Operational Simplicity

Cisco Application Centric Infrastructure (ACI) and Cisco Secure Workload Integration

The Application Centric Infrastructure (ACI) and Secure Workload integration is a data center security and automation solution that does the following:

• Combines ACI’s network fabric provisioning with Secure Workload’s policy-driven segmentation.

• Provides AI-driven visibility and centralized policy management.

• Supports both agent-based and agentless enforcement for consistent and scalable workload provisioning.

This integration streamlines application workload provisioning with simplified segmentation and centralized monitoring, extending the value of the existing ACI infrastructure and linking with Cisco’s broader security ecosystem. For more information, see ACI Integration with Secure Workload.

SMTP Authentication in Secure Workload

Secure Workload now supports configuration of SMTP using Microsoft Modern Authentication (OAuth) in addition to the basic SMTP authentication. This enhancement offers improved security through industry-standard OAuth 2.0 when connecting to Microsoft SMTP servers. For more information, see SMTP Server Configuration for Cluster and Site Configuration.

Cisco Secure Workload Software Appliance

Cisco Secure Workload is now available as a software appliance that can be deployed in customer-managed data centers using VMware vSphere. The software appliance delivers the same functionality and features as the hardware appliance and supports 20,000 or 40,000 agent license scale options. Customers can deploy the software appliance on any vSphere cluster, leveraging existing virtualization infrastructure for installation and lifecycle management. This new deployment model provides greater flexibility for on-premises environments while maintaining full feature parity with the hardware appliance. For more information, see Secure Workload Software Appliance Deployment Guide.

Enhancing User Experience

Enhanced UI for Secure Workload Landing page

The application landing page has been redesigned to make it easier to locate and manage applications, especially in environments with a large number of applications.

The new page highlights key features, such as Policy Statistics and Policy Conditions while offering a cleaner and more intuitive interface.

Key updates:

• List View: Displays workspaces, scopes, last (ADM) run timestamps, and application status (draft, analyzed, or enforced). It also features the top two AI-suggested tasks per workspace for faster insights.

• Tree View: Provides a modern look with a horizontal layout and improved spacing of the scope tree.

• Additional Options: Users can easily switch between the new and earlier landing pages using the toggle button, allowing a seamless transition experience.

Dark Mode option

With the new Dark Mode option, users can toggle between the Dark and Light modes by using the User Preferences page that is available on the user login menu.

Platform Enhancements

Agents-only patch upgrade

You can now apply agents-only patches to clusters. These patches support updated agent package versions without affecting other cluster components or causing downtime to cluster services.

Key benefits:

• Apply agent update independent of complete cluster upgrades.

• No service interruption or cluster downtime.

• Simplified and faster patching process for agent updates.

Revoke Agent Packages

The ability to revoke agent packages in Cisco Secure Workload allows administrators to block the installation or upgrade of specific agent versions or packages having critical issues for certain operating systems. This revocation is precise to the affected package and reversible, enabling administrators to temporarily prevent deployment or automatic upgrades to problematic agent versions, as needed. This feature helps maintain system stability and security by controlling agent versions in the environment.

Key points:

• Administrators can revoke specific agent packages to prevent their installation or upgrade.

• The revocation is reversible, allowing flexibility to block or unblock agent versions.

• This capability is useful for managing critical issues related to particular agent versions or OS platforms.

This concise control over agent package deployment enhances operational security and stability in Secure Workload environments. For more information, see Revoke Agent Packages.

Service Protection for AIX and Linux Agents

The service protection feature is now supported in Secure Workload agents running on AIX and Linux. When enabled in the Agent Configuration Profile, this feature prevents system administrators from disabling or stopping the csw-agent service or uninstalling the tet-sensor package using standard methods. If necessary, the protection can be temporarily lifted from a workload by using a Time-based One Time Password (TOTP) provided by the Secure Workload administrator, allowing controlled management of agent services while maintaining security. For more information, see Agent Config Profile.

Cluster Certificate

The Secure Workload SaaS platform uses a new set of Cisco-provided certificates for its agent-facing services. This update enhances security by ensuring trusted TLS negotiations between agents and the SaaS cluster. The certificates are publicly trustable, which means all TLS connections initiated by agents to the Secure Workload SaaS cluster will be secured with certificates trusted by public certificate authorities. The new certificates will only validate Fully Qualified Domain Name (FQDN) endpoints under the root domain secureworkload.cisco.com. As a result of this change, the downloaded agent installer scripts will no longer function after the publicly trustable certificates feature is enabled, which requires updated scripts compatible with the new certificate infrastructure. This update enhances security by ensuring trusted TLS negotiations between agents and the SaaS cluster.

Binary and User-based Enforcement on Linux

Linux agents running on Version EL7.1+ and equivalent distributions now support binary and user-based policy enforcement.

This enhancement allows policies to match and enforce rules based on the specific binary oruser-initiated outgoing flows, in addition to existing network-based parameters.

Key benefits

• Granular control over outbound traffic by user or process.

• Enhanced security and visibility for Linux workloads.

• Seamless integration with existing policy models.

Supplement RPM

A new RPM package, tetration_os_supplement_k9, has been introduced to provide supplementary fixes for each major release. When deploying a 4.0 cluster or upgrading an existing cluster to 4.0, upload this RPM in the Setup page along with the other required RPMs.