Cisco Cloudcenter and UCS Director

Cisco Cloudcenter and UCS Director

Industry	Cloud computing, Web services
Founder(s)	Sandy Lerner, Leonard Bosack
Headquarters	San Jose, California, United States
Area served	Worldwide
Key people	Chuck Robbins (CEO)
Products	SaaS
Revenue	$12.2 billion (2020, Q4)
Website	CloudCenter and USC Director

Cisco Cloudcenter and UCS Director are hybrid and multicloud software solutions provided by Ciscos Systems, Inc., a multinational technology conglomerate. While not providing public cloud services, Cisco acts as the "Switzerland of the cloud" by providing management, security, analytics, and advanced networking cloud solutions and services. Cisco CloudCenter and UCS Director are representative of that approach.

Cisco describes Cisco CloudCenter as a "software solution [that] helps you modernize and automate your data center or add public cloud application deployment to your service offering." USC Director is described as "a heterogeneous platform for private cloud infrastructure as a service (IaaS) ... [that] supports a variety of hypervisors along with Cisco and third-party servers, network, storage, converged and hyperconverged infrastructure across bare-metal and virtualized environments." These solutions support the Alibaba, Amazon, Google, IBM, Microsoft, and (presumably, with the acquisition of VMware vCloud Air) OVHcloud public clouds.

Provider research

This section uses public information to provide some answers to the 18 questions posed in Chapter 5 of the wiki-based guide Choosing and Implementing a Cloud-based Service for your Laboratory. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made. Additionally, as a provider of cloud-based software solutions for hybrid and multicloud management, some of the questions from Chapter 5 may not be relevant, as they are not providing public cloud services but software as a service (SaaS) (or local installs) of cloud management software.

1. What experience do you have working with laboratory customers in our specific industry?

It's not clear what laboratories, if any, have adopted Cisco CloudCenter or UCS Director. A Cisco representative is likely to be able to supply examples of laboratories that use or have used these SaaS cloud options.

2. Can your solution readily integrate with our other systems and business processes, making it easier for our end users to perform their tasks?

Per Cisco's CloudCenter Suite architecture document, "Cisco CloudCenter is built to integrate with and extend a wide range of other data center and cloud management platforms and tools that are found in the typical IT enterprise." The document then goes on to discuss content integration, platform integration, tool integration, and cloud integration; read the white paper to learn more. As for UCS Director, it acts as a tool to operationally integrate the bare-metal and virtual data center infrastructure stack to address complex, time-consuming, manual, and compartmentalized management processes." These tools' inherent purposes are to help integrate your on-premises with public and private cloud offerings.

3. What is the average total historical downtime for the service(s) we're interested in?

There doesn't appear to be an uptime status tracker for CloudCenter and UCS Director. According to Cisco's trust center document for CloudCenter, they used to have an uptime status page at http://status.cloudcenter.cisco.com/, but that URL does not function as of April 2021. You'll have to ask a Cisco representative about historical downtime data for these solutions.

4. Do we receive comprehensive downtime support in the case of downtime?

It's not clear if there are support tiers or plans for CloudCenter and UCS Director. You'll have to discuss support plans and provided support during downtime with a Cisco representative.

5. Where are your servers located, and how is data securely transferred to and from those servers?

The Cisco CloudCenter Suite Privacy Data Sheet indicates "datacenters are currently located in the following countries: United States, Germany, and Ireland." They add that "customer information is stored in the data center closest to the Customer's location as provided during the ordering process." You'll have to discuss this with a Cisco representative. Cisco documentation does add a little insight into secure data transfers using its solutions. The CloudCenter architecture document notes that CloudCenter "encrypts data at rest and in motion and offers a range of critical management, authentication, and authorization features that don’t just secure the Cisco CloudCenter solution, but also the clouds to which it connects." Other security measures include SAML 2.0 support, LDAP and Active Directory support, randomly generated REST API keys, and more. It's not clear what data transfer security measures are in place for UCS Director. Consult with a Cisco representative to learn more.

6. Who will have access to our data (including subcontractors), and what credentials, certifications, and compliance training do they have?

It's not fully clear what personnel protocols Cisco follows for its SaaS solutions. However, the trust center document for CloudCenter notes that "[a]ll employees are required to undergo annual security training and must comply with Cisco’s Global Personal Data Protection and Privacy Policy and binding corporate rules." They add, in regards to third-parties, that "our team performs due diligence reviews of each third party's information security program, privacy practices, confidentiality commitments and puts appropriate contractual terms in place to ensure that the processing will meet the high standards required by our team, and applicable laws." Cisco's brochure on the product life cycle at Cisco may also prove useful. For more about this topic, discuss it with a Cisco representative.

7. Will our sensitive and regulated data be stored on a machine dedicated to complying with the necessary regulations?

Cisco doesn't clearly state what compliance standards are in place for those servers in the U.S., Germany, and Ireland. You'll have to have a discussion about this with a Cisco representative.

8. How segregated is our cloud data from another customer's, i.e., will lapses of security of another customer's cloud affect our cloud? (It typically won't, but asking the question will hopefully prompt the provider to better explain how your data is segregated.)

In a 2016 white paper, Cisco describes in-depth the concept of multitenancy and tenant isolation in regards to CloudCenter. However, it's not clear if there is a bare-metal option for users of CloudCenter or UCS Director. You'll have to have a discussion with a representative to learn more about their SaaS servers, etc.

