1. Cisco Defense Orchestrator Technical Decision Maker Presentation
June 2016
Hello, my name is _______________ and I have been with Cisco for X years. Thank you for agreeing to discuss Cisco Defense Orchestrator.
[CLICK]

2. Get The Most Out of Your Expanding Security Tool Set
Cisco ASA with FirePOWER™ Services and Cisco
Firepower™ Next-Generation Firewalls
Cisco® ASA X Series Firewalls
OpenDNS Umbrella

3. We’ve Heard from Distributed Businesses Like Yours That Maintaining an End-to-End Security Posture Is Increasingly Complex for Network Ops
Manage constant changes in security policy and rules
Keep up with business needs
Stay ahead of the latest security threats
Do more with fewer resources and cut costs
We’ve heard from distributed businesses like yours that maintaining end-to-end security posture is becoming increasingly complex.
“Plugging holes" in the proverbial security dam with point products doesn't work – it’s no longer an option to be reactive to security.
Customers like you have said they’re faced with several changes. Here are just a few examples.
You’re required to:
Manage constant changes in security policy and rules. Sometimes the workarounds created to give your team the instant access or updates they’re asking for aren’t as secure as they should be or don’t get written into the proper policy. This opens you up to vulnerabilities.
You also have to keep up with business needs. For example, as your business expands, you’ll have more Cisco devices, more policy requests and technologies to manage.
It’s also super critical that your team stays ahead of the latest security threats. Often times this means you’ll need some way to leverage NGFW functionality with Security Intelligence Feeds to help you get cutting-edge IPS and Advanced Malware Protection. Your team might not have the expertise or time to keep up.
And lastly, you’re required to do more with fewer resources. On top of the increased workload, you are often expected to meet growing demands with a team that just isn’t getting any bigger.
Overall, this means you need an integrated security solution that is not only effective, but also simpler and consistent to manage. You need a systematic way to up your security game and provide robust Cisco security policy management across all of your locations.
T: We know it hasn’t been easy. [CLICK]

4. Does This Sound Familiar?
My team is stretched thin. We just keep up with the policy-change requests that hit us every day.
I want to add new next-gen tools to keep up with the latest threats, but I don’t have the knowledge, the time or the resources to do it – it’s just too complicated.
It’s a struggle for us to maintain consistent security as our company grows.
[Presenter guidance: Get up close and personal with your audience. Use this opportunity to get your customer talking. Take notes and use these points to frame the rest of your conversation.]
Does any of the following sound familiar? Perhaps you’re hearing or experiencing this on your team:
It’s complex to manage security policy across multiple layers, with multiple technologies that don’t always play nicely together.
The need to figure out what works and what doesn’t, while maintaining uptime and protecting against breaches can be difficult to balance.
You’ve got barely enough time and resources to keep up with the status quo, let alone think of ways to make it better or improve your strategy.
It’s a lot to manage, especially because there’s no room for mistakes or downtime.
T: The good news is, we have built a solution that addresses these kinds of challenges. Our solution is informed from the ground up with input from customers, and it’s their feedback that has helped us deliver a solution that meets core needs. Hopefully your needs, as well. [CLICK]

5. Cisco Defense Orchestrator
Introducing
Cisco Defense Orchestrator
A cloud-based policy management solution for Cisco security products
T: I’d like to introduce Cisco Defense Orchestrator, a cloud-based policy management solution for Cisco security products. [CLICK]

6. And Cisco Defense Orchestrator Is Here to Help
Simple
Efficient
Effective
Streamline security policy management and next-generation defense
Extend the reach of your resources
Achieve better security without adding complexity
Using Cisco Defense Orchestrator will strengthen your security posture.
This security management system is simple, efficient and effective. It will streamline your security policy management and next-gen firewall defense, enable you to do more with less, and we promise, it will strengthen your security without complicating your life.
T: And you get all of this from a central location. [CLICK]

