The vendor presents AWS Control Tower as the easiest way to set up and govern a new, secure multi-account AWS environment. With AWS Control Tower, builders can provision new AWS accounts in a few clicks, while knowing new accounts conform to company-wide policies.
N/A
Cisco Multicloud Defense
Score 8.5 out of 10
N/A
A solution to simplify security and gain multidirectional protection across any public or private cloud to block inbound attacks, lateral movement, and data exfiltration using a single solution. Cisco Multicloud Defense protects all cloud environments using a single software-as-a-service (SaaS) control plane, eliminating inefficient, complex, and costly point solutions.
We were wanting to prove the concept of a low touch process for quickly spinning up boilerplate AWS environments. We were able to get started quickly and to ensure that the AWS Well-Architected Framework principles were followed - at least upfront - however, we found that for our use case and expertise level it ultimately wasn't a fit. We have the skills on our team to manage more of this on our own. My recommendation would be contingent on what skills are already available on your team: if you can "do it yourself" you might as well so that you don't pay for resources you don't need and you have finer grain control over what's created.
For WAF functionality and delivery of websites, It's very well suited for traditional firewalling, if you're doing that already, it can be quite difficult to rearchitect everything around this product. So an example of that would be if, like us, you came from a datacenter style architecture within your cloud environment and you are trying to move to a more cloud-fronted architecture. Probably the best way to put it is that can be quite difficult, but once you've deployed, it gets easier operationally. So to kind of reverse engineer everything and then do everything again can be quite tedious in some ways. But that will be specific to people depending on where they're coming from with it.
DLP monitoring - key item for us which helps to view if anything which should leave our environment our or even between each part of network between/inside specific clouds
Segmentation of subnet, basic but helpful to isolate each host into their own part of single subnet and connect them, including all visibility features which are offered by Cisco defense systems
Allow/deny rules helps us to block, monitor and logs traffic passing in each direction of our environment
There is no way to easily close an AWS account whether it was created manually or via the AWS Control Tower. It takes too many steps to close it vs to provision a new AWS account
Using AWS Systems Manager and other slightly lower level components has been helpful for us to manage parts of our AWS presence at a more granular level than AWS Control Tower was designed for. It's not at all an apples-to-apples comparison as they solve different use cases, but for us, the use case associated with AWS Systems Manager was a better fit for our specific needs and skillsets. We did not need everything that AWS Control Tower was doing for us.
Cisco Multicloud Defense, Crowd Strike Falcon, and Arctic Wolf Cloud Posture Security Management System as a service SAAS platforms are very comparable platforms. Unfortunately for Croud Strike, they had a mishap recently that caused major downtime for many companies worldwide. I do not think that you would have to worry about this happening with Cisco Multicloud Defense.
