Cisco Web Security Appliance S190
Simple Installation, Easy Management, and Powerful Protection for Your Web Infrastructure.

Overview:

In a highly connected and increasingly mobile world with more complex and sophisticated threats, only Cisco delivers the strong protection, complete control, and investment value businesses need. Cisco offers the broadest set of web security deployment options in the industry, combined with market-leading global threat intelligence. The Cisco® Web Security Appliance simplifies security with a high-performance, dedicated appliance, and the Cisco Web Security Virtual Appliance enables businesses to deploy web security wherever and whenever it’s needed.

The Cisco Web Security Appliance (WSA) is the first secure web gateway to combine advanced malware protection, application visibility and control, acceptable use policy controls, insightful reporting, and secure mobility on a single platform, helping organizations address the growing challenges of securing and controlling web traffic.

The Cisco WSA enables simpler, faster deployment with fewer maintenance requirements, reduced latency, and lower operating costs. “Set and forget” technology frees up staff once initial automated policy settings go live, and automatic security updates are pushed to network devices every three to five minutes. Flexible deployment options and integration with the existing security infrastructure help customers meet demanding business needs.

In addition to the security risks introduced by malware and spyware, Web traffic also exposes an organization to compliance and productivity risks introduced by inappropriate Internet usage. The Cisco IronPort S190 Web security appliance combines acceptable use policy controls, reputation filtering, malware filtering and data security on a single platform to address these risks.

A single, highly-secure Cisco IronPort S190 can typically replace three comparable appliances from competing vendors. This consolidation reduces the operational costs (power, rack space, etc.) and supports green data center initiatives – all while increasing ROI and efficiency.

Extending security to the branch office should be an integral part of any Web security strategy. Branch networks have become a source of many potential security vulnerabilities, yet limited protection resources have existed at the branch level. Understanding branch office risks and security requirements is critical to building an overall Web security strategy. With the Cisco IronPort S190, Cisco extends the full capabilities of its powerful, secure Web gateway (including all of its innovative security technologies) to remote and branch offices.

Cisco provides a manageable, and intelligent Web security architecture for protecting branch offices, enabling you to do business effectively and safely.

Advanced Threat Defense

The Cisco WSA is powered by Cisco Security Intelligence Operations (SIO), our industry-leading threat intelligence organization. Cisco SIO detects and correlates threats in real time using the largest threat detection network in the world. It monitors 100 TB of daily security intelligence, 1.6 million deployed security devices, 13 billion daily web requests, and 35 percent of worldwide email traffic.

The Cisco WSA uses multiple layers of anti-malware technologies and intelligence from SIO updated every three to five minutes. It protects against hidden threats by analyzing every piece of web content accessed by the user, from HTML to images and Flash graphics.

Advanced Malware Protection

The Cisco WSA now includes Advanced Malware Protection (AMP), a malware-defeating solution that takes advantage of Cisco SIO and the vast cloud security intelligence network of Sourcefire (now a part of Cisco).

It delivers protection across the attack continuum—before, during, and after an attack—with malware detection and blocking, continuous analysis, and retrospective alerting. Users can block more attacks, track suspicious files, mitigate the scope of an outbreak, and remediate faster.

Protection across the Attack Continuum

Granular Acceptable Use Controls

Our WSA gives businesses complete control over how end users access the Internet. By identifying hundreds of applications and more than 150,000 micro-applications, the WSA helps administrators create policies that match the nuanced business needs of today. Specific features such as chat, messaging, video, and audio can be allowed or blocked, according to the requirements of businesses and users—without the need to block entire websites.

Vital Data Loss Prevention (DLP)

Using onboard DLP capabilities, administrators can create content control rules based on context. The Cisco WSA also integrates, using Internet Content Adaptation Protocol (ICAP), with DLP solutions from leading vendors. This helps to ensure consistent enforcement of DLP policies and deep content analysis.

Flexible Deployment

Cisco currently delivers the broadest set of web security deployment options in the industry. The Cisco WSA simplifies security with a high-performance, dedicated appliance. The Cisco Web Security Virtual Appliance (WSAV) helps businesses deploy web security wherever and whenever it's needed.

The WSAV offers all the same features as the WSA, with the added convenience and cost savings of a virtual deployment model. That includes instant self-service provisioning.

Features and Benefits:

Talos Security Intelligence

Receive fast and comprehensive web protection backed by the largest threat detection network in the world, with the broadest visibility and largest footprint, including:

• 100 TB of security intelligence daily
• 1.6 million deployed security devices, including firewall, IPS, web, and email appliances
• 150 million endpoints
• 13 billion web requests per day
• 35% of the world’s enterprise email traffic

Providing a 24x7 view into global traffic activity to analyze anomalies, uncover new threats, and monitor traffic trends. Talos prevents zero-hour attacks by continually generating new rules that feed updates to the WSA every three to five minutes, enabling industry-leading threat defense hours and even days ahead of competitors.

