Umbrella DNS Security Advantage

My main use case for Cisco Umbrella is to secure my users from internet threats, specifically those phishing emails where users might mistakenly click on fake bank logins and provide their information. It has been very beneficial for securing against those threats, and there has also been some security based on the DNS activity that was observed and found.

Cisco Umbrella has positively impacted my organization by providing a good security solution, especially as we are a consulting company that faces threats of attackers attempting man-in-the-middle scenarios while my users are connecting to public Wi-Fi networks.

When users connected to public Wi-Fi, I noticed a lot of reduction in incidents, and the response time was much better.

The best features Cisco Umbrella offers include protections against malicious websites, phishing websites, and C&C controls used by attackers, and the benefit of restricting certain websites according to our policies.

Regarding how easy it is to manage those policies, malware site protection has been there for ages, but the ability to control C&C has been very beneficial, which is something that needs to be controlled.

Regarding Cisco Umbrella's AI capabilities, it is able to detect suspicious domains well, and its phishing detection is much better, especially with the risk scoring that I truly believe in.

Cisco Umbrella has everything required, but I believe the dashboards and management could be simplified, and stronger integration with SIEM, identity providers, or other security products would be an added advantage.

I have been using Cisco Umbrella for almost one year, exactly thirteen months.

Cisco Umbrella is very stable in my experience.

I have not looked into Cisco Umbrella's scalability in detail, but I know that scalability depends on global performance and large-scale policy deployment, and the API-first automation is quite good.

The customer support with Cisco has always been good. I would rate the customer support a ten out of ten.

Before Cisco Umbrella, I was using Skyhigh, but it was not fulfilling the relevant requirements that I had, which is why I had to switch. Skyhigh was lacking in maintenance, management, and the AI part, which is currently missing from it.

I have seen a return on investment, specifically in terms of time saved and needing fewer employees.

My experience with pricing, setup cost, and licensing reveals that the pricing is acceptable, but it is marginally a bit high. However, the services provided are much better, leading to a good return on investment.

Before choosing Cisco Umbrella, I did not evaluate other options. I directly chose Cisco after a proof of concept that fulfilled my requirements.

Regarding Cisco Umbrella's AI capabilities, I think that regarding governance and security, for user exceptions, it has to involve a manual process. My advice to others looking into using Cisco Umbrella is to first check your requirements and then look into it, as Cisco can fulfill all needs. I would rate Cisco Umbrella overall an eight out of ten.

My main use case for Cisco Umbrella is to protect DNS queries that are going outside to the internet. When I open Cisco Umbrella, the first thing I do is watch the dashboard to analyze what the traffic looks like in the last 24 hours, how many malicious queries have been blocked, what the valid usages are, and how many blacklisted URLs have hits.

The scope of monitoring Cisco Umbrella involves two or three people or some people in the SOC team doing the monitoring. Cisco Umbrella is used company-wide.

From my experience using Cisco Umbrella, one of the best features is that it provides protection for the endpoints even while off the network, which means that if you are working from home, your DNS queries are protected well enough, with the caveat that it only protects DNS queries but does not work well when accessing something via IP address.

Cisco Umbrella has definitely helped improve some aspects of our security posture, contributing to overall organizational security posture management. I have seen improvements in that it cut down on malicious traffic; if there is a new domain registered by a malicious actor or hacker, it is quickly detected by Cisco Umbrella. For instance, there was a phishing link we discovered, and we blocked it in Cisco Umbrella, ensuring anyone trying to access that domain would be blocked, which is a critical feature even when off the network.

The biggest frustration I have encountered with Cisco Umbrella is that people can exit the Cisco Umbrella roaming client to bypass security, and some technically savvy individuals might know how to bypass it by modifying the hosts file to exclude Cisco Umbrella.

If I could change one thing about Cisco Umbrella, it would be to include traffic for DNS resolution even on IP addresses for extra protection and to enhance the analysis capabilities, considering the advancements in AI.

During implementation, there were not really any features that we are not using today, but SSL inspection was something we never enabled due to requiring extensive approval and legality considerations.

I have been familiar with Cisco Umbrella for almost one year.

Before adopting Cisco Umbrella, we did not have any tool and only used the firewall as a prevention tool, mostly relying on next-generation antivirus focused on behavioral analytics.

In terms of implementation, Cisco Umbrella is more of a SaaS tool, and configuring in the SaaS tool on the cloud is simple and quick; however, to protect the endpoints, deploying the clients on the endpoints is time-consuming. Configuring policies and downloading the client is easy, perhaps a one or two day task, but deploying the clients to all the endpoints definitely takes more time.

When evaluating options, I was not involved in the POC of Cisco Umbrella; I was a part of the engineering team that deployed it.

My team did need a small interaction with team members to explain the use cases implemented in Cisco Umbrella, which was important, and the knowledge base articles available on the Cisco website were good and useful to have handy.

My advice for someone considering Cisco Umbrella, based on my experience over the past year, is to understand your clear business requirements, check all the required features, and note that Cisco Umbrella provides good DNS security, though there are other competitive tools, such as Zscaler, which address the challenges I noticed in Cisco Umbrella. Based on your requirements and budget, analyze the tool during the POC and finalize your choice. I would rate my overall experience with Cisco Umbrella as a seven out of ten.