate a lot of these, these domains from an algorithm and programmatically then they they maintain the resiliency for abating detection and maintaining any of the command and control type channels.20:11That's that that they may have established as part of the malware.20:31And so when you look at at what the challenge is in trying to detect this, the, the general challenge is just scale, right? You've got this, this massive volume of domains that can be gen generated programmatically. You've got algorithms that are continually evolving. You've got things like fast flux and what have you with rotating IPs where.20:34Things are continually changing both on from a an FQDN perspective as well as, you know, the backing IPs.20:54And then ultimately, you know, the other challenge is that these also carry similarities to legitimate domains. And so if you look at at kind of the problem in detection, you know, switch that over to, to what the scale is. 90 % of all command and control malware uses DNS for communication, and currently there are.21:01There are over 50 malware family families that use DGA techniques. So when you, you marry those two together, you've effectively got, you know, DNS that's being used for command and control or as Phil has mentioned, you know, back channel VPN reverse shells, and then you've got this proliferation of malware families that are also using.21:21And DJA techniques to maintain, you know, their foothold into your environment. You know, again, looking at at the general scale, there are, you know, according to the registrars, there's approximately a hundred thousand new registrations per day.21:41Netcraft says there's 1.1 billion websites currently on the internet with 35.4 million registered just in 2025. Now from what we see within our DNS resolvers, we see 300000 new domain requests a day.21:55As we serve our over 800 billion requests. So, you know, you imagine this at scale as a, a SOC analyst or somebody who's trying to do, you know, detections, this is a very large scale, big data type problem, which is ultimately really, you know.22:10Kinda teed up for, for an AI or a machine learning type implementation. And so what we did is we took all of the lessons learned as we generated the DNS tunneling algorithm, and we said how do we apply this now to, to other large scale problems and you know can we get some some reuse Cause this this algorithm has been proven to be very, very.22:29Very effective and very, very fast. So what we did is we actually took the same algorithm, you know, slightly different parameters in actually what it's trying to detect, but ultimately pushed it towards this domain generation problem. And I'll show you a little bit in the next slide in a minute how.22:48How effective it's been. And so when you look at, at this detection, solutions kind of to date have been, you know, this reputation type system. So, you know, domains generate reputation based on, you know, their content, you know, 3rd party security feeds and and all of these pieces that come together for a threat intelligence team to also.23:08Determine the reputation of of a website.23:29Well, this incorporates some lag time. So now if you imagine that you have data exfiltration or command and control problems due to malware combined with, you know, this proliferation of domain generation algorithms, you know, reputation systems are always going to be in catch up mode.23:31So what can you do to get ahead of it? We can actually reverse engineer the DJ algorithm. And so, you know, you take apart the malware, you reverse engineer it, and then you can actually do a little bit more of a predictive model where you can start to understand what domains are gonna be generated because of the seed or what have you within the the algorithm itself.23:49Now, again, looking at the scale of this, this is virtually impossible for a human to be able to monitor all of this DJ activity and continually to to update you know their their you know whether it's a destination list, manual blocks or or just, you know, kind of the that category itself.24:10And so, you know, we do all of the things with the reputation systems, we reverse engineer the algorithms, but this is just that that getting even a little bit more proactive by getting in front of it. And just to give you a little bit of a tiny peek into a an old data set of how big this.24:28Problem is if you look at conflict array when it was released in 2008.24:48Keep in mind, that's a long, long time ago in in internet time. When configure A was released, it would actually generate 250 domains a day. Nine months later, when configure C was released, it was generating 50000 domains per day. So again.24:53The scale of this problem is very, very large. And so one of the approaches that we've taken is to actually apply AI to the detection. Next slide please. Perfect. So when we apply AI to this, this detection of these families, what did it actually meant for us?25:10So it took us from 68 % to an 88.1 % improvement in real detections. Now, one thing I want to point out if you're, if you're a you know machine learning or