7. Cisco Defense Orchestrator: Security Policy Management Simplified
Reports
Simple search
Notifications
Device onboarding
Policy change management
Policy modeling, analysis and optimization
Policy monitoring and reporting
Scalable orchestration of changes
Import from offline
Discover direct from device
Security policy management
Cisco Defense Orchestrator enables you to manage your policies through the cloud with 7 key capabilities:
Device onboarding
Object and policy analysis
Security templates
Simple search-based management
Change impact modeling
Out-of-band notifications
Automatic reports
Each of these features enable you to strengthen your next-gen firewall security posture.
T: But how easy is it to get started? [CLICK]

8. Onboard Security Devices Easily in One of Two Ways
Device onboarding
Get started through a simple interface
Customer Network
Cisco® Defense Orchestrator
Connect directly through the cloud
Set up a secure connection within your data center
Secure
Data Connector
Choose between cloud or on-premises connection
Security policy management
Object and policy analysis
Security templates
Simple search-based management
Change impact modeling
Out-of-band notifications
Reports 1 2
Onboarding devices is easy, and managing security should be, too.
Get started with our simple onboarding interface.
If you’re onboarding with a device, Defense Orchestrator supports ASAs, as well as ASAs with FirePOWER Services.
And connecting to Cisco Defense Orchestrator is simple, regardless of whether you choose to onboard in the cloud or on your own premises.
T: Once you’re onboarded, then the real fun begins. [CLICK]

9. Security Policy Management
Device onboarding
Defense Orchestrator helps you manage your security policy holistically
Security policy management
Change Management: Get visibility to change impact across affected security services and devices
Auditing: Gain policy awareness and identify issues
Cisco Defense Orchestrator
Change Impact Modeling
Object & Policy Analysis
Object and policy analysis
Security templates
Simple search-based management
Import From Offline
Discover Direct From Device
Device Onboarding
Change impact modeling
Security Policy Management
Reports
Out-of-band notifications
Monitoring: Track policy implementation and activity across all impacted security services and devices
Optimization: Adjust security policy rulesets to optimize performance
Reports
OOB Notifications
Once your devices are connected, Defense Orchestrator helps you orchestrate all four aspects of security policy management – through change management, auditing, optimization and monitoring.
For Change Management, you get visibility to change impact across affected Cisco security services and devices. You can visualize and orchestrate how changes affect global security posture using change impact modeling.
For Auditing, you gain policy awareness and identify issues. You have the ability to compare and edit duplicate, unused, and inconsistent configurations by conducting object and policy analysis.
In terms of Optimization, you can adjust Cisco security policy rulesets to optimize performance using change impact modeling. You can also easily apply policy configurations across all Cisco devices.
And lastly, for Monitoring, you can track policy implementation and activity across all impacted Cisco security services and devices through aggregated reports and out-of-band notifications.

10. Optimize your firewall by correcting duplicates
Effectively Analyze Policies and Objects Across Your Entire Infrastructure
Device onboarding
Optimize your firewall by correcting duplicates
Security policy management
Policies
Quickly see duplicate objects
Object and policy analysis
Duplicate
Object 1
Object 1
Security templates
Inconsistent
Object 1
Simple search-based management
Rename Policy
Unused
Edit Policy
Change impact modeling
Out-of-band notifications
Reports
Now that you have devices in the Defense Orchestrator environment, you are able to interact with all of your Cisco security devices to ensure that your security posture is sound.
Let’s say you have 5 branches, including your headquarters, and you need to make sure they’re secure. Defense Orchestrator enables you to see where you have duplicate policies and gives you the option to either rename them if they are in fact protecting your infrastructure, or to edit the policies to remove any overlapping instructions.
Removing duplicate policies and objects from your network helps optimize your firewall. By removing duplicate properties, your firewall doesn’t spin its wheels trying to protect your system in multiple ways using the same policies and objects.
T: Cisco Defense Orchestrator also enables you to spot inconsistencies within your network. [CLICK]

