Anyconnect Endpoint Security Management System

[cadet]

Hello!

We are faced with the requirement of a centralized management system for endpoint protection system. Competitors have such systems - for example, Checkpoint's Endpoint Security Management. What AnyConnect centralized management solution can we offer ?

[Muhammad Awais Khan]

Hi,

For end point protection system, Cisco is offering AMP4E. It do have both options cloud or on-premises but cloud one is the easiest one to deploy.

Below is the link for its datasheet. It requires connector to install on the end points, that connector can be AMP connector or if you are having already Anyconnect then AMP connector can be added on the Any Connect.

https://www.cisco.com/c/en/us/products/collateral/security/fireamp-endpoints/datasheet-c78-733181.html

I am attaching a snapshot from AMP Console page from where you manage your end points.

[cadet]

@Muhammad Awais Khan, hi !

Thanks for your answer.

As I understand this solution (AMP for endpoint) provides centralized management only the AMP module (connector) in Anyconnect.

But the customer also needs to centrally manage the following functionality at the end station:
- Web-filtering
- Application Firewall
- IPSec VPN
- SSL VPN
- Two-factor authentication
- Software Inventory
- Compliance

It is probably possible to offer with other modules of Anyconnect, Duo, Umbrella..... But what about a centralized system for this functionality?

[Muhammad Awais Khan · Accepted solution]

Hi,

You will find very few vendors who have a platform comprehensive enough to offer these solutions under single vendor.

- Web-filtering
- Application Firewall
- IPSec VPN
- SSL VPN
- Two-factor authentication
- Software Inventory
- Compliance

Out of above, We can have firepower next generatiin firewall appliance which can support web filtering, application filtering, iPsec vpn, sslvpn in a single box which can be manage by single platform wither FMC or FDM.

Further, Cisco security Architecture is integrated with each other. For example if You have AMP4E and Firepower with AMP enabled then those two AMP can be integrated with each other. Advantage of this integration is to have a single console to manage AMP policies like whitelisting/blacklisting file hashes. Also due to integrarion, we can corelate events happened on the firewall and AMP4E related to malicous files.

DUO is separate platform but it can also integrate with AMP4E. AMP4E can notify DUO if it detects a PC with malicious files or behavior then DUO will block this user to access the applications.

https://duo.com/blog/amping-up-endpoint-security-from-duo

Compliance check can be perform by DUO.

https://duo.com/blog/duo-provides-technical-controls-for-compliance-with-privacy-laws

So only thing missed from your list is software inventory :) you can get visibility on the users devices from AMP4E itself directly and from DUO also.