statistics, you know, nerd, and I say that very affectionately, is that this is what's known as the F one.25:30So F one effectively is the harmonic mean of precision and recall. And so recall is your ability to continually detect the bad things on a consistent basis, and the precision is, you know, kind of as stated, it's how good you are as you continually detect these things at at you know detecting the.25:48Right things, not false positives, not false negatives.26:08And so, you know, when Phil showed, even with the DNS tunneling when we improved to 99.1 %, it's the same. That's actually how we've not only narrowed our consistency and our ability to detect it, but actually narrowed the aperture of how precise we are in our detection. And what, again, as Phil mentioned, what this allows us to do is this allows us to be a.26:11A lot more aggressive in our detections because we have a high level of confidence that you know we don't have a, have a high false positive or a false negative rate. Similarly in looking at this, we actually reduced our false positive and false negative rates from by 50 %. So if you think about, you know, kind of that as a scope of, you know, this is, this is per.26:31Perfect and you know, we've actually then narrowed to the aperture to actually be a lot more precise in our detection.26:51And this, you know, DGA detection DNS tunneling, this is part of these continual updates and these innovations that we're continually working through, you know, whether it's within our, our DNS detection engines or our proxy detection engines and and so forth. And it's really just a continual investment in the.26:59Platform so that, you know, you as a customer can ultimately, you know, sleep better knowing that we're, we're actively working on our innovation vectors and you can count on this as part of your layered defense.27:19Okay. And now I'll hand it off to Nagisa. Thank you Curtis, and thank you Phil. Really appreciate those great updates around what we've done with DNS tunneling and detecting dgas. Great to see that the material improvement in our ability.27:32To to find detections or to detect. Ok, so now I want to transition and talk about the umbrella DNS evolution. So as I mentioned earlier in our presentation today, if you are happy with umbrella DNS, you can certainly stay there.27:52But there are some new capabilities and new upgrade paths available that we definitely want to encourage you all to consider.28:13Okay, so let's start by taking a look at our, a refresher at our 2024 cloud delivered security portfolio. So as you are all aware, we've had an umbrella DNS package as well as an umbrella SIG offering, and then we added secure.28:23Our access, which is our latest evolution and our universal ZTNA offering. And what's new is back in May, we added a new offer.28:42And this new offer is called Cisco Secure Access DNS defense. I'm really excited to tell you all about it today. So this is the evolution of Umbrella DNS. We launched it in early May, and today I'm gonna talk you through, you know, what capabilities are available.28:56Couple with this new package and the great news is that you can upgrade to DNS defense at NO extra cost and you can make this move on your own timeline. And I mentioned earlier that we're making it really easy for you guys to make.29:16To move. So if you are interested, we do have a free access tool that's available to help you with your upgrade and to move over your policies. And my colleague Chris is gonna do a demonstration for us on that in a few minutes. This tool is activated.29:36By your Cisco partner if you want to opt in and you, you do want to upgrade, so it's completely voluntary and it will not be activated unless you ask for it.29:56Okay, so one thing that I I did want to mention is that what Phil and Curtis rec, what Phil and Curtis covered today, you get that protection whether you're on umbrella DNS or on secure access DNS defense. It's the same protection.30:13Either way, from a DNS layer security perspective and there's some added capabilities that you get when you move over to move over to secure access DNS defense. But either way you're getting the same number one ranked, top ranked DNS layer security. So last year gigaome conducted.30:33A DNS radar report and they evaluated a total of eleven security vendors in their DNS offerings and they ranked Cisco as number one in DNS security, and recently gigaome refreshed this report and we were able to demonstrate again.30:53That we had, you know, the number one level of DNS security, same level of DNS security as umbrella DNS, and the new report has now been refreshed to share our latest branding.31:13With secure access DNS defense, and we'll put the link in the chat here for you guys to check out if you wanna, if you wanna skim through the report or or take a closer look at it. Okay, so in terms of why you should consider upgrading to Secure Access D.31:26DNS defense. So there's a number of great reasons why you should consider making the move over to secure access DNS defense. And this could be now, it could be a few months from now. It's