Cisco says network security needs to be delivered in a new way that enables enterprises to set and manage policy across hybrid environments and hundreds of devices from a single display.

To that end the vendor updated its security policy management tool, Cisco Defense Orchestrator, to support additional platforms and cloud-based logging with analytics.

Ahead of Cisco Live next week, Jeff Reed, senior vice president of product for Cisco’s security business, spoke exclusively with SDxCentral about the product updates and Cisco’s vision for the future of the firewall.

As companies move to the cloud and employees work remotely and use mobile devices, network traffic patterns change, Reed said.

“All those are great for business and how easily we can enable business, but it’s challenging for security,” he added. There’s no longer a single egress point where companies can establish security controls and deploy a firewall. This means network security functions need to be present on physical appliances, in data centers, in public clouds, in branches, and delivered from the cloud — but this also increases complexity.

“That perimeter is breaking down, so what we’re attempting to do is provide a new way to think about how network security is delivered and maintained,” Reed said.

This involves three things. First, Cisco will continue to invest in its security technology and Talos threat researchers.

“The second pillar is enabling those security controls to be run wherever our customers need them,” Reed said. This means that not only will Cisco continue to offer pure-play security products and services, but it will also integrate security with its networking and cloud products.

This gives customers the flexibility to put security controls wherever they need to based on their network traffic, be it the campus network or remote sites or public clouds. “But that can get really ugly from a complexity perspective,” Reed said. “So the third pillar is around having a single place where I can enable policy, and that’s CDO.”

CDO, or Cisco Defense Orchestrator, started as a cloud-based policy manager for Adaptive Security Appliances (ASAs), which are Cisco’s security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities. The vendor is now extending CDO to support Firepower Threat Defense (FTD) platforms and Meraki MX devices.

It’s also moving beyond policy management and integrating security analytics and logging into CDO. This means companies can correlate the events on the firewall with behavioral analytics and private network monitoring enabled by Stealthwatch Cloud. These capabilities will be available later this summer.

“It’s ASA in the data center, FTD at the internet, and Meraki MX in the branch. Now with CDO we’ll be able to cover all of these environments,” Reed said, adding that at Cisco Live the team will demonstrate support for native Amazon Web Services (AWS) firewalls as well. This new feature will be available later this calendar year. It will allow security professionals to set internal security policy “and extend that out to Amazon,” Reed said. “This helps solve ‘how can I ensure consistency of policy regardless of where my security control is?’ CDO can take this set of rules of apply it everywhere.”

While AWS will be the first public cloud, Cisco plans to also support Microsoft Azure and Google Cloud Platform (GCP) in the future. “Similarly, down the line as Umbrella [cloud security platform] gets more capabilities, we’re looking to extend CDO to that,” Reed said.

DHI Computing Service, a software provider in the financial, medical, and agricultural industries, uses CDO across about 200 ASA devices. In an interview with SDxCentral, Stuart Nelson, senior network engineer at DHI, called the security product a “lifesaver for us to be able to manage those ASAs.”

“The greatest benefit to use has been the time savings in pushing code upgrades out to those devices because now we can do that in bulk,” he added. Previously it took two people between three and five days to download the code manually and schedule updates for each device. Now it take one person less than a day.

Of course, Cisco isn’t the only security vendor bemoaning the death of the perimeter. And Cisco’s new firewall strategy sounds similar to VMware’s internal firewall that it debuted at RSA Conference in March. That product, called Service-defined Firewall, combines the capabilities of VMware’s NSX virtualization platform, which provides network and application visibility, and its first security product App Defense, which protects workloads by monitoring them against their intended state. And it adds automated and adaptive firewall capabilities to the mix.

Reed admits there are similarities. “They [VMware] see the same things we see, and they are extending some of their functionalities out to the branch and the cloud with Amazon.” Essentially both companies see customers moving data and applications outside of the traditional data center, he explained.

But Cisco has the advantage of being a legacy security vendor with a plethora of products and some 250 threat researchers, while VMware’s still just dipping its toes into the space.

“One of the benefits we have is the sophistication of our security controls, the threat intelligence in Talos, we have Snort,” Reed said, referring to the open source network intrusion detection software. And, he added, Cisco makes routers. “We have a broader set of places where you can put [security controls]. Our routing presence is tremendous in terms of market share.”