• Skip to primary navigation
  • Skip to main content
  • Skip to footer

Cisco Umbrella

Enterprise network security

  • Free Trial
  • Contact us
  • Blog
  • Login
    • Umbrella Login
    • Cloudlock Login
  • Products
    • Product
      • Cisco Umbrella Cloud Security Service
      • Cisco Umbrella Investigate
      • Product Packages
      • Support Packages
    • Functionality
      • DNS-Layer Security
      • Secure Web Gateway
      • Cloud Access Security Broker (CASB)
      • Interactive Intelligence
      • Cloud-Delivered Firewall
    •  
    • Webinar signup
  • Solutions
    • By Need
      • Protect Mobile Users
      • Fast Incident Response
      • Web Content Filtering
      • Shadow IT Discovery & App Blocking
      • Unified Threat Enforcement
      • Reduce Security Infections
      • Secure Direct Internet Access
      • Securing Remote and Roaming Users
    • By Network
      • Protect Guest Wi-Fi
      • SD-WAN Security
      • Off-Network Endpoint Security
    • By Industry
      • Higher Education Security
      • K-12 Schools Security
      • Healthcare, Retail and Hospitality Security
      • Enterprise Cloud Security
      • Small Business Cybersecurity
      • Our Customers
      • Customer Stories
    • Ransomware Defense for Dummies book
  • Why Us
    • Fast Reliable Cloud
      • Global Cloud Architecture
      • Cloud Network Status
      • Cloud Network Activity
      • Recursive DNS Services
      • Top Reasons to Trial
      • Getting Started
    • Unmatched Intelligence
      • Cyber Attack Prevention
      • Interactive Intelligence
    • Extensive Integrations
      • IT Security Integrations
      • Hardware Integrations
      • Meraki Integration
      • Cisco SD-WAN
    • Navigation-dropdown-promo-free-trial_102820
  • Resources
    • Content Library
      • Top Resources
      • Cybersecurity Webinars
      • Events
      • Analyst Reports
      • Case Studies
      • Customer Videos
      • Datasheets
      • eBooks
      • Infographics
      • Solution Briefs
    • International Documents
      • Deutsch/German
      • Español/Spanish
      • Français/French
      • Italiano/Italian
      • 日本語/Japanese
    • Cisco Umbrella Blog
      • Latest Posts
      • Security Posts
      • Research Posts
      • Threats Posts
      • Product Posts
      • Spotlight
    • For Customers
      • Support
      • Customer Success Hub
      • Umbrella Deployment Hub
      • Customer Success Webinars
      • What’s New
      • Cisco Umbrella Studio
  • Trends & Threats
    • Market Trends
      • Rise of Remote Workers
      • Secure Internet Gateway (SIG)
      • Secure Access Service Edge (SASE)
    • Security Threats
      • Ransomware
      • Cryptomining Malware Protection
      • Cybersecurity Threat Landscape
    •  
    • Navigation-dropdown-promo-threat-report_020521
  • Partners
    • Channel Partners
      • Partner Program
      • Become a Partner
    • Service Providers
      • Secure Connectivity
      • Managed Security for MSSPs
      • Managed IT for MSPs
    •  
    • Become a partner
  • Free Trial Signup
  • Umbrella Login
  • Cloudlock Login
  • Contact Us
Security

How DNS-Layer Security Can Improve Cloud Workloads

By Prem V
Posted on January 23, 2020
Updated on July 1, 2020

Share

Facebook0Tweet0LinkedIn0

More organizations are adopting the public cloud for their enterprise workloads. Gartner has forecasted1 that by 2020, less than 5% of enterprise workloads will be running in true on-premises private clouds. As workloads move to public clouds, it is crucial that security architectures evolve to protect those workloads, wherever they are.

Like with on-premises applications, a layered security approach works better than point solutions for cloud workloads. But the security challenges in the cloud are different. Without a physical data center in which you build your security stack to protect your data, it’s difficult to know if you’re fully protected everywhere your enterprise data is exposed.

That’s where DNS-layer security comes in. Since DNS is built into the foundation of the Internet, security at the DNS-layer can be simple to deploy and highly effective, whether your enterprise uses on-premises architecture or the public cloud. Cisco Umbrella provides DNS-based security that blocks requests to malware, phishing, and botnets before a connection is even established. It can prevent cloud workloads from being leveraged for malicious cryptomining by blocking requests to suspicious domains. Content category blocking can also be configured to prevent cloud workloads from being used by employees to circumvent on-premises content filtering rules.

One of the simplest approaches to enable DNS-based security for cloud-native workloads is to point the DNS server used by these workloads to Cisco Umbrella. This enables DNS-level blocking of malicious domains and provides an added layer of security. However, since most cloud workloads tend to access the Internet through an ephemeral public IP address, it is difficult to define policy or to view reporting of DNS activity in the public cloud.

Another approach is to deploy the Cisco Umbrella Virtual Appliance in a Virtual Private Cloud (VPC) in the public cloud. Workloads in that VPC can use the Virtual Appliance as their DNS server. The Virtual Appliance forwards DNS requests for external domains to Umbrella and includes the source IP of the requesting workload in the DNS metadata. Virtual Appliances include a customer identifier in each outgoing DNS request, which enables them to be used for environments with ephemeral public IP addresses. With the Virtual Appliance approach, subnet-based content filtering policies can be defined for cloud workloads. Umbrella can also provide visibility into the source of malicious domain requests, allowing administrators to quickly remediate these workloads.

The Cisco Umbrella Virtual Appliance now supports deployment in the three major public cloud platforms: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). With many organizations now adopting a multi-cloud strategy2, deploying Umbrella Virtual Appliances in the respective public cloud VPCs can provide a highly effective added layer of security for workloads deployed in any of these platforms, as well as improved visibility into activity.

What are you waiting for? Sign up for a free trial of Cisco Umbrella, and start leveraging the power of DNS-layer security to protect your cloud workloads.

  1. Modernize IT infrastructure in a hybrid world, Gartner, Mar 2019. Retrieved from https://www.gartner.com/smarterwithgartner/modernize-it-infrastructure-in-a-hybrid-world/
  2. Why organizations choose a Multicloud strategy, Gartner, May 2019. Retrieved from https://www.gartner.com/smarterwithgartner/why-organizations-choose-a-multicloud-strategy/

Previous Post:

Previous Article

Next Post:

Next Article

Follow Us

  • Twitter
  • Facebook
  • LinkedIn
  • YouTube

Footer Sections

What we make

  • Cloud Security Service
  • DNS-Layer Network Security
  • Secure Web Gateway
  • Security Packages

Who we are

  • Global Cloud Architecture
  • Cloud Network Status
  • Cloud Network Activity
  • OpenDNS is now Umbrella
  • Cisco Umbrella Blog

Learn more

  • Webinars
  • Careers
  • Support
  • Cisco Umbrella Live Demo
  • Contact Sales
Umbrella by Cisco
208.67.222.222+208.67.220.220
2620:119:35::35+2620:119:53::53
Sign up for a Free Trial
  • Cisco Online Privacy Statement
  • Terms of Service
  • Sitemap

© 2021 Cisco Umbrella