Visibility and Application Control

Visibility and application control are two sides of the same coin in modern network security. Without visibility, you are flying blind. Without control, you cannot enforce your security policy even if you know what is happening. Let’s break both down from the ground up.

First, what do we mean by visibility? In an IT context, visibility means the ability to see exactly what kind of traffic is crossing your network at any given moment. This includes knowing which devices are talking to each other, which applications they are using, and how much bandwidth those applications are consuming. For a beginner, think of it like the dashboard in a car: you can see your speed, fuel level, and engine temperature. If a warning light comes on, you know something needs attention. Network visibility tools provide the same kind of dashboard for your data traffic.

The traditional tool for achieving visibility is NetFlow, which is a protocol developed by Cisco. NetFlow collects metadata about network traffic. Metadata is data about data — it does not capture the actual contents of a message, but it records who sent it, who received it, when it happened, how much data was sent, and which protocol was used. A protocol is a set of rules that allows two devices to communicate; the most common example is TCP (Transmission Control Protocol), which reliably delivers data in the correct order. NetFlow summarises these flows into a report that a security analyst can review to spot anomalies, like a sudden spike in traffic to an unknown server.

A more advanced version called IPFIX (IP Flow Information Export) is an industry standard that builds on NetFlow but allows for more flexible data collection. Both NetFlow and IPFIX give you raw traffic data, but they do not automatically tell you which application generated the traffic. That is where Network-Based Application Recognition (NBAR) comes in. NBAR is a Cisco technology that inspects packets at a deeper level to identify the specific application, even if the application tries to hide by using a non-standard port. For example, a game or a torrent client might run on port 80 (normally used for web browsing) to bypass firewalls. NBAR looks at the actual payload — the data inside the packet — to determine that it is really a game, not a webpage. This is called deep packet inspection (DPI).

Now, why does this matter for the 350-701 exam? Because the exam wants you to understand that visibility alone is useless if you cannot act on what you see. Application control is the follow-through. Once your visibility tools have identified an application, your security policy can decide whether to allow it, block it, or limit its bandwidth. Cisco’s Next-Generation Firewall (NGFW) and the Firepower Threat Defence (FTD) system are the main platforms that combine visibility and control. They use a feature called Application Visibility and Control (AVC) to do this. AVC uses NBAR to recognise the application and then applies a rule (like a Quality of Service policy) to shape the traffic. Quality of Service (QoS) is the practise of prioritising certain types of traffic — for instance, giving video conferencing more bandwidth than file downloads to prevent choppy calls.

The exam also covers Cisco Stealthwatch, which uses NetFlow to build a baseline of normal network behaviour. Once the baseline is established, Stealthwatch applies machine learning algorithms to detect behaviour that deviates from the norm, such as a device sending data to a known malicious IP address. This is called behavioural analysis. The combination of signature-based detection (looking for known malware patterns) and behavioural analysis (looking for unusual activity) is the backbone of modern traffic analysis.

Finally, there is the concept of encrypted traffic analysis. Because so much modern traffic is encrypted with TLS (Transport Layer Security), traditional DPI cannot see the payload. Cisco’s Encrypted Traffic Analytics (ETA) uses machine learning to analyse the patterns of encrypted flows — like the size and timing of packets — to classify applications without decrypting them. This is a critical skill for the exam because encryption is becoming more common, and the best answer on the test will often involve recognising that you cannot block all encrypted traffic, but you can use ETA to profile it.

To summarise, the core workflow is: collect traffic metadata (NetFlow/IPFIX), identify applications (NBAR/DPI), apply controls (AVC/QoS), and analyse behaviour (Stealthwatch/ETA). Every exam question about visibility or application control will map to one of these steps or the tools that support them.

Let’s place this in a realistic business scenario. You work as a junior security analyst at a mid-sized insurance company called SecureCover Ltd. The network team has just deployed a Cisco Firepower 2100 Series NGFW at the internet edge. The Chief Information Security Officer (CISO) has received complaints from employees that the network is slow during lunch hours. The CISO also wants to ensure that no unauthorised file-sharing applications are exfiltrating customer data.

Step 1: You log into the Firepower Management Center (FMC), which is the central management console for all your security devices. You navigate to the traffic analysis dashboard and enable NetFlow export from the NGFW to the FMC’s built-in NetFlow collector. Within minutes, the dashboard shows you a live list of all the conversations happening across your network. You see that a large volume of traffic is flowing from employee laptops to a server IP that resolves to a known video-streaming domain.

Step 2: You drill down into that traffic using Application Visibility and Control (AVC). The dashboard uses NBAR to inspect the packets and tells you that the application is not standard web browsing but a specific peer-to-peer streaming service called StreamP2P. Even though the traffic is using the standard HTTPS port (443), NBAR’s deep packet inspection identified the unique handshake signature of StreamP2P. You now have visibility.

Step 3: You need control. You create an access control policy in the FMC that specifically blocks all traffic matching the StreamP2P application signature. You configure the rule to generate an alert every time a user tries to connect. Within 30 minutes, the alerts show that several employees were attempting to use the blocked service, and the network load during peak hours drops by 40%.

Step 4: The CISO asks about encrypted traffic. You deploy Cisco Stealthwatch and enable Encrypted Traffic Analytics (ETA). After one week of baseline learning, Stealthwatch flags a workstation that is sending small, regular encrypted packets to an IP in a foreign country at 3:00 AM every night. The packet sizes and timing patterns match known command-and-control (C2) behaviour for a malware variant. You report this to the incident response team, who isolate the workstation and find a hidden backdoor.

Step 5: You document this entire process for your organisation’s security playbook. The CISO presents your work to the board, demonstrating that the company now has real-time visibility into its network traffic and the ability to control risky applications. For the 350-701 exam, you would need to know that the tool you used for step 2 was NBAR, the policy engine was the FMC’s access control policy, and the encrypted traffic analysis was powered by ETA inside Stealthwatch.