Business Benefits of Segmentation with Software-Defined Access

The goal of moving applications to the cloud and integrating with SaaS platforms is to satisfy the growing demand for connectivity to data resources and applications at any time, from anywhere. However, achieving that goal with high levels of Quality of Experience (QoE) for applications depends on the enterprise wide area networks. Managing QoE connectivity among campus, branch, and cloud resources naturally increases network complexity. That translates into an increase in workload for IT teams to keep up with changing prioritization of traffic, network access rules, and data security policies.

But just because a network is complex doesn’t mean it has to be complicated. A Software-Defined Architecture (SDA) is the antidote for complicated. Separating data, control, and management planes makes networks both more flexible and manageable by automating many formerly manual tasks. A significant portion of those tasks are handled by Cisco Software-Defined Access (SD-Access) working at the controller plane level, reducing complexity and improving scalability and mobility of devices and the workforce.

Empowering IT with an Architecture for Access

When people, devices, and applications are located anywhere, automating the onboarding and provisioning of them with the correct access and security policies is paramount to maintaining control and security. SD-Access applies access and security policies generated by network intents. Translating intents into actions is the foundation of Intent-Based Networking, where higher-level business intents create network access and security policies that are automatically applied to devices and people to determine access rights and security privileges.

SD-Access simplifies network management, especially for segmentation and secure access policies, but also for operational consistency, increasing productivity, and a seamless experience. In this post, we will examine the business and security benefits of automating segmentation and access control.

Automation Simplifies Network Segmentation Management

To simplify the complexity of campus-branch-cloud connectivity, SD-Access shifts the workload from IT staff performing routine tasks of onboarding every individual device and managing network configurations, to building intelligence into the network itself. The network learns to manage itself by, for example, automatically onboarding specific device types with pre-ordained security and access policies that follow people and devices across the wired and wireless fabrics, from ground to cloud.

Automating access and segmentation is also critical for the successful integration and security of the Internet of Things (IoT) and the myriad types of devices that are being deployed throughout buildings, campuses, branches, and cloud edge. As sensors, cameras, and edge-processing applications proliferate, they need to be securely added to network segments with tight control over who and what can access them, and with which services they can communicate.

Video cameras, for example, should only communicate with a video server, not an application or web server. Placing cameras and their peer servers in one segment, isolated from other enterprise network assets, is a simple way to secure video devices. As additional cameras are connected, the network recognizes the device type and automatically adds them to the correct segment. Sudden changes in attempts to communicate with resources outside the segment can indicate a takeover attempt by malware, resulting in the network isolating the device  and thwarting the malware’s attempt to move laterally through the network.

The business benefits of automating onboarding of devices are plentiful: from eliminating the need to send technicians to remote locations to securely configure devices, denying access to unknown devices to prevent infections from spreading, and enabling IT to move from routine tasks to working on innovative projects.

Cisco SD-Access gives IT time back by reducing the effort it takes to manage and secure the network and improve the overall end-user experience.

Enforce Consistent Policies Across the Enterprise

Consistency is key to ensuring people, devices, and data resources all interact according to network policies. For enterprises with many regional locations, it’s common to have instances of Cisco DNA Center for each region to provide location-specific contextual insights for faster issue resolution and capacity planning. That could complicate the consistent application of policies. Fortunately, the regional Cisco DNA Centers can leverage a master instance of Cisco Identity Services Engine (ISE) so that SD-Access can apply access and segmentation policies across each region. With this capability, SD-Access ensures that security and access policies defined by corporate IT are implemented consistently across global networks, while enabling regional control over specific aspects of workforce and device rules.

Segmentation Eases Regulatory Compliance

With all the new privacy regulations coming online across the globe, being able to demonstrate compliance with these rules is paramount to avoiding legal battles and court fines resulting from data breaches. Employing SD-Access to define segmentation to keep private information strictly separated from other business data helps organizations prove they are in compliance.

Compliance with Payment Card Industry (PCI) regulations for protecting payment card information is an example of the business benefits of segmentation that SD-Access can manage. To comply with PCI standards, payment data must be kept separate from any other IT system and limit access to specific people and processes with no external internet connections—thus contained in a “PCI Island”. SD-Access creates microsegments that effectively isolate every device and application that “touches” payment data, effectively creating virtual PCI Islands where they are needed in a global network.

