SaaS Fundamentals

David Hanes, CCIE No. 3491, is a principal engineer in the SaaS Support Engine at Cisco, supporting the Cisco Technical Assistance Center (TAC). Specializing in SaaS, Internet of Things (IoT), and collaboration technologies, he is focused on workflow innovation, solution architecture, and technical solution development. David is the coauthor of two books: IoT Fundamentals: Networking Technologies, Protocols, and Use Cases for the Internet of Things (Cisco Press, 2017) and Fax, Modem, and Text for IP Telephony (Cisco Press, 2008).He has contributed to industry standards bodies such as the IETF and the SIP Forum and holds more than 50 patents, both pending and issued, across the domains of collaboration, IoT, security, AI/ML, wireless, and sustainability. David’s technical leadership is recognized globally, and he has been invited to speak at numerous international conferences on collaboration and IoT topics. At Cisco Live, the company’s flagship customer event, he has delivered more than 30 presentations and has earned seven Distinguished Speaker awards as well as induction into the Hall of Fame.Since joining Cisco in 1997, David has served as a TAC engineer and team lead for both the WAN and Multiservice Voice teams, and as an escalation engineer specializing in a wide range of VoIP technologies. He has resolved complex collaboration issues for many of Cisco’s largest customers worldwide. Prior to Cisco, David began his networking career as a systems engineer at Sprint, where he worked with frame relay and X.25 protocols. He holds a bachelor of science in electrical engineering from North Carolina State University.Omar Santos is a distinguished engineer at Cisco focusing on artificial intelligence (AI) security, cybersecurity research, incident response, and vulnerability disclosure. He is the cochair of the Coalition for Secure AI (CoSAI) and a board member of the OASIS Open standards organization. Omar is also the chair of the OpenEoX and the Common Security Advisory Framework (CSAF) technical committee. His work led the creation of the CSAF ISO standard.Omar’s collaborative efforts extend to numerous organizations, including the Forum of Incident Response and Security Teams (FIRST) and the Industry Consortium for Advancement of Security on the Internet (ICASI). Omar is the cochair of the FIRST PSIRT Special Interest Group (SIG) and was the lead of the DEF CON Red Team Village for several years.Omar is the author of more than 25 books, 20 video courses, and more than 40 academic research papers. His work in cybersecurity is also recognized through multiple granted patents. Prior to Cisco, Omar served in the United States Marines focusing on the deployment, testing, and maintenance of Command, Control, Communications, Computer, and Intelligence (C4I) systems.Paul Giralt, CCIE No. 4793, is a distinguished engineer in the Cisco Security and Trust Organization (S&TO) focused on making Cisco’s software secure; however, he spent most of his decades-long career at Cisco supporting all aspects of Cisco’s collaboration portfolio, from the early days of CallManager 3.0 to modern-day, cloud-based collaboration, including Webex. He has spent much of his career helping customers accelerate the adoption of Cisco technologies and solutions, working with Cisco’s largest collaboration deployments and working closely with engineering on improving product serviceability and cross-architecture product integrations. Paul has spent years designing, troubleshooting, and diagnosing issues on some of the largest and most complex Cisco collaboration deployments. His current focus is on making industry-leading changes to the security posture of Cisco products in the face of evolving threat actor sophistication leading to network infrastructure that is resilient to attacks.Paul holds a degree in computer engineering from the University of Miami, is the author of multiple Cisco Press titles, is an IETF contributor, and holds numerous patents in collaboration and networking technologies.Chad Patterson is a technical leader in Cisco’s Customer Experience SaaS Engine, with more than 12 years of expertise in cloud collaboration technologies, SaaS security, and full-stack observability. He specializes in supporting and innovating across many Cisco products, including Webex and Telepresence, building solutions that enable customers and support teams to detect and resolve issues faster.Chad is recognized for his contributions to technical innovation, having developed software tools and workflows that streamline troubleshooting and enhance customer outcomes. He is a prolific author of technical documents, white papers, and training materials, and has been responsible for developing and delivering curriculum to launch new collaboration and IoT support teams.An active participant in Cisco’s technical community, Chad has presented at major industry conferences, including Cisco Live and Cisco Impact, where he leverages his domain knowledge to empower customers and sales teams. He is also dedicated to mentoring colleagues and driving cross-functional innovation within Cisco’s Customer Experience organization. Chad holds a bachelor of science in electrical engineering and a bachelor of science in computer engineering from North Carolina State University.