9. Do you have documented data security policies?

Cisco documents its security practices regarding CloudCenter in several places:

• Cisco CloudCenter trust center document
• Cisco CloudCenter architecture document
• Cisco CloudCenter Suite Privacy Data Sheet
• Cisco secure development lifecycle document
• Cisco Transparency Service Center FAQ

Security documentation concerning UCS Director could not be found. Discuss this with a Cisco representative.

10. How do you test your platform's security?

Cisco tests its systems in multiple ways, as stated in its secure development document:

• "When modeling threats, Cisco engineers follow the flow of data through a system and identify trust boundaries and inflection points where the data might be compromised. Once potential vulnerabilities and threats are identified, mitigation strategies can be put in place to minimize the risk. Cisco’s Threat Modeling tool facilitates the process by exposing applicable threats based on the developers’ diagram of the data flow and trust boundaries."
• "Cisco SDL identifies key security checkers for Static Analysis (SA) tools to detect source code vulnerabilities in both C and Java source code. Through internal analysis, field trials, and limited business unit deployments, a set of checkers has been identified to maximize detection of security issues."
• Cisco uses vulnerability testing methods "to determine their ability to withstand probes and attacks." They also have "[d]edicated penetration testing and security risk assessment engineers ... available to further identify and resolve potential security weaknesses."

Additionally, Cisco customers are able to "access, review, and test Cisco source code and other intellectual property—including hardware, software and firmware—in a dedicated, secure facility at a Cisco site," via its Transparency Service Center.

11. What are your policies for security audits, intrusion detection, and intrusion reporting?

In their trust document for CloudCenter, Cisco states: "We are targeting ISO 27001 certification in early 2020, having undergone audits with minimal findings in calendar year 2019. We are evaluating SOC2 as a potential roadmap item." You'll have to discuss where their security auditing of their solutions stands in 2021. As for intrusion detection, that same document adds:

Our security operations team is responsible for continuously monitoring the day-to-day security of the SaaS solution. From endpoints to networks, crossfunctional teams are continuously observing the operational environments for anomalous events, behaviors, and malware. As threats emerge, the focus shifts to investigating suspicious alerts, events, and incidents. We are vigilant about keeping your data and systems secure.

12. What data logging information is kept and acted upon in relation to our data?

Cisco states in its trust document for CloudCenter that "[o]ur Cloud Operations and TAC teams have access to SaaS infrastructure and application log data. We provide limited assistance with audit requests." The Cisco CloudCenter Suite Privacy Data Sheet also indicates that its "configuration logs and Support Information are stored in the U.S. region." However, it's not clear how they act upon this log data. Discuss this with a Cisco representative.

13. How thorough are those logs and can we audit them on-demand?

It's not clear how thorough the logs are. Cisco will presumably let you audit those logs, but you'll have to verify this with a representative.

14. For HIPAA-eligible data (e-PHI) we may have, will you sign a business associate agreement?

As Cisco is providing cloud management solutions via SaaS, your sensitive data should not, in theory, be exposed to their solutions. That said, Cisco does provide an older 2014 guide with "insight into the Cisco enterprise architecture and the controls used to address HIPAA Security Rule technical safeguards." However, it's not clear if a business associate agreement is required if HIPAA-eligible data doesn't touch their solution.

15. What happens to our data should the contract expire or be terminated?

The Cisco Universal Cloud Services Agreement states:

If this Agreement is terminated for any reason:

a. Cisco will make your stored Content available to you for a reasonable period of time (subject to the AUP);

b. You will pay the fees for the SaaS provided up to the effective date of termination.

It's not clear what "a reasonable period of time" is. Consult with a Cisco representative to learn more.

16. What happens to our data should you go out of business or suffer a catastrophic event?

It's not publicly clear how Cisco would handle your data should they go out of business; consult with a representative about this topic. As for catastrophic events, in its Cisco CloudCenter Suite Privacy Data Sheet, the company notes "[i]f disaster recovery is needed, Customer information is restored within the region" in regards to its designated data center locations. Little else is said, and more clarification may be required of a representative.

17. Can we use your interface to extract our data when we want, and in what format will it be?

It's not clear how and when information can be extracted from either SaaS-based Cisco solution. Discuss this with a representative.

18. Are your support services native or outsourced/offshored?

It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with a Cisco representative.

Managed security services

Customers of Cisco Cloudcenter and UCS Director may also want to consider the managed security services (MSS) provided by Cisco. Those services appear to primarily be offered by its Active Threat Analytics team, which is advertised as combining "people, intelligence, analysis, and technology to provide you with end-to-end security monitoring, threat detection, and incident response." The primary services touted are managed detection and response, active threat analytics, and related incident response. This includes:

• Managed detection and response: cloud monitoring; threat intelligence analysis; data-driven investigation; and security orchestration, automation, and response (SOAR)-based incident response
• Active threat analytics: policy management, device monitoring, architecture management, incident analysis, device support, and detailed reporting

Cisco is listed in the top 30 of managed security service provider lists for multiple entitites.

Additional information

Documentation and other media

• Cisco development and auditing practices
• Cisco CloudCenter Suite at a glance
• Cisco CloudCenter Suite architecture overview
• Cisco CloudCenter Suite multitenancy white paper
• Cisco CloudCenter Suite trust document
• Cisco UCS Director at a glance
• Cisco UCS Director administration guide

External links

• Cisco trust center