really whenever you're ready.31:46You know, the, the net of it here is that when you upgrade, you are receiving stronger capabilities, more, more capabilities, stronger security at NO additional cost. So you're gonna get cloud data loss prevention, cloud DLP, cloud malware scanning. I'll speak more about these features and give you more context.32:02Just in a moment here, you're also going to get enhanced management with a streamlined policy model. So if you are on a zero trust journey, you're looking to add in the ZTNA capabilities, you can, this will save you time because the manager will do more of the heavy lifting for you.32:22And then what's also great about secure access DNS defense is that embedded within the product is a hundred seat free trial of our secure access private access capability. So this includes our, our zero trust network access and.32:43On VPN as a service capability. We've gotten really positive feedback about this.33:03This capability from our customers, they love the user experience and how transparent it is for the users. They don't even need to know what's allowing them to connect. All they know is that it's just so easy and they're able to access their apps and there's NO, there's NO issues with connecting.33:10Into their applications. And the other thing our our customers love about our private access solution compared to other vendors on the market is they're able to do it on their own timeline. So you can make the move on your own timeline. You don't have to do this in a forklift fashion where everything just.33:30This moves over to the new solution, and that's what some of our other vendors, what some other vendors in the market require.33:50Okay, so in a moment here, my colleague Chris is gonna give us a, a brief demo around upgrading and what the experience looks like to migrate over to secure access DNS defense. I'm really happy to share with you guys that our product team has made this.34:00It's super simple, really easy, and for a typical customer, this, this takes about 5 min or less. So really, really efficient with your time. And the other great benefit here is that you're able to run your umbrella instance simultaneous.34:19With your secure access DNS defense instance so that you can, you know, take all the team time you need to move that policy and protection over and, you know, make the official cutoff whenever you're comfortable. I know that some teams are, some security and IT team.34:39Most are swamped and have projects plans for the next three plus months. So this also helps you to.34:59You know, make the move over as it, as it works best for your team. Okay, so now let's talk about the additional cloud security capability, the additional features you get with secure access DNS defense at NO cost.35:07So I mentioned earlier that you're getting cloud DLP and malware protection. So now let's talk a bit more about both of these. So for cloud, data loss prevention, so an example use case here is let's say you have a situation where unbeknowns to you.35:28You, a colleague has put some sensitive data into a cloud share and you're worried about how that could potentially be compromised and the type of cleanup that would be required and the kind of costs associated with that. So with the cloud DLP DLP capability, this is.35:47Is one of the things that we can control and help you with. If you do need further DLP capability, you can consider taking a look at our, our secure internet access package, our SIA package of secure access, and that includes both on prem dlp.36:07DLP as well as the Cloud DLP.36:27So the other capability that you're getting with sec secure access DNS defense is the cloud malware protection, and with this capability, it not only looks at updates and new uploads into shares, but it also retroactively scans all of your existing files.36:31For malware. So you have further control to prevent the spread of malware. So both of these capabilities are included in the secure access DNS defense package as well as all of the, the, you know, bullets that you, you see on the slide here. So these are capabilities that go beyond.36:51Beyond the DNS layer security. So you're essentially getting more security, improving your security posture with NO added cost.37:10Okay, so you can build out the slide here. Thank you. All right, so let's talk now about how our our top rank DNS layer security, our, our top rank DNS layer security and how you are you can also get an on ramp to SSE.37:25And sassy when you make the move over to secure access. So on the left here we have the secure access DNS defense capability. So we've been talking about everything you get with this package in addition to the DNS layer security. Then we also have an SIA capability.37:44So this includes the full secure web gateway, DLP, CASB. It also includes digital digital experience monitoring by thousand eyes. So this is a, a capability that our our customers get really, really excited about. And it also does.38:04Does require a separate license. It's included in the base or the main SIA package. With some other SSE vendors, this is an add on