Cisco SD-Access is part of the DNA platform, providing an additional layer of analytics and controls over access policies, network segmentation, and endpoint monitoring. It’s an all-in-one product that delivers another vital layer of security and privacy protection.
SD-Access is a combination of two elements: SDN and the access edge. The result is a network with a centralized management system and enhanced security policies. SD-Access applies the principles of software-defined networking, or SDN, to network access. SD-Access places devices at the access layer under the management of a centralized network controller instead of managing each device as an independent entity.
The goal of SD-Access is to drive granular control of network access right down to the edge. The primary driver for enterprise SD-Access adoption is the desire to improve network security. While centralized SDN-style management can control all aspects of access device behavior, the main motivation for SD-Access is to strengthen security controls over who and what can connect, as well as what connected entities can do.
How does SD-Access work?
SD-Access works by combining the following three elements:
• Perimeter access control
• A centralized policy engine
• Behavioral threat analysis
Perimeter access control
Edge routers provide the access control component. They require initial authentication of the system’s identity and any subsequent re-authentication. They also assign virtual LANs (VLANs) and apply access control lists (ACLs) to each port, controlling which parts of the network that port can reach. In a conventional network, these assignments are essentially static; in an SD-Access network, they are dynamic and subject to change at any time.
When a policy changes, these assignments may also change. Such changes will be applied immediately, and systems will be re-authenticated and reauthorized. When a system misbehaves and needs to be isolated from other systems, its port can be blocked or assigned to a quarantine VLAN.
Centralized policy engine
Edge routers assign ports to VLANs and enforce ACLs according to the directives of a centralized policy engine. At the core of an SD-Access system, edge routers implement access policies, which enable, but do not require, SD-Access to implement zero trust. Access policies can create a wide range of security environments. These can range from completely open, requiring no authorization whatsoever, to completely zero trust, blocking all access that is not explicitly permitted.
Behavioral threat analysis
The behavioral threat analysis tool enables SD-Access to take behavior into account, which is essential for implementing a software-defined perimeter (SDP) or zero-trust network access (ZTNA). It can detect behavioral anomalies (such as behaviors associated with attacks or compromised systems) and notify the policy engine. The policy engine can then instruct the perimeter network to block, quarantine, or restrict access for the associated entity or identity. SD-Access is one of many approaches to zero trust. Organizations interested in driving zero trust at the access edge of their networks should evaluate SD-Access alongside other options, such as SDP. They should also consider implementing ZTNA as soon as resources allow.
