Overview

As the rapid growth of Secure Access Service Edge (SASE) solutions shows, the center of gravity for enterprise IT has shifted to the cloud, and organizations increasingly expect cybersecurity services to 1) be delivered via the cloud, and 2) to protect all the assets and processes they have moved there. Meeting this expectation requires shifting much of the security intelligence and related safeguards that used to be on-premise to the cloud. To support this transition, cloud providers and cybersecurity vendors are increasingly embedding Enea’s traffic intelligence engine – the Enea Qosmos ixEngine® – in their cloud products.

For example, Enea Qosmos ixEngine is being integrated into Cloud Firewalls to endow them with the application awareness and traffic insights they need to perform security functions typically associated with enterprise Next Generation Firewalls (NGFW). As another example, Enea Qosmos ixEngine is increasingly being integrated with cloud instances of Intrusion Detection and Prevention Systems (IDS/IPS) like Suricata.

In current Suricata cloud deployments, integration with Enea Qosmos ixEngine enables 1) the rapid development of whitelists and blacklists that leverage Enea Qosmos ixEngine’s expanded protocol coverage (particularly for cloud, SaaS, IoT and OT applications and protocols plus custom and legacy applications), 2) an improved ability to detect anomalous and evasive cloud traffic, 3) visibility into encrypted environments without having to use a proxy for decryption, and 4) high-value contextual metadata to aid threat analysis and forensics (while simultaneously reducing the need for full packet capture). Finally, Enea’s traffic intelligence technology supports cloud infrastructure security through the availability of a Cloud Native Function (CNF) format for its Qosmos ixEngine (SDK in C) and its Qosmos Probe (Qosmos ixEngine inside a standalone Linux application).