11. Address inconsistencies
Effectively Analyze Policies and Objects Across Your Entire Infrastructure
Device onboarding
Address inconsistencies
Security policy management
Policies
Quickly see inconsistent policies
Quickly see Duplicate Policies
Object and policy analysis
Duplicate
Policy 1
Objects 1 2 3
Duplicate
Policy 1
Policy 2
Objects 1 2 3b
Policy 1
Security templates
Inconsistent
Policy 1
Simple search-based management
Rename Policy
Unused
Edit Policy
Change impact modeling
Out-of-band notifications
Reports
Defense Orchestrator not only lets you see where inconsistencies exist, but it lets you dive into the details and see exactly where they reside.
The detailed view within Cisco Defense Orchestrator allows you to easily remediate any anomalies in your network.
T: You can also confidently identify policies and objects that are being used in your network. [CLICK]

12. Remove unused policies to instantly improve your security posture
Effectively Analyze Policies and Objects Across Your Entire Infrastructure
Device onboarding
Remove unused policies to instantly improve your security posture
Security policy management
Policies
Quickly see Inconsistent Policies
Quickly see Duplicate Policies
Quickly see unused policies
Object and policy analysis
Policy 1
Objects 1 2 3
Policy 5
Duplicate
Policy 1
Objects 1 2 3b
Policy 6
Security templates
Inconsistent
Inconsistent
Policy 7
Delete Policy
Simple search-based management
Unused
Edit Policy
Change impact modeling
Out-of-band notifications
Reports
Unused policies and objects just take up energy and space in your system. When these unused policies and objects take up memory space, it slows down your entire system, weakening your security performance.
Defense Orchestrator automatically identifies which policies and objects are going unused. This enables you to confidently remove any unused policies, with the knowledge that your security posture will not be impacted by these changes.
T: Cisco Defense Orchestrator helps you set up your security policies right the first time. [CLICK]

13. Precisely Manage Device Configuration from Start to Finish
Device onboarding
Security policy management
</p>
/>
</p>
</p>
/>
Object and policy analysis
</p>
/>
</p>
/>
</p>
/>
</p>
/>
<location server>
</p>
/>
</p>
/>
<IP address>
Security templates
/>
<Host name>
</p>
/>
</p>
/>
Simple search-based management
Export
New Branch
Change impact modeling
Out-of-band notifications
Reports
Defense Orchestrator drives efficiency in Cisco security deployments without compromising your security. How does it do that? Templates.
Templates allow you to determine the best security practices for your company and apply those practices out across your entire business. Each template is parameterized by specifying things like Location server, IP address, and Host name. And you can also use templates to assign device-specific values.
Defense Orchestrator helps your business to scale by making it easy to save and export security template. Want to open another branch? Not a problem. You can arm your new branch with the same exact template that is protecting the rest of your infrastructure.
T: Once you have all of your security templates set up, it’s important that you’re able to easily find and manage your security assets. [CLICK]

14. Easily See Which Policies Are Enforced Across Your Infrastructure
Device onboarding F a c e b o o k
Security policy management
www
Searching 5024 records
www
Object and policy analysis
Search results for “Facebook”
Security templates
Facebook.
com
Domain/IP
OpenDNS
15 Block
13 Allow
Facebook Chat
Application
FirePOWER
Facebook Games
20 Block
15 Allow
Social Networking
URL Category
Firepower Threat Defense
10 Block
10 Allow
Simple search-based management
Change impact modeling
Out-of-band notifications
Reports
Seeing how many policies and objects are sitting in Cisco Defense Orchestrator can be daunting. You’re probably managing thousands of policies and objects.
If you want to know how a particular object is interacting in different locations on different policies, the last thing you want to do is manually sift through all of your device information.
The simple search-based management feature allows you to do just that. Simple search-based management provides you a single-pane view across all of your Cisco security devices. Simply search by policy, object, ACL name, and/or network name to find exactly what you want to know.
We know you’re busy and we know that managing security can be tedious and time consuming. Cisco wants to make managing security simple, so we made it as easy as a web search.
T: And what you can do once you find what you’re looking for can make a big impact on your security posture. [CLICK]

