The document discusses how Cisco Tetration Analytics can be used to strengthen data center security through comprehensive visibility and machine learning capabilities. It describes Tetration's ability to map all network traffic, establish baselines of normal behavior, detect anomalies and outliers, and enable automated whitelisting policies. The document also outlines Tetration's key security use cases like segmentation, inventory of running processes, and reducing mean time to identify threats.

1. Derek Chia
Policy, Automation and Analytics
March 2018
How to strengthen DC Security with Cisco Tetration Analytics
Building a Secured Data Center
with Big Data Analytics

2. © 2018 Cisco and/or its affiliates. All rights reserved.
• Introduction to Tetration
• Key Use cases
• ADM and Whitelisting
• Security
• Pervasive Visibility
• Q&A

3. © 2018 Cisco and/or its affiliates. All rights reserved.
What if you could actually look at everything in your Data
Center that has ever traversed the network?

4. © 2018 Cisco and/or its affiliates. All rights reserved.
Tetration with Machine Learning answers your Critical
Questions
What’s normal
/Baseline?
What’s going on now
and 6 months ago?
What’s outlier?
Who is talking to
who?
Real time Whitelist
Policy?
How to enforce policy to
heterogenesis env.?
How to reduce
MTTI?
How to Lock down un-
used services/VMs?

5. © 2018 Cisco and/or its affiliates. All rights reserved.
Challenges in building a secure hybrid-IT
environment without compromising agility
• Know your applications:
what’s running and
what’s critical
• Understand what can
or should be deployed
in public cloud versus
on premises
• Minimize lateral
movement with fine-
grained segmentation,
zero-trust policy, and
behavior-based baselining
• Automate policy as
workloads scale or move
across infrastructure
• Identify behavior
deviations and
vulnerability quickly to
reduce exposure and the
attack surface

6. © 2018 Cisco and/or its affiliates. All rights reserved.
National Security Agency(NSA) on securing your assets
1. When protecting your network, you have to know everything that is going
on.
2. Decrease attack surface. Lock down and disable services you are not
using.
3. Identify what is routine in your infrastructure and what is not. Monitor for
deviations.
4. Whitelisting is a must in today’s cyber security world
Usenix Enigma 2016 https://www.youtube.com/watch?v=bDJb8WOJYdA
Rob Joyce, Tailored Access Operations, NSA
https://techtalk.pcpitstop.com/2016/09/07/nsa-best-practices-whitelisting/
https://www.theregister.co.uk/2016/01/28/nsas_top_hacking_boss_explains_how_to_prote
ct_your_network_from_his_minions/
“If you really want to protect your network you have to know your network,
including all the devices and technology in it,” he said. “In many cases we
know networks better than the people who designed and run them.”

7. © 2018 Cisco and/or its affiliates. All rights reserved.
Introducing Tetration
APPLICATION
INSIGHT
FLOW SEARCH
& FORENSICS
SEGMENTATION
& COMPLIANCE
v
Open Access
Web Rest API Event Bus Lab
Billions of Events
Meta-Data generated
from every packet
Software & Network Sensors: See everything
OS Sensor
Windows
Linux
Mid-Range
Universal
Network Sensor
Cloud-Scale Nexus
Nexus 9000 ‘X’
Data Analytics & Machine Learning Engine
Analytics Cluster
Appliance model
On-Premise or Cloud
▸ Ingest
▸ Store
▸ Analyse
▸ Learn
▸ Simulate
▸ Act

8. © 2018 Cisco and/or its affiliates. All rights reserved.
Application
Insight
Process
Inventory
Visibility and
Forensics
Cisco Tetration Platform
Security Use Cases
Cisco Tetration™
Platform
Foundation
Segmentation
Advanced Security
White-list Policy Policy
Compliance
Application
Segmentation
Process
Security
Software Inventory
Baseline

9. © 2018 Cisco and/or its affiliates. All rights reserved.
Operations
Cisco Tetration Platform
Use cases
Security
Cisco Tetration™ platform
Visibility and
forensics
Application
insight
Policy
Network and TCP
performance
Application
segmentation
Compliance
Policy
simulation
Process
inventory
Neighborhood
graphs

