Cisco takes Security Everywhere™ to throw blanket over shadow IT

Cisco wants you to know it has Security Everywhere™, but that it doesn't mean it is Gossamer Thin.

Rather, the messaging from the Borg is that its newly-boosted security suites cover just about everything that needs to be securable.

That it says includes the things you don't know you even own, or to use advertising lingo, shadow IT.

To that end, Cisco has tucked in its Cisco Cloud Access Security thing under the warm Security Everywhere™ blanket; this partnership allows customers to use Elastica and SkyHigh Networks to find and control staff devices tapping into the corporate network.

It is well suited to prevent bumbling employees hurting the business with their slippery and pwnable personal devices, but perhaps less so to stopping those dedicated evil insider thieves who simply want to steal.

The Borg's Identity Services Engine has had a kick under Security Everywhere™ with a mobility engine that means admins can enforce access controls based on where a user is physically located.

There are many aspects to the announcement (read the press release here) but Cisco's Aussie security man Anthony Stitt is most stimulated by the OpenDNS buy and shadow IT offensive.

"OpenDNS is a fantastic zero-footprint, zero-touch service that can be deployed in minutes," Stitt says.

"Elastica is there to help organisations with discovery of service that users are subscribing to that IT doesn't know about."

The newish pxGrid partnership inked around July and formalised more recently between the likes of Check Point, Invincea, and Infoblox is getting the big end of town excited, says Stitt.

He says Aussie financial sector firms have bought in, among others.

IBRS security adviser James Turner reviewed the announcement but does not see new capabilities.

"I can't see any new capabilities here," Turner says. "And, as usual, the pitch sounds like it's up to IT to 'regain control' and I humbly assert that it would be better for the business for IT to focus on being able to measure, report, support and enable."

Pressing questions for customers here include the resources required for IT to be able to setup and maintain the product capabilities - which is one of the "huge let downs" around security-pitched products - and the specific outcomes a business can achieve along with the services that can be enhanced.

"We see it far too often; that technical security people can run out and buy a new tool with the aspirations of securing everything, everywhere; but end up frustrating the business and failing to apply resources to where they will make the most difference."

Businesses should focus first on ticking off the Australian Signals Directorate's Top Four security controls which will make a "huge difference" for real risks. ®