Secure Web Appliance Usage Controls

Combine traditional URL filtering with dynamic content analysis to mitigate compliance, liability, and productivity risks. Cisco’s continuously updated URL filtering database of over 50 million blocked sites provides exceptional coverage for known websites, and the Dynamic Content Analysis (DCA) engine accurately identifies 90 percent of unknown URLs in real time; it scans text, scores the text for relevancy, calculates model document proximity, and returns the closest category match. Administrators can also select specific categories for intelligent HTTPS inspection.

Advanced Malware Protection

Advanced Malware Protection (AMP) is an additionally licensed feature available to all Cisco WSA customers. AMP is a comprehensive malware-defeating solution that enables malware detection and blocking, continuous analysis, and retrospective alerting. It takes advantage of the vast cloud security intelligence networks of both Cisco and Sourcefire® technology. AMP augments the malware detection and blocking capabilities already offered in the Cisco WSA with enhanced file reputation capabilities, detailed file-behavior reporting, continuous file analysis, and retrospective verdict alerting. The Cisco AMP Threat Grid delivers malware protection through an on-premises appliance for organizations that have compliance or policy restrictions on submitting malware samples to the cloud. The Layer 4 Traffic Monitor continuously scans activity, detecting and blocking spyware ”phone-home” communications. By tracking all network applications, the Layer 4 Traffic Monitor effectively stops malware that attempts to bypass classic web security solutions. It dynamically adds IP addresses of known malware domains to its list of malicious entities to block.

Cognitive Threat Analytics

Cisco Cognitive Threat Analytics is a cloud-based solution that reduces time to discovery of threats operating inside the network. It addresses gaps in perimeter-based defenses by identifying the symptoms of a malware infection or data breach using behavioral analysis and anomaly detection. Take advantage of Cisco Cognitive Threat Analytics with a simple add-on license to your Web Security solution. Reduce complexity while gaining superior protection that evolves with your changing threat landscape.

Application Visibility and Control (AVC)

Easily control the use of hundreds of Web 2.0 applications and 150,000+ micro-applications. Granular policy control allows administrators to permit the use of applications such as Dropbox or Facebook while blocking users from activities such as uploading documents or clicking the ”Like” button. The WSA supports visibility of activity across an entire network. New: Customers can deploy customized bandwidth and time quotas per user, per group, and per policy.

Data Loss Prevention (DLP)

Prevent confidential data from leaving the network by creating context-based rules for basic DLP. The Cisco WSA also uses Internet Content Adaptation Protocol (ICAP) to integrate with third-party DLP solutions for deep content inspection and enforcement of DLP policies. The Cisco WSA also supports Secure ICAP to encrypt the traffic exchanged between WSA and third-party DLP solutions.

Remote Browser Isolation (RBI)

By isolating web traffic from the user device and the threat, the Secure Web Appliance RBI delivers an extra layer of protection to the Secure Web Appliance so that users can safely access risky websites without the risk of malware infections. With RBI, the Secure Web Appliance isolates web content in a remote surrogate browser in the cloud, separate from the endpoint and the corporate network, and renders it safely to the end user providing a seamless end user experience.

Roaming-User Protection

The Secure Web Appliance protects roaming users by integrating with the Cisco Secure Client (including AnyConnect), which provides Secure Web Appliance to remote clients by initiating a VPN tunnel that redirects traffic back to the on-premises solution. Cisco Secure Client (including AnyConnect) technology analyzes traffic in real time prior to permitting access.

The Secure Web Appliance is also integrated with Cisco Identity Services Engine (ISE). With this exciting enhancement, customers can now take advantage of the power of Cisco ISE for Secure Web Appliance upon request. Cisco ISE integration allows admins to create policy on the Secure Web Appliance based on profile or membership information gathered by Cisco ISE through its single sign-on process.

Centralized Management and Reporting

Receive actionable insights across threats, data, and applications. The Secure Web Appliance provides an easy-to-use, centralized management tool to control operations, manage policies, and view reports.

The Cisco M-Series Content Security Management Appliance provides central management and reporting across multiple appliances and multiple locations, including virtual instances.

Cisco Advanced Secure Web Appliance Reporting is a reporting solution that rapidly indexes and analyzes logs produced by Secure Web Appliance and Cisco Umbrella. This tool provides scalable reporting for customers with high traffic and storage needs. It allows reporting administrators to gather detailed insight into web usage and malware threats.

