Cisco SSE Evolution: Umbrella’s Path to Zero Trust Webinar

Alright, our session has begun, and with that I will hand it over to our presenter, Bill Maven. Thank you. Hi Rachel, thank you so much and thank you all the umbrella customers that have been able to join us live and those of you that are joining us via recording later, we have some import.00:24Important updates for you about getting maximum investment protection and maximum potential out of your umbrella SIG subscription. And, next slide please. We just want to detail for you.00:44Exactly what the product evolution at Cisco is looking like in the security service edge SSE arena. We have some key differentiators in the evolution of umbrella. That's our Cisco secure access solution and my colleague Prabhu will be detailing and demoing some of those differentiators.01:00They include things like a ZTNA and VPN as a service capability with a single client, which is differentiated in the marketplace. We have an AI access capability that includes AI guardrails, which is also a differentiator and then.01:20The competition, when you want digital experience monitoring, they require an extra license. Cisco does not. So it's another way that we make the SSE experience highly cost effective. When you're ready to simplify your upgrade, we are ready to help you.01:38And we want to stress that you don't have to upgrade to Cisco Secure Access, but when you do, the, the economics of it are very compelling. We we as Rachel have noted, really welcome your questions today. Please keep them coming.01:55As we go through the presentation so that we get to absolutely everyone's question. Next slide please. So just to level set, I think some of you have seen a slide like this before, but, those of you in this session are umbrella SIG customers, so obviously you're familiar with the SIG capability.02:13And secure access is that evolution that includes things like digital experience monitoring and.02:33Our universal ZTNA capability. Next slide. When it comes to what is actually different in the secure access packages relative to Umbrella SIG, we want we want you to be aware of how there is digital experience model.02:41The the full AI access capability and supply chain risk management capabilities that Prabhu will be detailing, as well on all versions, whether it's essentials or Advantage, you receive remote browser isolation support. And then with our secure private app.03:02Access capability, that's the ZTNA and VPN as a service portion. All that includes the same management construct, so you can create policies for SIA and SPA together. This is differentiated relative to some of our other SSE vendors in the marketplace. So, with that.03:21If you could kindly continue and Prabhu is gonna go over some of these key differentiators that you can get many of them without paying more than you're already paying with sick. Prabhu over to you.03:41So, before we get into the actual features functions I wanted to just start off with a little bit of baseline so that, you know, we kind of explain how we're differentiated when it comes to traditional ZTNA and what we're calling universal ZTNA. Now, if you think about it, the traditional ZTNA was really centered around.04:00Around largely work from home sort of model, right? So.04:20If you think about a user who is on a managed device, we were able to sort of wrap, you know, strict strict access controls, security controls around how they would go access private applications. Now, that's kind of another world we live in right now, right? So we have more of like folks who are back in the office, hybrid, for the most part.04:24So when we think about that sort of use case, we oftentimes find that that the access for those users is more of a direct sort of policy where you come into the office, you plug in, and you're sort of away, what this is really what this really causes is a little bit of disconnect in terms of like how you address policy for use.04:44Because it could be the same user, but depending on where whether they are at home or whether they're in the office, there's a little bit of disconnect in how we're sort of addressing their.05:04Access privileges. Now more fundamentally though, the the other piece here to kind of think about is that most most for most SSE vendors in this space, there is a notion of blind trust. And what I mean by blind trust between authentication and access is that, you know, we most folks will, you know, for the most part rely on something like.05:12Active Directory or Okta or something in order for us to be able to provide that decision. We kind of take that decision and just run with it. We're not actually doing any sort of continuous assessment on whether the person who they say they are, right?05:32So with that, with Cisco Universal DTNA, we're trying to really address a lot of these inconsistencies. So number one is being able to provide a single policy framework whether the user is in the office or remote and whether they're coming from an unmanaged device as well. So e.g., where you were basically making.05:45The iOS and Android devices a 1st class citizen in that zero trust experience. For folks who are coming in from, say, an unmanaged device or an unmanaged experience, we're able to extend very similar capabilities to like a enterprise browser like the Google enterprise browser as an example. Not just that, we're also extending.06:06Get to things. When I say things, think about things like cameras, IoT devices, printers, and those kind of things.06:25And on the application side, now we want to be able to obviously provide access to private applications, internet applications, traditional applications that could be going over VPN, but also simplify the policy and the enforcement. So with something like hybrid private access that we recently announced, we can prevent something like big cloud hairpinning.06:32So think about the use case where a user is in the