Cisco Umbrella DNS-layer Security

Cisco Umbrella DNS-layer Security is a cloud-delivered threat defense capability that uses recursive DNS resolution to block malicious internet destinations, command-and-control callbacks, phishing schemes, and ransomware before internet connections are established. Because DNS is the fundamental starting point of virtually all internet communications, inspecting and resolving DNS requests in the cloud provides an efficient, lightweight first layer of cyber protection for devices on and off corporate networks.

The service operates over Cisco's globally distributed Anycast cloud network, ensuring low-latency resolution and high availability across the globe. Security policies are enforced at the DNS layer regardless of protocol, port, or whether network traffic is plain-text or encrypted with SSL/TLS. Cisco Umbrella DNS-layer Security incorporates real-time threat telemetry from Cisco Talos, evaluating domain reputation, newly registered domains, algorithmic domain generation, and malicious IP associations to block threats preemptively. Deployment requires only redirecting an organization's recursive DNS traffic to Cisco Umbrella IP addresses or deploying the lightweight Cisco Secure Client roaming module on remote endpoints. The platform integrates with Active Directory, Cisco Meraki, Cisco SD-WAN, and enterprise SIEM tools.

Primary enterprise use cases include proactive malware and phishing blocking, command-and-control callback prevention, acceptable internet use policy enforcement, and endpoint protection for off-network remote workers. By stopping threats at the earliest stage of cyber attacks, Cisco Umbrella DNS-layer Security reduces incident volume for downstream security controls.