license, but what's so great about it is that it really helps to simplify troubleshooting. So if a call comes into a help desk.38:24The, the, you know, the person working at the help desk can, you know, quickly see, you know, what is the CPU pressure of the user? What is their memory pressure? What, what Wi-Fi network are they on? So it really helps in many ways to simplify troubleshooting.38:44And then we also have the private access spa capability. So this is that integrated CTNA and VPN as a service capability, single client, single dashboard, single policy framework customers love how easy it is to roll out policies, how easy it is to.39:01Get users access to their applications, the single policy framework makes it really easy to do so. And I've been talking to a lot of customers that have made the move over from umbrella DNS over to secure access, some of which have added the the private app.39:21Access capability and we have a great story that we've put together around innovation federal credit union. We're gonna put the link to that story in the chat for you to check out. So this is an umbrella DNS customer. They moved over to secure access. For this customer in particular, they did do the.39:41Full feature set including this, this private access capability. But really at the heart of it is their VP of security information security. He really wanted a consistent user experience regardless of where folks were working in the office traveling.40:01Working from home, they get the seamless, the seamless access to applications, super easy for the users, NO added steps. So definitely take a look at that, at that story and you can learn more about their experience with secure access.40:21Okay, so now that we've, we've talked a bit about our SSC evolution and everything that you're getting, with the, with the secure access DNS defense package, I'm gonna invite my colleague Chris to join us. He's gonna do now an overview and.40:42Demo of what the upgrade process looks like to move from secure access DNS defense, from umbrella DNS over to secure access DNS defense. Over to you Chris.41:01Hey everyone, Chris here with Cisco, and today we're gonna be taking a look at the upgrade process from Cisco Umbrella DNS to Cisco secure access. There's three main steps that we're gonna be taking. Number one, we're gonna create security cloud control and security sign on accounts. Number two, we're going to activate the upgrade manager in.41:25In umbrella. And then finally number three, we're gonna migrate our traffic from Umbrella to secure access and then we're gonna close the umbrella account. The only thing that you need other than admin access to your umbrella account is a claim code. This claim code will be emailed to you after completing the upgrade transaction.41:44And with that, let's jump in.42:05Here we are in the umbrella dashboard and we have an account with some identities configured and traffic going out from those identities to the internet. We can also see that we have some policies configured. These are gonna be using AD groups as the identity source, so we'll be able to see not only how the AD information is migrated, but also how the policy.42:08Policies are migrated as well. Now if we go under licensing, we can see that this account has a DNS advantage license for a hundred and five users, and at the top we have an option to request an invitation to start the upgrade process. And when we request it, we can see the invitation has been sent to our email.42:27Checking our inbox, there's a message with the info that we need to attach our secure access account to security cloud control. So let's go ahead and do that. I don't already have a security cloud tenant, so I'm going to speed things up while I create a new one. In addition to creating a security sign on account, security cloud control provides a centralized control and.42:47AI driven insights across the Cisco security cloud. It gives us a central interface to manage and integrate all of our Cisco security products. Well, Cisco security sign on provides seamless authentication across those products.43:07Now that we've created our account and activated MFA with Duo, we can access security cloud control and create our new organization. It's important to note that the name selected here will also be used for the secure access account, so choose a name appropriately.43:21Since secure access is a global platform, the region deployment won't be used for this migration, but it's still a good idea to select an appropriate region since this account can be used to deploy other Cisco security products as well. If we look under product subscriptions, we see our invitation to attach secure access. The instance ID will be the.43:37Same as our existing umbrella organization ID.43:57And once we finish, we can see there's a card for secure access in our product list. With the product attached, we can claim the subscription using our claim code. As a reminder, this claim code will be emailed to you after the upgrade transaction is complete. During this process, it's important to select attach existing instance. Choosing