office, we can enforce on and on the on the Cisco firewall as an example, right? So these are all innovations that we're sort of working on in order for you to be able to take advantage of.06:52The modern framework that we provide. Now, all of this is is available mostly because we have one client that provides multiple functions. So this is the Cisco secure client, but then it provides you multiple capabilities like ZTNA VPN as a service, and you can also extend it to device posture.07:05Internet access DNS, and so on and so forth, but not also digital experience monitoring and other capabilities. Now, now if you think about the user experience, right? The user experience is really what we're trying to optimize for, where it's like, hey step one, we want you to authenticate. This is where we can take advantage of the advanced capabilities from.07:25Duo for dual as an example, things like dual passport. Where the goal really is for us to be able to frustrate the attackers but provide the users a seamless access. But once that.07:45Once that user is authenticated, everything after that point is obviously plumbing, but also we're able to continuously assess in order for us to be able to tell like whether who you say you are, right? So this is the capability where we are able to do continuous identity and integration, so we're not really establishing that blind trust, which.07:57Is enabled by identity intelligence. Now, we want to be able to meet you where you are in this journey. Now, we understand that everyone's not gonna be able to do universal ZTNA type things on day one, but being able to enable that flexible journey towards is really what we're sort of trying to aim for. Now.08:16For the most part, when we talk to customers, we oftentimes find that people are most folks are gonna be at the traditional VPN, which is which is enabled by like the VPN concentrator which is available on premises. Now this is typically node level access that we're gonna be able to provide. But as you go through this journey, the 1st.08:36Oftentimes it's gonna be around VPN as a service, which allows you to list and shift that VPN concentrator and those capabilities to the cloud. Now this is this is very different than what a lot of other folks would offer in the in this, in this space. What I mean by that is typically what you will find is that folks will ask you to just run Vmiss in the cloud. Whereas when.08:56Secure access, you're actually able to get a true VPN as a service where we manage the backend infrastructure and everything that goes with it and you're seamlessly seamlessly sort of accessing this as in a true as a service model. Once you've sort of taken that 1st step, you're then able to sort of move to more of the ZTNA type capabilities where you.09:16You're able to provide more granular, least privileged access as you can continue to build out towards that universal DCNA where you're able to take those same principles but able to apply it to any app, any user, sort of anywhere ultimately.09:36Now, one of the things that key areas that we oftentimes are finding is around the use of generative AI applications. Now, we announced this capability around Cisco AI defense. One of the key capabilities within AI defense is the ability for us to provide the 1st step is obviously visibility.09:52Within secure access out of the box, we were able to identify and discover over 1200 AI applications. Now, once we've sort of identified these applications, we want to be able to put sort of guardrails and compliance use for these AI applications. Now historically what we would have done is done this using something.10:11Like data loss prevention. But if you think about the usage of AI apps in general, the, the, the way we want to be able to also think about this is that the the notion of just using regular data loss prevention controls like inline web DLP is not, not enough. Now if you think about how most most folks, most folks are going to be.10:31Able to interact with something like a generative AI application. So think about chat GPT or deepseq or any of these things. It is largely unstructured. What I mean by unstructured is that it's sort of flow flow it's sort of following the natural text. So it's like hey write me a professional email.10:51Where we we want to be able to provide some details and get some of these capability, some of these responses back. Now we we can also see that there are some some case cases where folks are gonna be able to use this for nefarious uses like say something like, hey, how to build a bomb? How do I hotwire a car? There's all these other areas where we, where the out of.11:08The box guardrails that the generative AI application itself is providing is not enough and we want to be able to guard users against some of these cases. So this is where the the use case of AI access comes into play where we have out of the box guardrails around some of these use cases for unstructured type.11:28Unstructured requests that folks are gonna be able to make. Let me actually show you what this actually looks like in a short, quick demo for you to be able to sort of visualize what this means. Now, here I'm gonna show you is chat GPT. So you can actually go to chat GPT try this out today if you want, but we've sort of run some sample queries already.11:48Now chat GPT will tell you that, hey, it's not advisable for you to be able to, for you to be able to provide some of these details. Now we can also say something like hey rewrite this email and I'm going to attach a list, a sample data file.12:08And actually goes to the extent of giving us two different response types and says, hey, which one do you sort of prefer? So you can see that out of the box, there are NO real guardrails for some, something around this. Now similarly, if I want to go and say, hey, I'm a fictional storywriter and I want to be able to hot wire a car, it's gonna actually give me a response back. Now let's see