15. Rapidly Determine Impact of Policy Changes Before Deployment
Device onboarding
Review policy and object changes in a safe environment
Security policy management
Object and policy analysis
Instant Messaging Policy
Active
Review current policy
Turn off Instant Messaging
Google chat
Google talk
Facebook messenger
Yahoo chat
AOL chat
View change impact
Validate change
Security templates
Deploy broadly
Sync
Simple search-based management
Change impact modeling
Revise if needed
Revise if needed
Out-of-band notifications
Reports
Making changes to your security policies without fully understanding the impact of that change opens you up to a lot of risk.
Cisco Defense Orchestrator makes it easy for you to determine the impact of policy changes prior to deploying the change out to your entire organization.
For instance, say I have a policy in place to block access to all instant messaging applications. As long as that policy is active, people on my network cannot access those sites. Say, however, that I have a business need that requires access to Google Talk. I can turn on the Google Talk as an application through my network and continue to block the rest of the instant messaging applications.
As you see in this slide, even if I allow Google Talk, none of the other instant messaging objects or policies are impacted. They remain blocked. As the admin, I can then decide whether or not I want to deploy the change broadly across my network. If I decide everything is good to go, I can sync the policy with all of my security devices.
If I decide that this isn’t the change I want to make, I simply revise the change and find another way to achieve the outcome I’m looking for.
T: But what happens if someone else decides to make a change to my network? [CLICK]

16. Automatically Receive Notifications When Policy Changes Occur
Device onboarding
Branch office makes unplanned changes to the network
Security policy management
Object and policy analysis
Security templates
Simple search-based management
Policy change
Policy 1
Policy 2
Policy 3
Policy 4
Change impact modeling
Discard change
Out-of-band notifications
Deploy change
Reports
Headquarters receives automatic notification. Choice to discard change or deploy broadly
When unplanned changes are made to your security policies, you’re weakening the defense of your entire infrastructure.
Defense Orchestrator helps keep your security posture consistent by sending you automatic out-of-band notifications. As soon as a field tech makes an unplanned change at a specific branch, the lead IT administrator is notified regarding those changes and can to decide whether or not that change should be blocked or distributed to all of the other branches.
If the IT administrator chooses to deploy the change, all branches will be protected by the updated template. Should the change be blocked, the branch that initiated the unplanned change will revert back to the original template.
This ensures that your organization has a consistent, strong, security posture.
T: To understand how your network is behaving overtime, Cisco Defense Orchestrator provides several automatic reports. [CLICK]

17. Efficiently Track Policy Effectiveness
Device onboarding
Top destination
Top applications
Attacks and threats
Security policy management
Analyze where people in your network are most often visiting.
Learn which applications your network is using the most.
Identify where any potential and current attacks and threats might be coming from and how they’re affecting your network.
Object and policy analysis
Security templates
Top web categories
Simple search-based management
Evaluate the top web categories that people are using on your network and determine where there might be gaps in security.
Change impact modeling
Out-of-band notifications
Reports
Cisco Defense Orchestrator provides four automatic reports
Attacks and threats
Top destinations
Top web categories
Top applications
With these reports, you’re able to view aggregated information about your Cisco security solution, not just the performance of one device. This enables a deep analysis of what’s working, what policies or objects need to be improved and which locations are lacking protection, if any.
It also makes any potential threats or attack easily visible, so you and your organization can address problems quickly.
T: Cisco wants to make keeping your company secure, easy. [CLICK]

18. And Increase Visibility into Your Cisco Security Network
Device onboarding
Analyze the performance of your entire infrastructure
Security policy management
Get visibility into Layer 7
Identify trends within your network with reports on top destination, applications, and web categories
Object and policy analysis
Security templates
Simple search-based management
Change impact modeling
Out-of-band notifications
Reports
These reports help you analyze the performance of your entire Cisco infrastructure. They grant visibility into Layer-7 and identify trends within your network, enabling your organization to gain a stronger, more consistent security posture.
T: But let’s see what this looks like in reality. [CLICK]

19. Demo of Cisco Defense Orchestrator

20. Cisco Defense Orchestrator Security, Deployment, and Architecture
I’ll now walk you through how it all works in terms of deployment options.

