Cisco Secure Workload (Tetration) Platform Data Sheet

Cisco Secure Workload (formerly Tetration) seamlessly delivers a zero-trust approach to securing your application workloads across any cloud and on-premises data center environments by reducing the attack surface, preventing lateral movement, identifying workload behavior anomalies, and remediating threats quickly.

Product overview

Traditionally in IT, we’ve had an infrastructure-centric view of the universe. Our most valuable data was contained in the data center, so our job was to let good traffic in and keep bad actors out. And our tool of choice was the firewall.

In today’s organizations, the center of gravity has shifted decidedly in favor of applications. Applications are critical to how you engage with customers, run your operations, and get paid. But the constant proliferation and dynamic nature of these applications have led to an unprecedented security challenge for IT professionals.

Applications are distributed. They’re deployed both on-premises and in the cloud, or across multiple clouds, and critical workloads are no longer tidily kept in the data center where they can be protected by a perimeter firewall. In some ways, there is no more perimeter. To respond to this app-centric world, you need a security solution that can bring security closer to the applications using a “new firewall” that surrounds each and every workload, allowing you to protect what matters most to you—your applications and your data.

With Cisco Secure Workload, you can secure your applications by creating firewalls at the workload level across your entire infrastructure consistently, whether these are deployed on bare-metal servers, virtual machines, or containers.

Workload protection use cases

Secure Workload helps to deliver zero-trust application security, reduce risk, and maintain compliance with:

●      Automatically generated microsegmentation policies through comprehensive analysis of application communication patterns and dependencies

●      Dynamic attribute-based policy definition with a hierarchical policy model to deliver comprehensive controls across multiple user groups with role-based access control

●      Consistent policy enforcement at scale through distributed control of native host firewalls and infrastructure, including ADCs (application delivery controllers) and firewalls

●      Near real-time compliance monitoring of all communications to identify and alert against policy violation or potential compromise

●      Workload behavior baselining and proactive anomaly detection

●      Common vulnerability detection with dynamic mitigation and threat-based quarantine

Multidimensional workload protection approach using Cisco Secure Workload

By using this multidimensional workload protection approach (Figure 1), Cisco Secure Workload significantly reduces the attack surface, minimizes lateral movement in case of security incidents, and quickly identifies anomalous behaviors within the data center.

To learn more about workload protection capabilities, refer to the Cisco Secure Workload Platform for Workload Protection data sheet: www.cisco.com/c/en/us/products/collateral/data-center-analytics/Secure Workload-analytics/datasheet-c78-740328.html.

Features and benefits

Table 1 lists the main features and benefits of the Cisco Secure Workload platform.

Table 1.        Cisco Secure Workload platform primary features and benefits

Deployment models and scale

Cisco Secure Workload offers both Software-as-a-Service (SaaS) and on-premises options allowing customers to choose the model that meets their business needs.

For on-premises deployments, they can choose a hardware-based appliance model (small or large form factors) depending on the number of workloads in your environment.

In order to support very large enterprise deployments that could be split across multiple data centers and regions, Secure Workload supports horizontal scaling through federation. Secure Workload also offers Disaster Recovery (DR) capabilities that allow customers to continuously back up Secure Workload data to another data center and be able to switch to the DR site in case of a disaster in minutes.

Cisco Secure Workload SaaS option

With the Cisco Secure Workload SaaS option, customers can get the benefits of workload protection capabilities without having to deploy the platform on-premises. With this option, Cisco Secure Workload software runs in the cloud, managed and operated by Cisco. The customer is responsible for purchasing the required software subscription licenses and deploying software agents on workloads.

This deployment option Is well suited for SaaS-only or SaaS-first customers, because it offers scale flexibility. You can start small and grow as your demand grows. Other benefits of the SaaS option include:

●      Significant reduction in TCO (Total Cost of Ownership)

●      Faster time to value

Note:      This consumption option does not support ingesting telemetry from hardware sensors. It also does not support custom user applications on the platform.

Cisco Secure Workload-M (small form factor) option

The Cisco Secure Workload-M small form factor deployment option consists of 6 servers and 2 Cisco Nexus^® 9300 platform switches. It is suitable for data centers that have fewer than 5000 workloads (virtual machine or bare metal or container hosts).

Table 2 shows the verified and supported scale. Table 3 shows the power and cooling requirements for the Cisco Secure Workload-M platform.

Table 2.        Cisco Secure Workload-M platform scale

Table 3.        Power and cooling specifications for Cisco Secure Workload-M

Cisco Secure Workload (large form factor) platform option

This deployment option consists of 36 servers and 3 Cisco Nexus 9300 platform switches. It is suitable for data centers hosting more than 5000 workloads (virtual machine or bare metal or container host).

Table 4 shows the verified and supported scale. Table 5 shows the power and the cooling requirements for the Cisco Secure Workload platform.

Table 4.        Cisco Secure Workload platform scale

Table 5.        Power and cooling specifications for large form factor

Software licensing

Cisco Secure Workload platform software is licensed based on the number of workload equivalents depending on the sensor type being used. Telemetry data can be collected using software sensors, supported by other supported sensors or collectors, in any combination. Policy enforcement is enabled through software sensors with enforcement capability with infrastructure enforcement through ADC or via streamed Kafka policy. Workload is defined as a virtual machine, bare-metal server, or container host.