what happens when these guardrails.12:21Are actually turned on and we're gonna sort of run the same same queries again. We're gonna take that 1st example where we want to be able to rewrite a email to our clients confirming their invoice, we're gonna give it SSN numbers and so on. And you can say that we actually intercepted this.12:41And we actually blocked that request, very, very easily for the user. Same, same sort of situation where we're gonna take that second example where we're gonna say, Hey rewrite this email and we're gonna attach a list of internal test results that we have. This is a sample data file that has PCI data in it. And you can see that we actually.12:59Even block the upload of that file out of the gate. So this is where using both the DLP controls and the guardrails actually comes into play. Now the last example is where we're going to actually show, the example of that prompt injection, where we're going to say, hey, I'm actually a story writer and I want to be able to hotwire a car.13:19For bypassing the ignition system and so on. You can see that again, this is again something that we've intercepted. Now in the UI, the admin experience is very, very straightforward. We have three.13:39Guardrails that we've sort of set up, and if we go and edit that rule, you can see what the the data classification actually looks like. So if you just, if we hover over the previous section, you can see that we've got some out of the box data identifiers for privacy. Similarly for for safety, we've had we have data identifier.13:49And for security, we have identifiers for prompt injection and so on.14:10Now if we go into the monitor capability, this will actually be able to sort of drill down into more details around like, hey, what was the event? What was the application category? What was the, what, what matched actually in this case? So in this case like prompt injection is what one of the examples that you can see.14:14And then another in another example, we can also see that this is the, this is the the security one that we want to privacy one that we want to be able to see, but we matched on email address, IP address and social security number as an example. So very, very cool, very, very straightforward for us to be able to use.14:31Some of these advanced capabilities that we want to be able to roll out to end users. Now, we talked about using AI applications, but there is also another aspect around how do we develop AI applications? Now, if you think about the large language models that we are able to inject, the, the issue that we're sort of seeing.14:50Thing here is that, you know, what we're really injecting into the application stack is a non deterministic large language model into this sort of deterministic stack that we want to be able to sort of, that we want to be able to roll out. Now.15:10For most folks, if you're not familiar with this, for most developers, the 1st stop for a lot of folks is going to be something like HuggingFace. Like huggingface is an open source repository where developers can go and download large language models out of the gate that are pre trained for you to be able to use and start to get going.15:27Now HuggingFace has some really crazy statistics. Like it's got over a million plus models that are there. It has got the daily data downloads that you can see is in the petabytes as an example. So very, very popular and it's usually the 1st stop for.15:47For for most folks to be able to get started with. Now, a key sort of area that we want to be able to also think about is for most folks when they start, the blind spot is really where a developer is gonna be firstly downloading this model and begin that rapid prototyping process. Now that is the window of risk that we're talking.16:03About here. So when a, a developer actually downloads this model and begins that rapid prototyping, there maybe some risky models that we they're actually working with. Now, these could have things like intellectual property as an example. This could also have malicious code that's actually built into it or it could have origin compliance.16:23There could be multiple risks that we're starting to look at and by the time this is actually committed and this is actually being pushed into say the software commit process, this is the window that we're trying to protect the developers against. Now this is where we actually announced something at RSA just a couple of weeks ago around being able to provide.16:43A sort of pre use enforcement engine within secure access. This is this is under the umbrella product of AI supply chain risk management, but the three things we wanna be able to sort of protect against is number one being able to protect against malicious code. Number two is around protecting for intellectual property compliance and then.17:03The origin compliance, where did the large language model actually originate? So to give you a little bit of an idea of how this sort of looks.17:23Now we have an example here of a user who has gone through hugging phase. Now they they hear about deepseq being all the age, so they want to start playing around with deepseq. So they go into deep into hugging phase to download deepseq. If you look at the model card in the last month, it's been downloaded over a million times, like 1.3 million times.17:31Now they go into the files and they want to download the, the safe tensor file for it. So when they go into it, you see that we actually are intercepting it and say that, hey, this model.17:51Is blocked because it's being sourced from a prohibited geo. We are actually also sending them off to using a private repository in this case. Now this is a, this is another example where we have a malicious file that's actually stored within this repository. This is pre scanned and we're able to detect that this got malicious code execution.18:01We're actually again sending them to the private repository. Now within secure