• Introduction xxvPart I SaaS FundamentalsChapter 1 What Is SaaS? 1Cloud Types 2IaaS, PaaS, and SaaS Cloud Computing Models 10Everything as a Service 17Shared Responsibility Model 19The Business Case for SaaS 21Summary 24References 25Chapter 2 SaaS Architecture 27Logical Model 29Review of SDN Logical Model 29SaaS Control Plane and Application Plane 33Architectural Model 35NIST Cloud Computing Reference Architecture 36SaaS Architectural Model 38Infrastructure 42Compute 43Storage 44Network 46System Software and Tools 48Application Services 51Microservices and Serverless Architectures 52Business Logic and Core Functionality 58Database Services 60Structured, Unstructured, and Semi-Structured Data Types 61Relational and Non-Relational Database Types 63Presentation Services 69Integration Services 73Custom Integrations with APIs, Webhooks, and WebSockets 74Prebuilt Integrations with Apps, Connectors, Modules, and Adapters 76Security and Privacy 78Cloud Security Controls 79Identity Access and Management 80Visibility and Monitoring 82Management and Analytics 82Multitenancy 88Summary 91References 93Chapter 3 Migrating to SaaS 95Discovery 96Cost of Ownership 97Partial or Full Migration 98The Reason to Identify Key Features and Functionality 98Application Configuration 99Application Integrations 100Network Requirements 101Security 102Migration Requirements 103Design and Planning 104Network Requirements 105Connectivity 105Quality of Service 106Bandwidth 107Virtual Private Network (VPN) 108Data Migration 109Testing 110User Acceptance Testing (UAT) 110Automated Testing 110Application Metrics 111Security Testing 112Fallback Planning 114Implementation 115Staging Environment 115Application Cutover Strategy 116Hard Cutover 116Parallel Applications 117Staged Migration 119SaaS Provider Migration Tools 120Value Realization 120Validate 121Uplift 122Utilize 122Common Migration Challenges 122Network Changes 123User Adoption 124Security Concerns 124The Need to Prevent Unauthorized Access 125Loss of Data 125Vulnerability Management 125API Security 125Shadow IT 125Summary 126References 127Chapter 4 Security and Privacy for SaaS 129SaaS Security Basics 129Data Protection and Privacy Concerns 130Common Threats to Data Security in SaaS Platforms 130Data Breaches 130Data Leakage 131Insider Threats 132Advanced Persistent Threats (APTs) and Nation Sponsored Attackers 134Ransomware 136Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Attacks 137Regulatory Compliance and Certifications 137General Data Protection Regulation (GDPR) 137Payment Card Industry Data Security Standard (PCI DSS) 138International Organization for Standardization (ISO) Standards and Certification 138Europe’s Cyber Resilience Act (CRA) 139Federal Risk and Authorization Management Program (FedRAMP) 139System and Organization Controls (SOC 1, 2, and 3) 142The Cloud Security Alliance (CSA) Security, Trust, and Assurance Registry (STAR) 143Data Sovereignty 144Architectural Considerations for Data Partitioning and Tenant Isolation 147Tools and Techniques for Preventing Data Loss in a SaaS Setup 149Encryption 149Data Masking and Tokenization 152Data Classification and Tagging 154Integration of DLP Solutions with Existing Systems 157Identity and Access Management (IAM) 158Centralizing Identity Management 158Enforcing Multifactor Authentication (MFA) 161Using Cisco Duo and MFA 163Understanding FIDO Technology 163Implementing Single Sign-On (SSO) 168Looking at SAML, OAuth, and OpenID Connect 170Monitoring and Analyzing User and Application Account Activities 173Best Practices for Monitoring and Analyzing Activities 174Access Control Mechanisms 175Continuous Monitoring and Incident Response 176Best Practices for SaaS Incident Response 177The Automation of Everything in SaaS to Enhance Security and Efficiency 179SaaS Security Management 180SaaS Security Posture Management (SSPM) 180Cloud