create new.44:00Instance will create a new secure access account that will need to be deactivated from the subscriptions page before you can apply the license to the correct account.44:20Once we claim the subscription, it can take a few minutes to fully activate, so now is a good time to grab a cup of coffee. After claiming the subscription, we can apply it to the secure access product instance, and now we're all set to migrate our umbrella configuration.44:29Back on the umbrella dashboard, I'm going to refresh the page and a pop up will appear with the option to take us to the upgrade manager in addition to a new link being available in the menu bar. We have three steps we need to take care of before starting the upgrade. The 1st one is to configure Umbrella to use security sign on for authentication.44:45Since this is what security cloud control and Secure Access use, we need to have Umbrella use it as well. If you already use a SAML IDP for Umbrella dashboard authentication, you can configure security sign on to use that same IDP before completing this step.45:05For our account here, we're going to go ahead and choose configure SAML, and when the test configuration comes up, we can see that we're already logged into security cloud control and so we don't have to log in again. If we weren't already authenticated, we would just log in using our security cloud control credentials.45:21Back at the upgrade manager, the other two prerequisites are to upgrade some of our connectors and devices. Clicking start will walk you through that process, but since I know all of mine are already on the latest versions I'm gonna mark them as done and click next. Now we're ready to start the upgrade process that will migrate.45:46Get our configuration to secure access. Once clicking upgrade, it's important to stay on this page until the process has completed.46:06Closing the page means the process will have to start again from the beginning. With the upgrade complete, we can now open secure access and view our policy. Since secure access has a different policy structure than umbrella, there might be multiple rules per migrated policy, but the outcome of the policy engine will be the same.46:14Here we can see that our AD group has been migrated and is listed as the source for the rule. Digging in, we can see all of our users are visible in the secure access dashboard as well as our DNS forwarders, which is what Secure Access calls the virtual appliances.46:35The important thing to note is that we've only migrated our configuration. All of our traffic is still being routed through umbrella. We can verify this by opening activity search and selecting Cisco Secure Access as the point of enforcement. No traffic is found.46:53But if we select umbrella, we can see all of our traffic. To migrate traffic, we'll return to the upgrade manager and click start on the redirect traffic step. For now we'll redirect our HQ site to secure access. From here we can freely move individual identities to and from secure access so that we can.47:09To migrate and test at whatever pace we need to.47:29Now let's generate some traffic. We're back in activity search and in addition to the HQ site, I also migrated our branch one router and then generated some traffic from both. If we select secure access as our point of enforcement, we can see traffic using secure access.47:31In addition to our other identities that are still using umbrella.47:51Once we've migrated all our traffic to secure access and our content, everything is working as expected. The last step is to close the umbrella account. On the upgrade manager, we have the option to complete upgrade and close umbrella. This is a one way action. Make sure you're comfortable with the upgrade, click close umbrella, and that's it.47:58A start to finish look at upgrading from umbrella DNS to secure access.48:18Thank you so much, Chris. Really appreciate that demo and I'm just so thrilled to see how easy we've made it for all of you to move over to secure access DNS defense and take care, take, take advantage of the opportunity to get all this added capability.48:26And to get your SSE future ready. So before we wrap up the session here, we have just a bit more material that I'm gonna cover regarding next steps. I want to encourage you all to continue putting your questions in the Q and A window. I do see some questions coming in the chat.48:44Please put them in the Q and A window and we'll definitely get those answered for you here. Okay, so in terms of who's eligible to, to make the migration over to secure access DNS defense. So all of our umbrella DNS essentials and DNS advantage customers are.49:04Eligible to make the move over, as well as all of our customers on our legacy packages. So Umbrella Professional insights platform, you guys have been with us for a long, long time. You if you didn't make the move over to umbrella, DNS Essentials or advantage. This is a great time now to get onto our our.49:24Latest offer and make the move over to secure access DNS defense when you are ready. So this is an opt in, as I mentioned, NO one is gonna