 

Specifications:

Chassis / Processor
Form Factor	1RU
Dimensions	1.7" x 19" x 31"
Power Supply	345W, 100/240V
Redundant Power Supply	Yes, Accessory Option
Processor, Memory, and Disks
CPUs	1 x 1.9 Ghz, 6C
Memory	8 GB, DDR4
Disk Space	1.2TB (2x600 GB SAS)
Hot Swappable Hard Drives	Yes
RAID	RAID 1, software 256MB cache
Interfaces
Ethernet	2 port 1G Base-T copper network interface (NICs), RJ - 45
Serial	1xRS-232 (DB-9) Serial
Fiber	No
Configuration, Logging, and Monitoring
Web Interface	GUI-based (HTTP or HTTPS)
Command Line Interface	SSH or Telnet (Configuration Wizard or command-based)
Logging	Squid, Apache, syslog
Centralized Reporting	Supported
File Transfer	SCP, FTP
Configuration Files	XML-based
Centralized Configuration	Supported
Monitoring	SNMPv1-3, e-mail alerts

Deployment:

The Cisco WSA is a forward proxy that can be deployed in either Explicit mode (proxy automatic configuration [PAC] files, Web Proxy Auto-Discovery [WPAD], browser settings) or Transparent mode (Web Cache Communication Protocol [WCCP], policy-based routing [PBR], load balancers). WCCP-compatible devices, such as Cisco Catalyst 6000 Series Switches, Cisco ASR 1000 Series Aggregation Services Routers, Cisco Integrated Services Routers, and Cisco ASA 5500-X Series Next-Generation Firewalls, reroute web traffic to the WSA.

The WSA can proxy HTTP, HTTPs, SOCKS, native FTP, and FTP over HTTP traffic to deliver additional capabilities such as data loss prevention, mobile user security, and advanced visibility and control.

All-in-One Solution - Simplifies Deployment

Simplify web security deployment by aggregating several web security features in a single appliance. With its simplified architecture, the WSA reduces IT costs by having fewer devices to manage, support, and maintain.

All-in-One Solution

Licenses:

A Cisco WSAV license is included in all Cisco Web Security software bundles (Cisco Web Security Essentials, Cisco Web Security Antimalware, and Cisco Web Security Premium). This license has the same term as the other software services in the bundle and can be used for as many virtual machines as needed.

Term-Based Subscription Licenses

Licenses are term-based subscriptions of one, three, or five years.

Quantity-Based Subscription Licenses

The Cisco Web Security portfolio uses tiered pricing based on a range of users, not devices. Sales and partner representatives can help to determine the correct sizing for each customer deployment.

Web Security Software Licenses

Four web security software licenses are available: Cisco Web Security Essentials, Cisco Anti-Malware, Cisco Web Security Premium, and McAfee Anti-Malware. The major components of each software offering follow:

Cisco Web Appliance Essentials

• Threat Intelligence via Cisco Talos
• Layer 4 traffic monitoring
• Application Visibility and Control (AVC)
• Policy management
• Actionable reporting
• URL filtering
• Third-party DLP integration via ICAP

Secure Web Appliance Advantage

• Secure Web Appliance Essentials
• Real-time malware scanning

Cisco Web Appliance Premier

• Secure Web Appliance Advantage
• Advanced malware protection
• Cognitive threat analytics
• Threat Grid file analysis

Advanced Malware Protection

• AMP augments anti-malware detection and blocking capabilities with file reputation scoring and blocking, static and dynamic file analysis (sandboxing), and file retrospection for continuous analysis of threats.

Cognitive Threat Analytics

• CTA relies on advanced statistical modeling and machine learning to independently identify new threats, learn from what it sees, and adapt over time.

McAfee Anti-Malware

• McAfee real-time malware scanning is available as a single, a-la-carte license.

Software License Agreements

The Cisco End-User License Agreement (EULA) and the Cisco Web Security Supplemental End-User License Agreement (SEULA) are provided with each software license purchase.

Software Subscription Support

All Cisco Web Security licenses include software subscription support essential to keeping business-critical applications available, secure, and operating at peak performance. This support entitles customers to the following services for the full term of the purchased software subscription:

• Software updates and major upgrades to keep applications performing optimally at the most current feature set
• Access to Cisco Technical Assistance Center (TAC) for fast, specialized support
• Online tools to build and expand in-house expertise and boost business agility
• Collaborative learning for additional knowledge and training opportunities

Documentation:

Download the Cisco Web Security Appliance Data Sheet (PDF).