Cloud Security Technologies (Cisco Umbrella, CloudLock)

Cisco Umbrella and Cisco CloudLock are two distinct products within Cisco’s security portfolio. They address different parts of the security puzzle, but together they form a powerful layer of protection for organisations that use cloud services. To understand them, you first need to know a few basic terms.

DNS stands for Domain Name System. Think of it as the internet’s phonebook. When you type a website name like ‘www.example.com’ into your browser, your computer asks a DNS server to translate that name into a numeric IP address, such as ‘192.0.2.1’, which is the actual location of the website’s server. Every single internet request starts with a DNS lookup. Cisco Umbrella leverages this by standing between your computer and the internet at the DNS layer. It does not wait for you to download a malicious file or click a bad link. Instead, it checks the DNS request against Cisco Talos’s threat intelligence database. Talos is one of the largest threat intelligence teams in the world; they collect data on millions of malicious domains, IP addresses, and phishing sites every day. If the domain you are trying to visit is known to host malware or is a phishing site, Umbrella simply returns a blocked page and logs the event. This is called DNS-layer security. The advantage is that it works regardless of what device you are using or where you are located, as long as you are connected to the internet through an Umbrella-protected connection. It also includes a feature called intelligent proxy, which can inspect web traffic for malicious content in real time.

Cisco CloudLock, on the other hand, is a Cloud Access Security Broker, or CASB. A CASB is a piece of software that sits between your organisation’s users and the cloud applications they use, such as Google Workspace, Microsoft 365, Salesforce, Box, and Dropbox. Its job is to enforce security policies on data that is already in the cloud. CloudLock uses a technology called API integration. Instead of intercepting traffic as it flows, CloudLock connects directly to the cloud application through its API (Application Programming Interface). An API is a set of rules that allows one piece of software to talk to another. This connection happens in near real-time. Once connected, CloudLock can scan all files, folders, and sharing permissions. It looks for three main types of risk:

CloudLock can automatically apply actions like quarantining a file, removing a public share link, or requiring user re-authentication. It also provides detailed reports for compliance, such as demonstrating where sensitive data is stored and who has access to it. This is crucial for regulations like GDPR or HIPAA, which require organisations to protect personal data.

Why do you need both? DNS-layer security stops many threats before they even start, but it cannot see inside encrypted traffic or protect data that is already in the cloud. A CASB like CloudLock fills that gap by monitoring the cloud application itself. Together, they provide a layered security approach. For the 350-701 exam, you need to know the specific capabilities of each product, how they are deployed, and the problems they solve.

A mid-sized company called ‘GreenTech Innovations’ has 500 employees who work remotely. They use Microsoft 365 for email and document collaboration, Salesforce for customer management, and Zoom for meetings. Their IT team is small, with only two people. They need to protect their data without adding complexity.

Here is what an IT professional at GreenTech would actually do with Cisco Umbrella and CloudLock.

First, they deploy Cisco Umbrella. They install a small piece of software called a roaming client on every employee’s laptop. This client directs all DNS requests from that laptop to Umbrella’s servers, even when the employee is working from a coffee shop. The IT team logs into Umbrella’s dashboard and creates policies. For example, they block all categories like ‘malware’, ‘phishing’, and ‘newly registered domains’ (which are often used for attacks). They also allow ‘social networking’ but limit it to two hours per day. The IT person can see a live dashboard showing which employees are trying to access blocked sites. One morning, an employee clicks a link in a phishing email that leads to a newly registered malicious domain. Umbrella blocks the request before any data is sent. The IT team gets an alert and investigates. That is the front-door protection.

Next, they deploy Cisco CloudLock. The IT professional goes into the CloudLock admin console and connects it to Microsoft 365 and Salesforce using API integrations. This is a one-time setup that takes about 30 minutes per application. Once connected, CloudLock immediately scans all existing files. It discovers that a spreadsheet in Microsoft 365 containing employee tax information has been accidentally shared with the entire company. CloudLock automatically removes the public link and sends an alert. The IT person then creates a policy to detect any file containing the pattern of a social security number (like ‘###-##-####’) and automatically quarantine it. A week later, CloudLock detects that a sales representative has logged in from a country where the company has no business. This is a sign of a compromised account. CloudLock forces the user to re-authenticate with multi-factor authentication and notifies the IT team. The IT pro then investigates and finds the user’s password was stolen in a phishing attack. They reset the password and notify the employee.

Finally, the IT professional uses CloudLock’s reporting to prepare for an audit. They generate a compliance report showing where all sensitive data is stored, who has access, and which policies were triggered over the last quarter. This report satisfies the auditor’s requirements in minutes instead of days. The combination of Umbrella blocking threats at the DNS layer and CloudLock monitoring cloud data means GreenTech’s IT team of two can effectively protect 500 remote employees.