How Cisco Umbrella works technically
Here we go one level deeper than on the homepage and explain what actually happens, technically, when a device is protected by Umbrella - both for DNS security and for SIG Advanced.
DNS security
Whenever a device tries to visit a website, it starts with a DNS lookup: the device asks “what address belongs to this domain?” before it even connects. The Umbrella client makes sure that lookup goes to Cisco's DNS resolvers instead of your regular provider's. There, the domain is checked against a range of threat categories before an answer is returned. If the domain is malicious, the device never gets a real address to connect to - it's redirected to a block page instead. If the domain is safe, everything proceeds as normal. The whole check typically takes a fraction of a second, and users usually don't notice it at all.
What gets checked?
No matter which protection policy is selected, every domain is always checked against these categories:
Malware
Domains known to host or distribute malicious software.
Phishing
Domains impersonating legitimate services to trick users into handing over login credentials or other sensitive data.
Cryptomining
Domains associated with malicious cryptomining, where a device's processing power is hijacked without the owner's knowledge.
Command & Control
Domains that already-infected devices use to “phone home” to their operators for instructions or to send stolen data onward.
Newly Seen Domains
Domains observed for the very first time within the past 24 hours, anywhere on Cisco's global network. New domains are often registered specifically for a single phishing or malware campaign, precisely because they aren't yet known to be malicious by traditional security tools. By keeping a closer eye on domains nobody has seen before, Umbrella catches a share of threats that would otherwise slip through before they're categorized.
Beyond these security categories, depending on the chosen protection policy, you can also block content categories such as adult content, gaming, or social media. See the full breakdown of what each policy includes on the policy page.
SIG Advanced - full traffic inspection
DNS security only checks which domain a device wants to connect to - not what's actually being sent back and forth. With SIG Advanced, all traffic from the device is instead routed through an encrypted tunnel to Cisco's cloud infrastructure, where it's inspected in full before being forwarded to its actual destination.
Secure Web Gateway
The actual web traffic - not just the domain name - is examined for malicious content, and the same categories used in DNS security are enforced here at a deeper level. This catches things like a malicious file trying to download from an otherwise innocent-looking page.
Cloud firewall
All traffic also passes through a firewall in Cisco's cloud that enforces rules for which connections are even allowed to be made - an extra layer on top of the web inspection.
Danish IP address
Because traffic is physically routed through Cisco's data centers, that's where - not on the device itself - it leaves the tunnel and continues out onto the internet. Valeo configures this so your traffic always exits the tunnel through a Danish data center. That's why an employee traveling abroad still appears to browse from a Danish IP address and can access Danish services as if they were at home.
Just like with DNS security, the chosen protection policy determines exactly which categories get blocked. See the details on the policy page.
DNS Essentials vs. SIG Advanced - the technical difference
DNS Essentials
- Checks the domain name before a connection is made
- Protects against malware, phishing, cryptomining, command & control, and newly seen domains
- No visibility into the actual content of the traffic
SIG Advanced
- All traffic is routed through an encrypted tunnel to Cisco's cloud
- Inspects the actual content of the traffic, not just the domain
- Traffic exits the tunnel through a Danish IP address