Access Security Broker (CASB) 181Summary 182Part II SaaS SolutionsChapter 5 Collaboration: Webex Meetings and Messaging 185Product Capabilities 186Webex Meetings 187Webex Messaging 192Asynchronous Video (Vidcast) 195The Webex Platform 196Infrastructure 197Application Services 199Authentication and Authorization 200Encryption and Key Management 201Meeting Management and Control/Media Services 204Messaging Services 209Recording, Speech, and AI Services 210Presentation Services 211Database Services 211Provisioning Database 211Messages Database 212Management and Analytics Data Storage 212Logging Data 213Integration Services 213Management and Analytics 214Security and Privacy 218Summary 220References 220Chapter 6 Collaboration: Webex Calling 221Product Capabilities 223Call Routing and Dial Plan Management 224User Management 227PSTN Connectivity 227Cisco Calling Plans 227Cloud-Connected PSTN Partners (CCPP) 228Premises-Based PSTN 229Emergency Calling 231Calling Endpoint Support and Management 231Calling Features 233Customer Experience Features 235Interoperability 236Analytics and Troubleshooting 237High Availability and Survivability 240Artificial Intelligence (AI) Features 242The Webex Calling Platform 243Infrastructure 243Application Services 245Call Control Services 245Edge Services 247Media Services 248Provisioning Services 249Device Management Services 250Presentation Services 250Database Services 251Integration Services 252Management and Analytics 252Security and Privacy 253Summary 254References 254Chapter 7 Collaboration: Webex Contact Center and Webex Connect 255Cisco Cloud Contact Center Products 257Product Capabilities 258Omnichannel Communication 259AI-Powered Features 260Virtual Agents 261Cisco AI Assistant 261Advanced Call Routing 262Skills-Based Routing 264Agent-Based Routing 265Flow Designer 265Analytics and Reporting 267Integrations 269Webex Workforce Optimization 272Webex Contact Center Platform 274Infrastructure 274Application Services 276Contact Interaction Management 277Queues and Routing 279Desktop Agent 279Presentation Services 280Database Services 281Flow Configurations 281User Profile Information 282Logging and Telemetry 282Management and Analytics 283Integration Services 284Security and Privacy 285Summary 286References 287Chapter 8 Security: Identity and Access Management 289Cisco’s Zero Trust and Continuous Trust Philosophy 290The Shift to Identity as the Perimeter 291Cisco’s Zero Trust Framework 292The Principle of Continuous Trusted Access 294An Introduction to Cisco Duo 295From Traditional MFA to Phishing-Resistant Passwordless 295Overview of FIDO2 and WebAuthn 296Case Study: Implementing FIDO2/WebAuthn with Cisco Duo for Passwordless Authentication at Cisco 297Implementation Process 298Passwordless Implementation Lessons Learned and Recommendations 299Single Sign-On (SSO) and Duo 300Passwordless Authentication 300Device Trust and Health 300Getting Familiar with Cisco Duo via the Free Tier 301The Duo Cloud-Native Platform and On-Premises Components 301Duo Authentication Proxy 302Duo Network Gateway (DNG) 304More Than 400,000 VPN Connections per Month 304The Cisco Duo Identity and Access Management (IAM) Platform 305Duo Identity Routing Engine 306Hardware-Free Phishing Resistance 306More on Cisco Identity Intelligence 307Summary 307References 308Chapter 9 Security: Cisco Umbrella and Cisco AI Defense 309From OpenDNS to Cisco Umbrella 310Secure Internet Gateway and Secure Access Service Edge 310An Analysis of Umbrella’s Converged Functions 312Predictive Security with AI, ML, and Talos 313Domain Generation Algorithms (DGAs) 314Command-and-Control (C2) Callbacks 316Umbrella Investigate 317Cisco Umbrella Deployment Scenarios 318Policy Configuration Best Practices 320Cisco AI Defense: Securing the AI Revolution 321The Rise of Shadow AI 321The Developer’s Dilemma: Securing In-House AI Applications 