Building this level of segmentation would be difficult with a manual, case-by-case approach. Assigning people and compute resources to a PCI Island security group tag (SGT) simplifies segmentation, helping to maintain compliance, saving time and minimizing rigorous PCI testing. Securing payment and personal information this way also reduces the risk of exposing sensitive data in breaches.

SD-Access Directly Benefits Business Processes Across Industries

Every industry is moving applications and data to the cloud, some faster than others, but all driven by competitive pressures, operational changes, and regulatory demands.

◈ Healthcare organizations are methodically moving sensitive patient data to cloud platforms where it can be accessed by healthcare providers distributed across regions, while ensuring that access is strictly controlled and monitored for compliance.

◈ Pharmaceutical enterprises, which use acquisitions as a growth strategy, use SD-Access to simplify their network operations and the process of integrating IT operations by first segmenting resources during the acquisition process, and then uniting them by changing access policies across the board as the acquisition culminates.

◈ Government branches, consisting of dozens of agencies, use SD-Access to streamline, unite, and secure wired and wireless network operations among the distributed workforce in offices, branches, and in the field.

◈ Manufacturing facilities, which have a complex mix of IoT devices, mobile computing, and data center resources, use SD-Access to segment traffic to provide the appropriate SLAs for latency for time-critical manufacturing processes, keep malware from spreading should one device be infected, and provide secure workforce access to the appropriate applications.

◈ Financial institutions with highly distributed sites use SD-Access—along with SD-WAN—to securely connect branch and headquarter networks while ensuring that sensitive data is accessible only to employees with the appropriate access privileges.

While each industry has its own path for designing and building a software-defined architecture based on SD-Access, ISE, and Cisco DNA Center, most achieve breakeven results in about 14 months, an ROI of 300%, and cost savings of over 52%. In addition, business benefits often shared by Cisco customers are a 67% reduction in network provisioning costs, 48% reduction in the cost of a security breach, 80% reduction in cost to resolving networking issues, and 94% reduction in the cost to optimize policies.

It’s time for your organization to examine how to benefit from software-defined segmentation based on SD-Access.

Continue reading

Automating Your Network Operations: Focus on Outcomes

When I started this blog series, I had intended to present a cohesive approach to automating your network operations, eventually leading to DevOps. The intent was to take you beyond simply automating ad-hoc tasks using contrived examples to a more systematic way of automating your network operations (hence the title). Unfortunately, I completely failed because I presented it in an ad-hoc way. So in this blog, I am going to go back to the beginning: What are we trying to achieve?

Before I do that, I want to introduce a new blogger, Jason King. Jason and I have a very similar background in operations and development. We’ve both spent a large part of our careers on the front lines designing, building, and operating large systems and networks and hope to leverage that experience in our blogs, repos, and other works. With his help, hopefully we can get the series moving more smoothly.

Automated Humans vs. Automated Business

Do we just want a human to be able to perform a single operation faster? If so, then we might not actually achieve that. Why is this? Automation is geared at deploying single or multiple changes across a large number of devices. However, many changes do not fall into this category.

Engineering vs. CRUD

There are basically two types of changes that are made to a network in steady state operations:

◈ Architectural/Engineering: These are changes to the architecture of the network (e.g. Routing, QoS, Multicast) that generally affect the entire network. It is also the architecture for how new services are deployed (e.g. tenants, remote sites, etc.)

◈ Create, Read, Update, Delete (CRUD): These are changes that deal with delivery of network services to a particular customer or application (e.g. putting a port in a VLAN, adding an ACE to an ACL, or adding a load balancing rule).

The rigor of DevOps is absolutely the way to make major architectural changes to a network because of the network-wide effect that these changes have and the relatively small number of changes that occur.

CRUD is often different, however. While making a single change (e.g. SNMP Community Strings) on thousands of devices is an operation for which the overhead of DevOps is justified, that same overhead may significantly slow down operations involving a single change on a single device (e.g. changing a port VLAN).

The DevOps overhead is not necessarily a bad thing, even for small changes. There are significant advantages in enforcing configuration management, revision control, code review, and testing on every change. It does not, however, always make network operations faster or easier. This increased friction can make it unpalatable to many network teams and hinder adoption.

Constraints-based IT

There is also the Theory of Constraints with states that “any improvements made anywhere besides the bottleneck are an illusion.” (Eliyahu M. Goldratt, 2014)

This means that if you are automating processes that are not slowing down your business, you are not having an effect on your business. The entire effort is potentially a waste of time and money. That is why automation should begin with a thoughtful process that identifies the most important outputs of your infrastructure and what the current bottlenecks are in producing those outputs.