access now switching to the admin view, we've got three risk categories that I outlined before. Now on day one, it's going to show you obviously all is allowed, but you are able to sort of go in there and granularly say allow or block for any of those models. Now, if you want to dig dig in bit.18:21Deeper into that deep seek R one model that we looked at earlier, we again can go into the monitor capability, go into full details and it'll give you a full list of all the.18:41Relevant details and breadcrumbs that you want around this capability as well. Now, the next piece is around digital experience monitoring. Now, it is very, very critical obviously to be able to troubleshoot very, very quickly and provide that visibility to the operator on where that issue actually resides. Now.18:52Now this could be on, this could be on the end user machine. This could be on the Wi Fi that they're on, the broadband or the network that they're actually, that they're on. And being able to also provide historical performance and recommendations.19:12So, if you, if you don't go ahead and I want to show you a quick demonstration of what this actually, actually looks like. So the 1st step here is that of being able to look at the number of endpoints. So in this case, we're seeing.19:31Three endpoints that are available, one at risk, one healthy, and we can sort of go into and figure out which ones are at risk, which ones are healthy, and so on and so forth. You can using the geographical engine and the, and the way for us to be able to sort of categorize these as well. We're gonna show you an example of what.19:50It looks like on that user, but we also have a common set of SaaS applications that we're actually already monitoring performance for. We also go into the user now. Now you when you go into the user specifically, you can see that they're actually, you can see very specific things like, you know, what are the firewall rules that are associated with them? What are.20:10To be blocked and allowed events and so on and so forth. But you can also see the end to end performance of how, what is their device path to secure access as an example. You can also see details like, you know, whether they're running disk encryption as an example, whether, you know, what, what is the CPU usage and so on and so forth. So there's a lot of critical details that.20:30We're able to sort of identify very, very easily. Now, we're gonna be able to also do a segment visualization. So in this case, we want to be able to see what is their path all the way to Microsoft Teams. So in this case, we have the agent running on the device where we're gonna be able to see whether that's pegged at a hundred percent. But even then, we can also see.20:50What the hops are through that segment visualization, what is the path all the way to Microsoft Teams? So this, this allows us to tell us where the problem resides, whether it's on the agent, whether it's the gateway or is it the application itself.21:10Now we can quickly also, through the full thousand eyes view, where we can also dig into things like, hey, what is the underlying networks? No networks that we potentially may not own in this case, right? And what is the path that it's taking in order for us to sort of get there? Very, very cool, very, very differentiated in what we're able to sort of provide.21:24Right.21:44Alright, with that, I will pass it back to you Bill. Thanks Prabu. So one thing I I just wanna, help to emphasize is to to reiterate a couple of things that you noted. 1st 1st of all.21:45All that in in this context of upgrading your subscription to cloud delivered security from Cisco from Umbrella SIG.22:05To secure access, the the the investment protection starts with the fact that when you're upgrading to our secure internet access package within secure access, you're not paying more.22:14Then you already have with, with your SIG your present SIG subscription. And Prabhu, some of the some of the things that you noted like are are full AI access capability. That feature that's a feature set of secure access as you can see in the.22:31Dashboard one is not paying more for the AI access capability or for the supply chain risk management capability for AI models that are malicious. So that, that's something I just wanted to, to reiterate. Also.22:51When, when Prabhu you were noting the VPN as a service and ZTNA capability, and you, and you, you also noted how our universal ZTNA capability can work with duo. One thing that I want to point out to everybody on the.23:10Paul is if you're using multi factor authentication.23:30From Microsoft or from Okta or from whomever else, the Cisco identity intelligence capability that Prabhu noted, it's available through Duo. You don't have to take the MFA multi factor authentication from Duo to get this identity intelligence protection.23:35This is really important because every threat intelligence organization, including Cisco Talos, our internal threat intelligence organization is showing that upwards of 80 % of attacks adversaries are walking through the front door with a identity based approach to, to mounting their attacks. So.23:54When you look at other major players in the SSE space, you'll see that only Cisco has this universal ZTNA approach, which is identity centric. This is, this is a real differentiator for you. And as it relates to, to investment protection, above and beyond when you.24:15Go from SIG to secure internet internet access not having to pay more. There's actually actually actually more that makes this simple and compelling.24:35Next, next slide please. So, we wanted we wanted you to be aware that there is a upgrade tool which is gonna be available in the SIG dashboard, and we're anticipating this later this year and that gets activated at your request and only at your request. You don't have.24:44You have to do this, but at your request by your Cisco partner. This month we've started rolling a similar