There are two primary license types for Secure Workload (including SaaS and On-Premises deployment options):

●      Secure Workload protection license: This license provides workload protection capabilities, including telemetry data collection, application insight, forensics, software vulnerability detections, policy recommendation, policy simulation, policy enforcement, and compliance tracking functions

●      Secure Workload endpoint license: This license provides the comprehensive telemetry data collection from a Cisco AnyConnect client installed in the endpoints (laptops, desktops, smartphones, etc.), using an NVM module, software agents on VDI, or any endpoint device managed through Cisco ISE. This provides insights into user, device, group, process ID, process hierarchy, and OS as well as the domain names accessed from the endpoint. Customers must purchase the endpoint visibility license if they want to use the platform’s capability to collect, analyze, and define policies and provide visibility into endpoint device activities. This license can be independent of the workload protection licenses. This does not include any other licenses required to enable AnyConnect NVM, VDI, or Cisco ISE (those licenses need to be purchased separately)

If a customer has multiple Cisco Secure Workload clusters, software licenses can be pooled across those clusters.

If a customer has Cisco Secure Workload SaaS licenses, they cannot be ported over to an on-premises license option or vice versa.

Licensing terms

Secure Workload SaaS deployment:

The SaaS subscription is governed by the Secure Workload SaaS Offer Description (https://www.cisco.com/c/dam/en_us/about/doing_business/legal/OfferDescriptions/cisco_tetration_saas_offer_description.pdf) and the Cisco Universal Cloud Agreement, located at www.cisco.com/go/uca (or similar terms existing between you and Cisco) (the “Agreement”), and any software that you install is licensed under the Cisco End User License Agreement, located at www.cisco.com/go/eula (the “EULA”).

On-premises deployment option:

Secure Workload on-premises subscriptions are governed by the Cisco EULA (see www.cisco.com/go/eula). In addition, Cisco Secure Workload software is subject to the terms of the Cisco Supplemental End User License Agreement (SEULA; see https://www.cisco.com/c/dam/en_us/about/doing_business/legal/docs/cisco-tetration.pdf).

Platform support and compatibility

Tables 6–8 provide operating system support and compatibility information for the Cisco Secure Workload platform.

Table 6.        Supported operating systems for microsegmentation (deep visibility and enforcement) use case:

Table 7.        Supported operating systems for visibility only (no enforcement):

Table 8.        Supported operating systems for universal software sensors

Container microsegmentation requires integration with the orchestration platform. Table 9 below shows the supported orchestrators and corresponding version information. The supported container runtime is Docker.

Table 9.        Supported container orchestrator versions

Ordering information

Table 10 provides hardware and software bundle part numbers for the Cisco Secure Workload option.

Table 10.     Hardware and subscription software bundle for Cisco Secure Workload option

Table 11 provides hardware and software bundle part numbers for the Cisco Secure Workload-M (8RU) option.

Table 11.     Hardware and subscription software bundle for Cisco Secure Workload-M option

Table 12 provides the software bundle part number for the Cisco Secure Workload software subscription license.

Table 12.     Bundle for Cisco Secure Workload software subscription only option

Table 13 provides subscription software bundle part numbers used for the Cisco Secure Workload platform for on-premises deployment options.

Table 13.     Subscription software license for Cisco Secure Workload on-premises deployment options

 

 

Also note the following additional information about the software subscription license part numbers:

●      You can select a 1-year, 3-year, or 5-year subscription term.

●      The subscription price includes software support.

●      The subscription tier is selected automatically based on the quantity entered.

●      You can select the annual billing option or prepay for the entire term.

●      You can add more workload instance licenses through subscription modification.

●      This software subscription license can be used with both forms of Cisco Secure Workload hardware clusters.

Table 14 provides subscription software bundle part numbers used for the Cisco Secure Workload SaaS deployment option.

Table 14.     Software bundle for Cisco Secure Workload SaaS option

Also note the following additional information about the software subscription license part number:

●      You can select a 1-year, 3-year or 5-year subscription term.

●      The subscription price includes software support.

●      You can select the annual billing, a monthly or quarterly option, or prepay for the entire term.

●      You can add more software sensor instance licenses.

●      This software subscription license can be used only with a Cisco Secure Workload SaaS deployment.

Your license for Cisco Secure Workload Endpoint software does not include AnyConnect or AnyConnect NVM licenses. You are responsible for acquiring those licenses separately.

 

Put Cisco expertise to work to accelerate adoption

Cisco provides professional and support services from Advisory, Implementation and Optimization to ongoing Solution Support, to help organizations get the most value from the Cisco Secure Workload platform. Cisco Services experts help integrate the platform into your production data center environment, define use cases relevant to your business objectives, tune machine learning, and validate policies and compliance to improve application and operation performance. Cisco Solution Support for Cisco Secure Workload provides hardware, software, and solution-level support. We offer a selection of custom and fixed-price, fixed-scope services for Cisco Secure Workload that help you experience faster time to value, comprehensive adoption in your environment, optimized policies and application performance, and solution wide support.

Cisco environmental sustainability

Information about Cisco’s environmental sustainability policies and initiatives for our products, solutions, operations, and extended operations or supply chain is provided in the “Environment Sustainability” section of Cisco’s Corporate Social Responsibility (CSR) Report.

Reference links to information about key environmental sustainability topics (mentioned in the “Environment Sustainability” section of the CSR Report) are provided in the following table:

Cisco makes the packaging data available for informational purposes only. It may not reflect the most current legal developments, and Cisco does not represent, warrant, or guarantee that it is complete, accurate, or up to date. This information is subject to change without notice.

Cisco Capital

Flexible Payment Solutions to Help You Achieve Your Objectives

Cisco Capital makes it easier to get the right technology to achieve your objectives, enable business transformation and help you stay competitive. We can help you reduce the total cost of ownership, conserve capital, and accelerate growth. In more than 100 countries, our flexible payment solutions can help you acquire hardware, software, services and complementary third-party equipment in easy, predictable payments. Learn more.

For more information

For more information about the Cisco Secure Workload platform, please visit https://www.cisco.com/go/Secureworkload or contact your local Cisco account representative.

Document history