In general, automation is going to provide your business two main improvements:

When your enterprise produces customer value faster (e.g. onboarding new customer and/or offering new services), the business generally brings in more revenue. Adding a faster time to remediation (e.g. less maintenance and quicker trouble resolution) reduces operating costs and increases customer satisfaction. When done right, it is a powerful combination proves the best outcomes for any automation project.

This is why we must focus on automating business processes and not just humans. In fact, the best way to automate a business is to remove the human from the process, at least from that value chain between the customer’s request and the delivery of that request.

“If it does not have an API, it does not exist”

– Mitchell Hashimoto

Automating Business Processes: API-Driven Automation

When we consider how to automate business processes, we must focus on reducing the time between the time a customer requests a new service and the time they receive that service. Humans, generally, are not the best way to reduce this time, which is where APIs come in. APIs allow each step of the process to be automated.

For example, when a user wants to add a firewall exception for a new server, they can go to a self service portal to make that request. That request can then go through the review process to make sure that it is aligned with business policies (hopefully automatically) and appropriately approved. Once it is approved, the ITSM pokes the automation framework through an API to begin the delivery of the service. The advantages of this approach is that:

1. It takes the network team out of the CRUD

2. It allows the network team to define and put checks around how changes to the network are performed

Hold the phone!

We are going to let a customer request a complex service with potentially harmful repercussions without having a human in the loop??? Well … yes. But even if you do need a human in the loop, you don’t need an entire team of them in the loop. And in either case, that is why DevOps is important. DevOps is not just automation, it is the development, testing, deployment, and validation of the artifacts that provide the service. If you properly develop and test these artifacts, you can be reasonably assured that the process does not go pear shaped. If you do the proper validation of deployed services, you can “fail fast” back to a previous version of the artifacts.

DevOps is the safety harness for automation, but that does not mean that you cannot start automating without it. In fact, very few organizations are able to implement a righteous DevOps pipeline in one go. The DevOps journey should be viewed as a stepwise approach to delivering business value. In this blog, we have provided some criteria for how to determine what to automate in order to achieve maximum value. You should not automate just to automate. Start with automation that addresses your critical business needs that fall into the categories outlined above, but always keep an eye on the end goal of building toward DevOps processes and, ultimately, business transformation.

What’s next?

Well, instead of writing blogs over the past 6 months, we’ve been working with a team of people to create a CI/CD pipeline for SD-WAN. Not a set of examples of what you could do, but a fully functional, operationally righteous framework that we and our customers use in their operations. To get there, we wrote Ansible modules for Viptela, VIRL, NFVIS, and PyATS that automate every step of the process. We’ll cover this in our next blog, followed by an in-depth treatment of each component and how to consume it individually on your stepwise path to DevOps.

Continue reading

How to Prepare for 200-105 exam on CCNA Routing and Switching?

Exam Name: Interconnecting Cisco Networking Devices Part 2

Exam Code/Number: 200-105 ICND2

Exam Overview: 

Cisco CCNA 200-105 Routing and Switching (ICND2) exam tests a candidate's knowledge and skills related to LAN switching technologies, IPv4 and IPv6 routing technologies, WAN technologies, infrastructure services, and infrastructure maintenance.

Practice Exam: Cisco Certified Network Associate Routing and Switching Practice Test

Sample Questions: Cisco 200-105 Sample Questions

Continue reading

Mobile Operators and 5G: Evolving into Digital Service Providers

5G is a revolutionary technology that’s expected to enable Industrial Digitization. It envisions a digital network that enables society to become mobile and connected, while driving value creation in sustainable business models. 5G implementation will have an impact in social and business developments some of them would be as:

◈ High-capacity or high-performance outdoor and indoor broadband access in high density spaces
◈ Increased user mobility
◈ Proliferation of Internet of Things (IoT) devices
◈ Extreme real-time communication
◈ Ultra-reliable and lifeline communications

With 5G technology powering the next wave of business ecosystems and capabilities, a new and diverse revenue mix will be created for mobile operators who can turn their mobile networks into platforms for deeper interaction with content and services. This transformation to digital service providers will facilitate the creation of new disruptive business models coupled with lean operational efficiency. While this evolution has the potential to drive revenue streams for service providers into enterprises and vertical solutions, it is a significant business and technology transformation that must be visualized in an end-to-end fashion. The technology transformation is underpinned by the Network as a Service (NaaS) model, which creates a slice in the network to carry various types of traffic and service SLAs over a single network.