capability out.25:04To umbrella DNS customers, and so if you have a very large or complicated policy set and you want to, make, make that transition even easier, you're gonna really enjoy this upgrade manager. One thing though is while it's while it's still.25:12All available.25:32You if you're ready to upgrade now, the elevate program is definitely something that you should be aware of, and next slide please. The elevate program is is a capability where whatever your existing umbrella subscription term length is, whether you have 90 days.25:34Days or a hundred and 80 days or two years left in your umbrella SIG subscription. You'll get investment credit.25:53For the entire unused portion of that subscription, I should say up to that entire balance that you have on your unused portion of your umbrella subscription that's applied towards secure access. So not only at renewal time.26:02From SIG to SIA secure Internet Access.26:22The, the cost is, is not greater when, when you upgrade. If you want to upgrade now, you get that investment protection. And this is a partner led offer. The reason that we say up to is that we have encouraged all of our partners.26:29To provide customers with 100 % investment credit, ok? It is at the partner discretion, so we can't guarantee that that will be 100 % but we certainly can advocate for that with you. And, the other very important part about this is.26:47That you when you when you do this.27:07You get an extra year of umbrella on top of, of, of your, your move to secure access and this enables you on your own schedule to upgrade to secure access and do this in a, in a very, you know.27:10Business friendly, and operational friendly manner. So, please do talk with your Cisco partner and account manager about the elevator offer and to get the ball rolling on that. Next slide please. Actually, one, one thing before.27:30You know, we'll just couple of couple other items go ahead Prabhu on the slide. Thanks so much. With regard to eligibility, all SIG customers regardless of where you are in the contract cycle, you are eligible for the elevate program and you can see.27:50Here, not exactly fine print, but some key details that the term of the new subscription cannot be less than the existing remaining term that you're getting credit for. And, as I noted a minute ago, you get that additional year from Cisco.28:10At a $0 entitlement for an extra year of umbrella on top of your secure access subscription. Next slide, please.28:30So in terms of that next step, and what we would recommend that you do actually today is just click on this link and set a time to talk with the Cisco security specialist. They'll help coordinate things with your, your security.28:43Account executive as well as your partner, so that you, you can have a seamless transition and upgrade to Cisco secure access and we have we blocked out an hour for for the webinar here.29:02And please keep your questions coming. We're gonna answer as many of your questions as we can today. If we, if your questions are technical or they are related to the commercial terms of the Elevate program, please let us know and we'll be very happy to.29:21To address those questions. And, with that Rachel, let me hand it back over to you.29:41Thank you so much Bill and Pravu. Great information shared. I also had posted that URL in the chat for easy access. This will be emailed out after today's session, so that link, if you don't see it in chat at the moment or forget to bookmark it, it will be sent to you after.29:51For today's session. We do.30:11Encourage questions at this time. This covers all of the content that Prabhu and Bill covered in the slides, so please take advantage of our remaining time together. Please access the Q and A box, the question and answer box, so we can keep that separate from chat.30:14And our technical team who is on the line as panelists will be able to answer your questions that come in through Q and A And as a reminder.30:34There is a part of your Webex console with three dots and you can click on those three dots in the lower right hand corner. You'll see a pop up menu for Q and A, and that's where you can submit your questions that are top of mind.30:46So we'll stay on the line. I know some, questions may have snuck into chat, but please redirect them to Q and A that helps us keep it organized and making sure that everything is addressed appropriately. At this time, we, again, will stay on the line for all of those questions that you may.31:02Have, and if you don't have any questions, you're more than welcome to exit the session. You'll receive a survey afterwards. We do welcome and desire your feedback on today's session. It helps us to continually improve. And additionally, if you don't have questions yet, you.31:22You're more than welcome to stay on and see if there are other questions that maybe of interest to you that others may have placed into Q and A So feel free to stay on with us a little bit longer and we'll be sure to get your questions answered.31:42Thank you so, so much.31:58Thanks again for the questions that are coming in through the Q and A box. We greatly appreciate the the questions that are coming in and we encourage you to please continue to submit any top of mind questions on today's content. As a reminder, please redirect questions to.35:49The Q and A function rather than chat so we can appropriately address them in that venue. Again, if you don't have questions or you have had your questions addressed, you're more than welcome to exit today's session. You will receive a survey come, well, it'll come to you complete.36:09Completely after you exit the session, so please take a moment to answer our short survey.36:29This helps us continue to improve and we do appreciate your time and your feedback. Again, you're more than welcome to stay on a few moments longer as we wrap up Q and A and make sure that all of your questions are addressed. Thank you.36:35