322Cisco AI Defense Four-Pillar Framework for AI Security 323Summary 325References 326Chapter 10 Security: Cisco XDR, Splunk, and Cisco Vulnerability Management 327Unifying Telemetry for Accelerated Response Using Cisco XDR 329Cisco XDR Architectural Deep Dive 329Data Ingestion and Normalizations 329The Analytics and Correlation Engine 330Licensing Tiers (Essentials, Advantage, Premier) 331Cisco XDR Core Capabilities and AI-Powered Detection 331Cross-Product Context, Incident Prioritization, and Cisco Talos Threat Intelligence Integration 331Automated Guided Response and Containment Actions 332Guided Playbooks, Workflows, and Forensics 332Data-Driven Insights with the Splunk Ecosystem 333Splunk Enterprise and Splunk Cloud Platform 333Splunk for Security Operations and Splunk Enterprise Security 334Going Beyond Security with Observability and IT Operations 336Splunk AI Toolkit: Operational Machine Learning on the Splunk Platform 338Cisco Vulnerability Management: Prioritizing Risk with Data Science 340Risk-Based Vulnerability Management (RBVM) 340Data Ingestion and Intelligence Feeds 341The Scoring Mechanism, Asset Criticality, and Context 342Operationalizing Vulnerability Management 342The Power of Integration: A Unified Security Strategy 344Splunk, Cisco XDR, and CVM Technical Integration Points 345Correlating Threats with Vulnerabilities 346A Practical Workflow: From Vulnerability Awareness to Orchestrated Response 347Cisco’s AI Assistant 348Summary 349References 350Chapter 11 Observability and Monitoring: Cisco AppDynamics and Splunk 351The Basics 352What Is Full-Stack Observability? 352Observability vs. Monitoring 353OpenTelemetry and MELT 354AppDynamics + Splunk 356SaaS Security Practices—AppDynamics and Splunk 359Data Encryption 359Access Control 360Disaster Recovery 360Audit Logging 362Multitenancy 362Splunk Observability Cloud—Architecture Overview 363Cloud-Native Observability 363Data Collection 364AppDynamics—Architecture Overview 365SaaS and On-Premises Observability 365Controllers and Agents 367Controllers 367Agents 369Core Observability Features 370Application Performance Monitoring (APM) 371Infrastructure Monitoring 374End-User Monitoring 376Browser Monitoring 376Mobile Monitoring 378IoT Monitoring 378Synthetic Monitoring 379Log Observer Connect 380Summary 383References 384Chapter 12 Observability and Monitoring: Cisco ThousandEyes 387Architectural Overview 388Agent Types 391Endpoint Agent 392Enterprise Agents 393Cloud Agents 394Agent Tests 396Enterprise and Cloud Agent Tests 396Routing Test 397Network Tests 398DNS Tests 399Web Tests 400Voice Tests 403Endpoint Agent Tests 405Path Visualization and Dashboard Snapshots 407Internet, WAN, Cloud, and Traffic Insights 409Integrations 411Prebuilt 411Custom 412Cisco AI Assistant Integration 413Summary 415References 416Chapter 13 Management: Cisco Meraki 417Meraki Platform Capabilities 418Meraki Dashboard 419Security Appliances (Cisco Meraki MX) 422Switches (Cisco Meraki MS) 425Wireless Access Points (Cisco Meraki MR) 428Cellular WAN Gateways (Cisco Meraki MG) 431Cameras (Cisco Meraki MV) 432Sensors (Cisco Meraki MT) 434Device Management (Meraki Systems Manager) 436The Cisco Meraki Cloud 438Infrastructure 439Application Services 441Presentation Services 443Database Services 444Integration Services 445Management and Analytics 447Security and Privacy 449Summary 450References 451Chapter 14 Management: Cisco Intersight 453Intersight Overview 454Cloud-Managed Compute 455SaaS vs. On-Prem Implementation 458Device Integration (Cisco and Third Party) 458Key Features and Functions 461Automation and Insights 467Orchestration 467Programmability and Infrastructure as Code 470Architecture 474Common Deployment Scenarios 477Common Workflows and Use Cases 480Device Onboarding and Security 481User Management 486TAC Integration 488Summary 491Reference 492 9780135334744 TOC 3/23/2026