Cisco Umbrella

What is Cisco Umbrella?

Built-in application in the foundation of the internet

Cisco Umbrella uses Internet infrastructure to block malicious targets before a connection is established. By providing security from the cloud, you not only save money, but also provide more effective security.

DNS and IP layer enforcement

Umbrella uses DNS to stop threats on all ports and protocols - even on direct connections to IP. Stop malware before it reaches your endpoints or network.

Smart Proxy

• Instead of proxying all web traffic, Umbrella forwards requests to risky domains for deeper inspection of URLs and files. Protect effectively without delay or performance impact.
• Command and control callback lock
• Even if devices are infected in other ways, Umbrella prevents connections to attacker's servers. Stop data exfiltration and ransomware encryption execution.

Packages

• Professional
• Block ransomware, malware, phishing, and C2 callbacks
• Protect users wherever they are, inside and outside the corporate network
• Hack malicious domain requests and IP responses at the DNS layer, on any port or protocol
• Perform real-time enterprise-to-business activity surveys and scheduled reports
• Apply acceptable usage policies using more than 80 content categories
• Create custom block/permission lists.

Insights

• Best for midsize businesses
• Includes everything from the Professional plus package:
• Blocking direct IP connections in the IP layer
• Identification of targeted attacks comparing local activity versus global activity
• Identifying risks from cloud, IT shadow and IoT usage, reporting more than 1,800 services
• Imposition and visibility by internal network or user / Group of AD
• Risky proxy domains for URL and file inspection using Cisco's antivirus engines and advanced malware protection (AMP)
• Log maintenance with Amazon Web Services integration using the Customer-Managed or Cisco-Managed S3 bucket

Platform

Best for advanced security teams

Includes everything from the Insights package plus:

Enforcement API

• Deployment of pre-built integrations that work with 10 or more security providers - including Splunk, FireEye, and Anomali
• Leverage custom API for integration with other systems, including:
• Safety devices
• Threat intelligence platforms or feeds
• Custom built-in tools

Investigate the console

• Count on what Umbrella is blocking and why
• See attacks when they form
• Prioritization of incident investigations

additional:

Investigate the API

Use the API to enrich data on your threat intelligence platform or SIEM, so you can quickly view high-impact security incidents and add more context to incident responders.

Gold or Platinum Support

All packages include online and email support - for peace of mind, plus expanded assistance with gold and platinum support packages.

Console Multi-org

Centrally manage configuration and security reports in a "single dashboard." Get shared control and unified visibility for tens to hundreds of separate organizations.

All packages provide:

Easy deployment

Cloud-provided security deployed in minutes - no installation hardware or software for maintenance

Fast and reliable cloud infrastructure

Fast and reliable network that resolves 100B + DAILY DNS requests for more than 85 million users without additional latency

Predictive Intelligence

Umbrella's live threat intelligence discovers and blocks malicious domains, IPs, and URLs before they're even used in attacks

Built on the foundation of the Internet.

The domain name system (DNS) is a key component of the Internet - mapping names to IP addresses. When you click a link or type a URL, a DNS request starts the process of connecting any device to the Internet. For the cloud security platform, DNS is used only as a way to make connecting to the cloud not only simple and fast, but also secure.

A little bit about the Cisco Umbrella global network.

Cisco umbrela performs the processing of billions of DNS requests from millions of users every day. Not only do they have data centers around the world, but most importantly, we analyze leading Internet service providers (ISPs) and content distribution networks (CDNs) to reduce routes between all networks in the world and Cisco Umbrella datacenters.

Your internet access even faster.

Scaled to support tens of thousands of concurrent enterprises and blocking millions of concurrent threats. Applying over 7 million unique malicious destinations at any one time. No device can be scaled to provide this same effectiveness.

• 125 billion daily internet requests
• 90 million users
• 26 datacenters worldwide
• More than 500 partnerships with leading ISPs and CDNs
• 7M + malicious destinations applied simultaneously

The fastest and most reliable platform.

When you connect to a cloud security platform, performance is critical. To ensure reliability, Cisco Umbrella uses Anycast routing - each data center advertises the same IP address so that requests are sent transparently to the fastest available, with automated failover. With Umbrella, you'll never experience downtime for maintenance and won't need static routes to a primary and backup datacenter.

Peering by speed.

Umbrella will not add latency compared to your current provider. In fact, many customers see an increase in internet speed. Peering partnerships with ISPs and CDNs provide shortcuts across all networks. And Umbrella stores responses to the daily requests of 80 million users and, for most safe destinations, responds immediately.

Application without latency or delay.

To get started, Umbrella determines which client the internet request belongs to and which policy will be applied. It is then determined whether the target domain request and IP response are (A) malicious, unwanted, or blacklisted; (B) secure or on the whitelist; or (C) risky, which means it hosts malicious and secure content.

For type A targets, the connection to a lock page is routed. For B, the connection is routed as normal. And for C, the same process is carried out only now through cloud-based proxy for deeper inspection. All requests are logged globally and immediately visible for your security teams to take action.

World's first smart proxy.

Traditionally, blocking web content at the URL level requires proxy intermediation of all connections, which increases complexity and negatively affects performance. With Umbrella, secure connections are allowed and malicious requests are blocked in the DNS layer. Only requests for risky domains, which contain malicious and legitimate content, are routed for deeper inspection of URLs and files. With Umbrella's smart proxy, users don't have slow or broken Internet access.

Open platform for integration.

One fear that IT staff has with the cloud is the loss of personalization and control. Umbrella is an open platform that integrates with its internal tools and third-party solutions. Using the API, you send local intelligence to Umbrella and apply it globally in minutes. In addition, you query threat intelligence using the Cisco Umbrella Investigate API, enriching security event data on your SIEM or other systems.

System Requirements

Windows 10 with .NET 4.5

Windows 8 (includes 8.1) (64-bit) with .NET 4.5

Windows 7 (64-bit / 32-bit) with .NET 3.5.

Mac OS X 10.9 or newer.