The Business Proposition for 5G

The new network infrastructure will address exponential bandwidth demands, massive logic scale, and the rise in low-latency requirements from new applications and services in an efficient, automated, and programmable manner using a flexible and agile network fabric.

Operators can grow Enterprise revenue streams through use cases like Fixed Wireless Access (FWA) and create varied business models as 5G enables IoT, machine-to-machine communication at scale, and low latency services, also known as ultra-reliable low-latency communication (URLLC).

The adoption of technology advancements in the radio domain also offers the potential for operators to accelerate the implementation and monetization of massive multiple-input and multiple-output (MIMO) technology. MIMO allows the dynamic transmission of data as highly focused beams to send and receive multiple data signals simultaneously over the same radio channel, with multiple users using the same time and frequency resources through millimeter wavelengths and small cells.

Bringing possibilities to life using Network as a Service (NaaS)

For operators to provide the use cases detailed above, the network must be used as a Service. There will be a need for a flexible, dynamic network configuration based on user-specific service requirements, as opposed to a one-size-fits-all architecture. To achieve the Network as a Service approach, network slicing – a critical service feature, is introduced in 5G technology. This feature, coupled with a slice orchestration engine, working in tandem and across various domains, as well as software-defined networking (SDN) controllers, allow operators to offer the NaaS solution to their enterprise customers.

Network slicing allows multiple logical networks to be run as virtually independent business operations on a common physical infrastructure. Network slicing provides a network with user-specific functionality without losing the economies of scale of a common infrastructure. Network slicing will be an end-to-end solution approach, traversing across the different layers of the packet network from access to core. For implementation, Network slicing will require platforms to be much more programmable, intelligent, and flexible in order to cope with heterogenous environments and requirements.

The new services enabled by 5G will require that separate slices can be provisioned for different services based on the operator’s requirements, as well as those of the enterprise customer. Network slicing can be a combination of hard and soft slicing; hard slicing comprises the creation of separate planes or topologies with dedicated links, while soft slicing is a logical isolation and traffic classification using VPN and quality of service (QoS).

In the 5G era, a single network infrastructure can meet diversified service requirements. A 5G E2E network architecture is envisaged to have the following attributes: Provides logically independent hard and soft network slicing on a single network fabric to meet diversified service requirements and provides Telco Cloud consisting of DC SDN fabric and virtualization stack, providing a platform to host 5G infrastructure services as well as business services. Radio disaggregation and virtualization will reconstruct radio access networks (RAN) to provide massive connections of multiple standards and implement the on-demand deployment of RAN functions required by 5G. This also simplifies the core network architecture to implement the on-demand configuration of network functions through control and user plane separation, on-demand distributed functions and workloads, and unified orchestration and management.

The key tenets of 5G network transformation

Traditionally, mobile operators have had network architectures that are complex, rigid, monolithic resulting in high operating costs. To be operationally efficient, agile and to deliver NaaS, Service Providers will have to transform to Network Cloud architectures for 5G. The key tenets of this transformation are as follows:

◈ Transport simplification 

     ◈ To reduce the number of devices from access to core, states and protocols on the IP transport layer with stringent timing considerations

◈ Network functions virtualization (NFV) 

     ◈ Benefits include virtualization, disaggregation, agility and the ability to drive Capex savings leveraging non-modified opensource technologies

◈ Distributed Edge Cloud 

     ◈ Hosting services at the network edge translates to bandwidth savings and a better user experience while reducing touchpoints for network operations and management if deployed correctly

◈ SDN and Orchestration 

      ◈ To build an automated network service and analytics framework visualized to a network management for reduced time to market and improve operational efficiency

Bringing it all together: Cisco 5G

Network as a Service is a key framework for operators to monetize 5G. Cisco’s approach is to build a programmable, packet-based network architecture with orchestration and closed-loop automation. This takes place across various domains of the 5G network like Transport networks, Central and Distributed Edge data centers to host cloud-native network functions in an agile manner. This approach empowers operators to transform holistically from the one-size-fits-all approach to a dynamic network slice architecture to capitalize on the opportunity 5G will bring.

Continue reading

Cisco Advanced Malware Protection for Endpoints Awarded AV-Comparatives’ Approved Business Product Award

We are very pleased to share the news that our Advanced Malware Protection (AMP) for Endpoints won the Approved Business Security Award from AV-Comparatives. And we’re happy about this for a couple of reasons.

