Manage Endpoint Security

Secure Access is a converged cloud security solution that enables fast, reliable, and secure private network connections to your applications. End users are assured of a secure, transparent user experience, anywhere they work — office, home, or on the road. User devices can read, write, and update private resources by setting up virtual private networks (VPNs) or zero trust network access (ZTNA) connections to Secure Access through IPsec network tunnels.

Endpoint posture assessment involves orchestrating and performing data collection and evaluating the posture of a given endpoint.

Typically, endpoint posture information is gathered and then published to appropriate data repositories to make collected information available for further analysis supporting organizational security processes.

Endpoint posture assessment typically includes:

• Collecting the attributes of a given endpoint;
• Making the attributes available for evaluation and action; and
• Verifying that the endpoint's posture is in compliance with enterprise standards and policy.

Cisco Secure Access can evaluate certain attributes and conditions on end-user devices. This guide describes the endpoint attributes evaluated by Secure Access.

This option checks for the existence of any required operating systems that are needed on the endpoint device.

The operating system hosts and manages your data, applications, and connected devices. Inadequate protections for the operating system could also affect the performance of all of these components and ultimately affect productivity of your users and the organization.

The following sections describe the supported operating systems and package dependencies for Secure Access posture profiles.

This option checks for the existence of a firewall on the endpoint device.

• Windows
  • Require the platform-native firewall to be running on the endpoint device.
• Mac OS X
  • Require the platform-native firewall to be running on the endpoint device.

This option checks for the existence of an endpoint security agent required to be running on the endpoint device. The Endpoint Security Agent is a modern solution that delivers comprehensive, multilayered protection to safeguard your device against diverse threats. Its unified architecture allows you to deploy multiple solutions through a single agent for streamlined management and enhanced security.

This option checks whether a system password is required on the endpoint device.

This option checks for the existence of disk encryption running on the endpoint device.

Disk encryption ensures that files are always stored on disk in an encrypted form. The files become available to the operating system and applications in readable form while the system is running and unlocked by a trusted user. An unauthorized user inspecting the contents of the disk directly finds garbled random-looking data instead of the actual files.

With user data encryption enabled, the /home directory in the file system is encrypted and user data is available when the system is running. The user /home partition is mounted on a separate disk partition and block level encryption is enabled for that disk.

Note

By default, the disk encryption check only detects for the presence of the disk encryption software but does not require that particular disk drives are encrypted. On a Windows platform, it is possible to require that the default C:\ drive is encrypted. For more information, see Welcome to Cisco Secure Access.

This option checks for the existence of a required web browser on the endpoint device.

This option checks for the existence of a registry key or the value of the registry key on the endpoint device. The posture check for this partcular field only requires the path to the directory containing the registry and should not include the registry name.

This option enforces a check to verify if the device has joined a Windows domain. You have the option to also specific a specific SID to ensure a device is joined to a specific Domain.

At this time Secure Access supports both Azure AD and Microsoft Entra. Events generated from successful or failed domain joins and snapshots of detailed posture checks are avilable in the Activity Search Report. By using the Azure AD you can reduce the risk of devices joined to unapproved domains. Add and managed your domains within your posture profile; see step 9 of Add a Client-Based Zero Trust Access Posture Profile.

This option checks for the existence of a file, the date of a file, and the versions of a file on the endpoint device.

Note

File conditions are checked against case-sensitive checksum protocols.

This option checks if an application or process is running or not running on the endpoint device.

Note

You must include the full name of a process along with its extension to ensure the proper functionality of the Process Conditions option. For example, instead of 'Firefox,' use 'Firefox.exe.'

Secure Access supports certificate and Security Assertion Markup Language (SAML) authentication for remote access VPN connection profiles. This option checks if any required server certificates are present and valid on the endpoint device.