700-765: Security Architecture for System EngineersDemo

Secure access must protect both the workforce—people and their devices accessing resources—and workloads—applications and services that communicate with other resources. Cisco’s zero-trust guidance includes securing user access and protecting or segmenting workloads as distinct security domains.

Multi-factor authentication (MFA) verifies a user’s identity by requiring more than one form of authentication before access is granted.

Cisco pxGrid shares TrustSec egress-policy information with integrated systems, enabling policy to be applied consistently across the security ecosystem. Cisco Cloudlock manages cloud-application policies and data-access scopes, including full-data and limited data-and-files access. Cisco pxGrid API—Get egress policies Cisco Cloudlock API—request samples

Web Security safeguards the web and email channels, where threats such as malicious links, phishing content, and malware can be delivered. Cloud, data-center, and voicemail vectors require different security controls.

Cognitive Intelligence applies multilayer machine-learning analytics, including event classification and entity modeling, to correlate activity and produce stronger threat intelligence.

Compliance regulations require organizations to meet mandated security, privacy, audit, and reporting obligations. A lack of solution integration leaves security data and controls disconnected across tools, increasing operational complexity and reducing unified visibility. Cisco identifies lack of integration as a security-management challenge and describes the need to consolidate security and compliance information into a unified view.

Cisco Identity Services Engine profiles connected endpoints by collecting device attributes and correlating them with predefined or custom profiling conditions. Cisco Duo verifies user identity and device trust or health before access is granted, providing the verification component of identity and endpoint profiles.

Cisco cloud security includes cloud data security, which protects cloud-hosted information through controls such as data-loss prevention and compliance capabilities, and cloud-delivered security, which provides protective services from the cloud for users and internet access. Cisco documents CloudLock’s Cloud Data Security & Compliance capability and describes Umbrella as a cloud-delivered security service.

Cisco’s Advanced Threat portfolio is organized around network analytics, threat analytics, and malware protection. Cisco Secure Network Analytics provides network-telemetry-based threat detection, Cognitive Threat Analytics applies analytics to identify threats, and Cisco malware-protection capabilities provide layered defense against malicious files and behaviors.

DNS-layer security uses current threat intelligence to classify risky destinations and enforces DNS filtering policies that block access to malicious or unwanted domains before the associated connection is made. Proxy/file inspection and sandboxing are secure-web-gateway or malware-analysis capabilities; monitoring and analytics support visibility and investigation rather than being the core DNS enforcement capabilities.

Cisco Firepower NGFW uses shared threat intelligence for early warning so defenses can be prepared before an attack. It accelerates advanced-threat detection and remediation, and it consolidates security functions with unified management to reduce operational complexity.

IoT devices must be kept current through equipment and firmware/software updates, and malfunctions must be remediated because faults can create operational and security vulnerabilities.

Cisco Identity Services Engine (ISE) enforces identity-based authentication and authorization policy for IoT assets, assigning Security Group Tags based on authorization policy. In the IoT architecture, this protection applies to the control layer and the connected things layer, enabling controlled access to operational equipment and devices.

Advanced Malware Protection uses advanced analytics and dynamic analysis to evaluate suspicious files and determine malicious behavior. Dynamic analysis executes files in a sandbox and produces a threat score, while advanced analytics correlates file and malware artifacts to identify attacks and provide context.

Cisco identity policies associate connections with users, correlate user identity with threat, endpoint, and network intelligence, and apply access control based on users or groups. This identity context supports layered policy enforcement and containment of threats to limit their entry and spread.

Fully integrated Cisco NGFW platforms provide context, telemetry, and intelligence sources, allowing other security components to share relevant security information and participate in consistent enforcement across the environment.

Visibility and enforcement capabilities identify devices and apply access-control policy based on endpoint context and posture. They protect endpoint devices, including mobile devices, while web, cloud, and email are covered by their respective security domains.

MFA protects access to web applications by requiring an additional authentication factor, and it helps protect endpoints by verifying the user and evaluating the device used to access protected applications. This reduces the risk that a stolen password alone enables unauthorized access.

Traditional perimeter security is insufficient because the expanding number of connected devices broadens the attack surface, while more vulnerabilities create additional paths for compromise that a boundary-only control model may not prevent.

Cisco Security provides integrated, multilayered capabilities for advanced threat detection, and its portfolio protects across the organization’s environment, including network, cloud, endpoint, and application layers. Cisco Security

Cisco ISE provides guest access management through guest and sponsor portals and centrally administers consistent access-control policies across the network. Device firewalling and DDoS prevention are not core ISE functions; ISE is an identity- and policy-based access-control platform.

Cisco Secure Web Appliance provides user authentication for web-access policies and includes Web Usage Controls that perform URL filtering and Dynamic Content Analysis for URL categorization. Cisco documents both the appliance authentication capability and the URL filtering/Dynamic Content Analysis capability.

TACACS+ Device Administration in Cisco ISE centrally controls administrator access to network devices, authorizes individual commands according to assigned roles and policies, and records accounting information for audit purposes.

Trust-centric (Zero Trust) security requires explicit authentication and authorization before access is granted, using all available signals such as user identity, device health, location, and the application or workload. This broad, context-based access evaluation is more than device management or general attack prevention.