be required to migrate.49:44And we'll put a link for you guys in the chat for how you can get the process started. Next slide, please.49:58Okay, so if you are interested in learning more about secure access DNS defense, I hope that many of you are. We're gonna put this link for you guys in the chat and what this will do is connect you with the cloud security expert and help connect you with the account team, the appropriate folks on the account.50:16Account team and the partner to get the process started if that is the route you choose to go. Yeah, so that with that that wraps up the content that we have planned for our webinar today. I want to thank you all so much for, for joining us today. We will have the recording.50:37And the deck available for all of you. Please continue to put your questions in the chat and we will answer them for you. Have a wonderful day. Thanks for joining.50:56Thank you so much, Nikisa, Curtis, Steve, Phill, and Chris. We are at the point of receiving your additional questions at this time in the Q and A box. As a reminder, you can access the Q and A, the question and answer box by go.51:14Going to the three dots in your lower right hand corner of your Webex console. You'll see a menu pop up and you can select Q and A This is the place where we can best take advantage of your questions and answer them for you rather than the chat. So please take advantage of this time.51:34Time before we end the session at the top of the hour.51:54And if you don't have any questions, please feel free to stay on the line with us if there are other questions submitted by other folks that maybe of interest to you. And when you do exit today's webinar, you will receive a survey. We do request your feedback. This helps us to continually.51:58Approve and get feedback from you about future topics and what maybe of interest to you. So again, we'll take the next few minutes together to answer any final questions that you may have about today's session, and we do appreciate your time and participation.52:18Hey, this is Phil here. I guess we're gonna do a little bit of crowd work. Hey, somebody had asked how long does it take to upgrade the virtual appliances and is the umbrella module still required for roaming computers? That's an excellent question. You'll still use the umbrella module.53:55If you're moving over to secure access, we'll probably rename that module someday. But you're using the same mechanism of of acquisition, you're talking to the same DNS resolvers. You're, the big change is in the control plane. You'll be using.54:11A rules based model for, for policies instead of what we call our bundle based model. And if you're doing the in place upgrade, you don't have to touch any of your roaming devices if they're already running a supported version. For virtual appliances, same thing you can keep using them as they are if you're.54:27We're doing the in place upgrade, you don't have to make any changes to them at all. You'll be using the same virtual appliances between secure access, DNS and and umbrella. So hopefully that's really seamless for you and hopefully that answers your question, but if anybody has any more.54:47Any more detailed questions, feel free to feel free to let us know. Thanks for asking that.55:02Thank you, Phil. As mentioned, feel free to continue to submit your final questions.55:23Into the Q and A box. If we run out of time before the top of the hour in the next 4 min or so, we'll be sure to connect with you post webinar to make sure your question is addressed. And thank you for your partici participation and time today. We really value it and we hope that you found today's.55:29Session impactful and valuable. Again, we'll stay on the line for a few minutes longer and feel free to get those questions coming to us and we'll make sure we'll get them taken care of. Thank you.55:49Okay.57:02I'll answer this one verbally. There was a couple questions about do we have any, any expectation of eoling umbrella eventually? That's a great question. And the answer is NO, we have NO plans to end of life umbrella. And I'm happy to be saying this verbally because my manager's manager is here in the call as well.57:06So, yeah, keep on keeping on, we're we're we're, we're excited to offer secure access TNS for you, but it's not for everybody yet. So we're not gonna, we're not gonna burn the ships as they say.57:26Alright, we are now at the top of the hour, so this does conclude today's webinar. We are very grateful for your time with us today. We really value that and we hope that you found.59:15Today's sessioned helpful and again if there are any questions that you had submitted that were unaddressed, we apologize for running out of time, but we will be connecting with you afterwards. And again, when you exit today's session, you will automatically receive a survey from us. It's very short.59:25But we do request your feedback. It definitely helps us to continually improve and we again thank you for your time, participation, and we hope you have a great rest of your Wednesday and we hope to see you at a future session. Thank you.59:45