21. Cisco Defense Orchestrator Is Secure at Every Level, Regardless of Connection Method
Secure multitenant architecture within Cisco Defense Orchestrator 1
Cisco® Defense Orchestrator
Customer
Customer
Data in motion is encrypted with Secure Sockets Layer (SSL) on a per-customer basis 2
2FA
2FA 3 3 4 4 1
Secure multitenant architecture
Two-factor authentication (2FA) is required for users to connect to their tenant
SSL 2 2
SSL 3
Customer Data Center
Customer Data Center
Data at rest is encrypted on a per-customer basis in a separate database instance 4
Secure data connector in the cloud
Secure data connector in the customer data center
There are two primary ways to connect with Cisco Defense Orchestrator. The first is with a Secure Data Connector in the cloud and the second through a Secure Data Connector in your Data Center.
Regardless of the connection method, Defense Orchestrator is secure at every level.
It starts with a secure, multi-tenant cloud, where your data is secured in your own tenant.
All data in motion is encrypted with Secure Sockets Layer (SSL) on a per-customer basis.
Next, Two-factor Authentication is required for all users to access their tenant within Defense Orchestrator.
And lastly, all data at rest is encrypted on a per-customer basis in a separate database instance.
T: Now, let’s look at the two connection methods in a little more detail. [CLICK]

22. Cisco® Defense Orchestrator
One Way to Connect Is If All Your Devices Have Internet Connectivity Secure Data Connector in the Cloud – Customer 1
Cisco® Defense Orchestrator
Customer 1
SSL
Customer 1 Data Center
SSL
SSL
Public Internet access
Secure data connector in the cloud
In this example, Customer 1 has internet connectivity to all of their Cisco security devices in their data center and branches.
This customer has multiple locations with ASA and ASA+FirePOWER services, which are directly connected to their customer tenant using their Secure Data Connector in the cloud.
Each ASA and ASA+FirePOWER Services device will establish secure communication with Defense Orchestrator via the Secure Data Connector.

23. Cisco® Defense Orchestrator
Another Way to Connect Is If Your ASA + FirePOWER Device or FTD Has Private IP Address Connectivity Secure Data Connector in the Cloud – Customer 2
Cisco® Defense Orchestrator
Customer 2
SSL
Customer 2 Data Center
SSL
SSL
IP forwarding
Public Internet access
Secure data connector in the cloud
Similar to the previous example, in this scenario, the Secure Data Connector is also in the cloud.
Customer 2 also has multiple locations with ASA and ASA+FirePOWER services devices and their datacenter and branches have internet connectivity. The difference here is that only the ASA module in the device has public internet access while the FirePOWER services module in the device has a private IP address.
In this scenario, the customer can use the Secure Data Connector in the cloud to communicate with Defense Orchestrator. Each customer has their own secure data connector deployed in the cloud. We’ll take care of the inter-device communication by forwarding the traffic from private to public within the modules.

24. Cisco® Defense Orchestrator
Or When Your Security Requirements Limit Cloud Connectivity Secure Data Connector in the Customer Data Center – Customer 4
Cisco® Defense Orchestrator
Customer 4
SSL
Customer 4 Data Center
No Internet access
Secure data connector in the customer data center
This final scenario is very similar to the previous. This customer has security requirements that limit their cloud connectivity.
In order to deploy Defense Orchestrator in this environment, the customer can download the Secure Data Connector in their data center.
They’re limited to cloud connectivity, not due to lack of internet on their devices (they may or may not have internet on their devices), but because their security requirements mandate limited cloud connectivity. So in this case, the customer could connect the same way as the last example.
T: Next, we’ll talk about Defense Orchestrator’s scalability availability. [CLICK]