10. © 2018 Cisco and/or its affiliates. All rights reserved.
Cisco Tetration analytics data sources
Main features
 Low CPU overhead (SLA enforced)
 Low network overhead
 New Enforcement point (software agents)
 Highly secure (code signed and authenticated)
 Every flow (no sampling) and no payload
*Note: Available for POC/Trail purposes only
Software sensors
Linux servers
(virtual machine and bare metal)
Windows servers
(virtual machines and bare metal)
Windows Desktop VM
(virtual desktop infrastructure only)
Cisco Nexus 9300 EX
Cisco Nexus 9300 FX
Network sensors
Next-generation Cisco Nexus® Series Switches
Other Sensors
Other types of sensorsAvailable today
Container Host
(Host OS – Linux Based)
ERSPAN Sensor
Netflow Sensor*

11. © 2018 Cisco and/or its affiliates. All rights reserved.
Information
about Consumer
– Provider and
type of traffic
Detail
information
about the flow
Datacenter Wide Traffic Flow Visibility

12. © 2018 Cisco and/or its affiliates. All rights reserved.
Tetration Application Segmentation
Policy Recommendation
Cisco Tetration
Analytics™
APPLICATION WORKSPACES
Application
Segmentation
Policy
Public
Cloud
Private
Cloud

13. © 2018 Cisco and/or its affiliates. All rights reserved.
Network performance features in
Datacenter fabric
• Currently there is very little visibility into data
plane traffic within the fabric, resulting in
visibility and operational gaps
• Cisco Nexus 9000 Series Switches with the
built-in hardware flow cache with Cisco Tetration
platform enables the following Network
Performance features:
• Provide visibility into fabric topology
• Map and trace every flow path on the fabric topology
through switch ports and queues
• Search flows for individual fabric links or queues
• Provide per-link statistics and time series
• Provide per-queue statistics and time series
• Highlight important links for further diagnostics based
on specified performance metrics
Cisco Tetration
Analytics™
Cisco ACI™ Infrastructure using Cisco
Nexus® 9300-FX leaf switches and Cisco
Nexus 9500 with X9736C-FX line cards in
spine

14. © 2018 Cisco and/or its affiliates. All rights reserved.
Cloud Workload protection
Process baseline and behavior analysis
• Gain visibility into critical activities of a
process: Detect and alert when a particular
process deviates from its normal behavior
• Automatically detect suspicious behavior
based on process behavior deviations
• Proactive analysis: Quickly search and
visualize process tree and timelines to
identify threats
• See what happened at each stage of the
attack: Full time-series view of process
hierarchy and behavior changes

15. © 2018 Cisco and/or its affiliates. All rights reserved.
Tetration Use Cases
Digital
Transformation
SDN & Cloud
Adoption
Mergers &
Acquisitions
Hybrid
IT
De-Risk
Change
Cost Visibility
& Reduction
High Availability
Operations
Cyber
Hardening
Forensics Compliance
Technology and Business Transformation
Secure Cloud+DC Operational ExcellencePartnering with Cisco Security

16. © 2018 Cisco and/or its affiliates. All rights reserved.
Cisco Tetration Analytics: Ecosystem
Service visibility Layer 4-7 services integration
Security orchestration Service assurance
Insight exchange
Cisco Tetration
Analytics™

17. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
CISCO CONNECT 2018 . IT’S ALL YOU
Win a BOSE Soundsport Free
Wireless
Attend and complete the Secure
Infrastructure for the Multicloud
track feedback form and visit the
Cisco Data Center booth to qualify.

19. © 2018 Cisco and/or its affiliates. All rights reserved.
Tetration Analytics: Deployment Options
Cisco Tetration Analytics
(Large Form Factor)
• Suitable for deployments
more than 5000 workloads
• Built in redundancy
• Scales up to 25,000
workloads
Includes:
• 36 x UCS
C-220 servers
• 3 x Nexus
9300 switches
Cisco Tetration-M (Small
Form Factor)
• Suitable for deployments
under 5000 workloads
Includes:
• 6 x UCS C-220 servers
• 2 x Nexus 9300 switches
Cisco Tetration Cloud
• Software deployed in AWS
• Suitable for deployments
under 1000 workloads
• AWS instance owned by
customer
On-Premise Options Public Cloud
Amazon Web
Services