Item: Cisco Umbrella
Rating: 9
Author: Verified User

Use Cases and Deployment Scope

We have Cisco Umbrella being used across the entire organization, on all computers. The reason we use Cisco Umbrella is to control the website filtering in order to prevent users from accessing potentially malicious sites and/or content not deemed appropriate for work.

Pros and Cons

Lots of filtering options
Small client installer
Client installer works on remote computers

Creating a block list is a bit weird
Certain circumstances can cause a website not to load because of SSL certificate issues
Filtering rules can be a bit difficult to setup in complex scenarios

Return on Investment

Fewer malicious website popups
Certain employees don't waste time on inappropriate websites
Helps block ads on websites

Security Coverage

The client installer allows web filtering on endpoints that are outside the main firewall. Cisco Umbrella even supports pointing a remote site's DNS servers to Cisco Umbrella's DNS servers and it can be intelligently filtered if it matches a static IP configured in the web console.

Integrations

We don't use the extra interoperability with third-party solutions, mostly because we use different products that it can't interface with. We do feel that it fits with our security stack because it acts as both a first line of defense on workstations as well as an additional layer of defense if something were to get attacked. It actively filters traffic to prevent accessing malicious sites and also would help prevent outgoing requests to malicious sites as they get updated in Cisco Umbrella's filter lists.

Support Rating

We haven't had to contact their support very often, which is good. The few times we've had problems with sites getting categorized incorrectly, they've been able to fix the issue, but not always quickly. We've had a couple issues with sites that are classified as New that sometimes get blocked, and their response has been to wait a couple days and it won't be categorized as new anymore, so not exactly a quick fix.

Alternatives Considered

Webroot DNS Protection and WebTitan DNS Filter

We tested a couple options before going with Cisco Umbrella. Cisco Umbrella was definitely the most feature rich option and the most useful overall. At the time we compared other options, Webroot DNS Protection had just been released and we decided not to deploy a brand new product. At that time it wasn't nearly as complete a product as Cisco Umbrella, but that may have changed in the past couple years. WebTitan required a virtual machine to run the software so it wasn't appropriate for external or remote workers.

Other Software Used

WebTitan DNS Filter, Webroot Business Endpoint Protection, ConnectWise Automate (formerly LabTech), ConnectWise Control (formerly ScreenConnect)

Likelihood to Recommend

I think Cisco Umbrella is well suited for almost all organizations. It works so well that both a small business and a large business can use it without issues. Technically it can even be used by devices that don't support the client installer, so it can basically be used anywhere by anyone. The only downside to Cisco Umbrella is that it doesn't fully support Terminal Servers, in that it won't do user-based filtering, which can be a deal-breaker.

Cisco Umbrella is a great product

Overall Satisfaction with Cisco Umbrella