25. Strengthen The Security Posture of Your Cloud
Simplify security policy management in the cloud with Cisco Defense Orchestrator Security
Plan and model security policy changes before deploying them across the cloud to ensure consistency with other security devices
Deploy changes across virtual environments in real time or offline
Receive notifications about any unplanned changes to security policies and objects
Reports
Simple search
Notifications
Device Onboarding
Policy change management
Policy modeling, analysis and optimization
Policy monitoring and reporting
Scalable orchestration of changes
Import from offline
Discover direct from device
Security policy management
Cisco Defense Orchestrator enables you to manage your policies through the cloud with 7 key capabilities:
Device onboarding
Object and policy analysis
Security templates
Simple search-based management
Change impact modeling
Out-of-band notifications
Automatic reports
Each of these features enable you to strengthen your next-gen firewall security posture.
Security policy change management
Plan and model security policy changes before you deploy them
Confidently deploy changes in real time or offline, and verify that they do what they should
Be notified about any unplanned changes to security policies and objects
Respond to threats quickly by orchestrating security policy changes
Periodically analyze the security policy configuration

26. Defense Orchestrator Is Highly Scalable and Highly Available
Add more servers to scale
All traffic is load balanced
MESSAGE QUEUE
REPLICA SET
All services are stateless
Elastic infrastructure allows for the addition of services
Defense Orchestrator is highly scalable and highly available.
It is built to manage any number of devices, so as you grow your business, it can meet your scale needs.
Defense Orchestrator has highly reliable, always-on availability.
We have an exact replica of the cloud environment in another location, so your data is always backed-up.
T: Another aspect of our cloud architecture is being multi-tenant. [CLICK]

27. Multitenancy Isolates Your Data
APPLICATION SERVER
Connections in the connection pool are unauthenticated. Requires key to access database
AUTHORIZATION SERVER
INJECTED PRINCIPAL
Customer A
MT INFRASTRUCTURE
Worker Threads
SPRING FRAMEWORK
Connection Pool
Authenticate
Get OAuth token
Customer B
BROWSER
RESTCall
Send Oauth Token
Customer C
Use OAuth token to retrieve a key to authenticate to the database and encrypt traffic
KEY MANAGER
Multi-tenancy helps you keep your data isolated. The multi-tenant environment allows us to isolate tenant data and encrypt it between the database and the application server.
What you are seeing here is that the data is on a per-customer, per-tenant level, right from the browser to their database in the database server. Your data is encrypted at rest and in motion with Oauth tokens. Every customer is authorized with their own token. This means that in case of a security incident, the threat would need to go trough several layers of security encryption to get to data, all which are refreshed every 60 seconds.
T: You can be confident that your security posture is strong through Defense Orchestrator. [CLICK]

28. We Understand the Problems You’re Experiencing
Manage constant changes in security policy and rules
Keep up with business needs
Stay ahead of the latest security threats
Do more with fewer resources
We understand the problems you’ve been facing.
It’s tough to keep up with constantly changing security policy, keep up with business expansion and stay ahead of the latest security threats, ALL while your resources are being trimmed.
T: We want to make managing your security posture easier. [CLICK]

29. And Cisco Defense Orchestrator Is Here to Help
Simple
Efficient
Effective
Streamline security policy management and next-generation defense
Extend the reach of your resources and cut costs
Achieve better security without adding complexity
Defense Orchestrator is simple, efficient and effective to use in your Cisco security environment.
T: But don’t take our word for it. [CLICK]

30. Learn More and Schedule a Proof of Value
Discover more about Cisco® Defense Orchestrator
us to learn more about Defense Orchestrator
cisco.com/go/cdo
Find out for yourself how powerful this tool can be. You’ve seen the demo today, but we want you to understand how this will help your day-to-day security operations.
Schedule a proof of value today and see how powerful Defense Orchestrator can be in your own security environment.
T: Of course, you can always contact our team with any questions, but I’d be happy to answer any questions you have right now. [CLICK]

31. Thank you for your time.