Most vendors’ marketing materials look great, your organization exists in the real world. So, having an independent third-party conduct months of testing against our technology, and us coming out a winner, helps to show the world what our customers already know: that the strength, flexibility, and ease of use of our endpoint security establishes our leadership. We have over a decade of experience in endpoint protection through Immunet (creators of AMP) and Sourcefire (creators of ClamAV).

AV-Comparatives’ Business Main-Test Series ran from March to June and consisted of two, in-depth tests:

The Malware Protection Test

This test ran in March and consisted of having 1,311 malware samples thrown at us during that time. A passing score required a 90% or higher detection rate and this time zero false positives. We did very well scoring a 99.8% with zero false positives.

The Real-World Protection Test

The idea here was to mimic what happens in, well, the real world. This test ran from March to June and was based upon 732 test cases. The focus here was on user behaviors such as clicking malicious links, opening malicious email attachments, etc.

An efficacy score of 90% or higher and a false positive count of 100 or less were the criteria to pass this test. And, we came in with 98.9% and ranked in the lowest false positive group.

In short, AMP for Endpoints achieved test results that demonstrated a balance of strong protection rates with very low false positives. AV-Comparatives also highlighted Cisco’s broad endpoint platform support and relative ease of deployment.

Beyond antivirus

Secondly, we view this report as further evidence that the security world has moved past the legacy world of antivirus. I’m not saying antivirus doesn’t have a role to play in endpoint security. Our own ClamAV is one of the several mechanisms that AMP for Endpoints uses. What I am saying is that the ‘antivirus as a sole means of endpoint protection’ ship has sailed – and sailed a long time ago.

The biggest problem with antivirus is that it’s not operationally efficient. That means a lower return on your investment and weaker protection of your business. Back in my IT days in the late 90s and early 2000s, antivirus was a big deal, but it was tough enough to administer when I was at a small, two-office operation let alone when I moved up a 50,000-user, global enterprise. And when the Love Letter worm hit us in 2003, that was a couple days and nights of manual remediation for our entire department, worldwide, because antivirus couldn’t remediate the problem or identify infected hosts.

Now fast forward to today’s world of fileless malware and multi-vector attacks that combine email, web, endpoints, etc. What’s antivirus going to do about those? The answer is pretty obvious.

What was surprising for me to learn recently was that the majority of organizations out there still rely on antivirus for their endpoint protection. I attribute this to deployment fatigue. Rolling out software is hard. I know. I’ve deployed my share of enterprise software. The good news about AMP for Endpoints is that we can be up and running quickly, as noted on page 28 of the AV-Comparatives report:

“Getting started with Cisco Advanced Malware Protection for Endpoints is very straightforward. The console requires no setup, and deploying the client software is quick and easy.”

The Big Picture

We believe it’s important to put our technology to the test and we feel the results speak to how our solution helps our customers protect their organizations. (I’ve included links to other real-world tests below.) We also believe that strong endpoint protection comes from being a part of an integrated security portfolio. One that dynamically shares the latest threat intelligence is the most effective way to defend against modern attacks. And we’ve designed our integrated security portfolio to do exactly that. But that’s another story for another day.

Continue reading

Take bigger risks with the right trusted advisors

When I look back at all the chances I have taken in my life – moving to New York City out of college having never visited prior, to leaving that career with no direction of what was next, to joining Cisco back in 2012 having no technology background whatsoever. I ask myself what gave me the strength and resolve to do so (after I ask myself was I crazy), and the overwhelming response is that I have always had a strong support system.  My parents packed me up and drove me from North Carolina to New York, and they also packed me up and drove me from New York back to North Carolina.  My husband and my friends helped me formulate my plan, provided me with sound advice and lent their shoulders to lean on when I took the leap of faith to come to Cisco.  Without any of these people, I would not be here today.

The same can be said for our customers and partners as they work to differentiate themselves in an ever-increasing competitive market.  Those who want to set themselves apart must be innovative, provide an amazing customer experience, but also insure a high level of security at the same time.

According to Steve Martino, SVP and CISO for Cisco; “Companies need to balance security vs business risk, and user experience. Once you have that balance, you need a program that applies defense with an active response for when things go wrong. Human error is a reality and there’s a multi-billion dollar cybercrime industry today that bets on it. You need to plan for that error and be able to respond quickly when it happens. Every day we find successful attempts to defeat our security defenses due to human error, or dedicated bad actors targeting our assets, or to software vulnerabilities; and every day we validate that our active detection and responses are finding and containing these attacks. That’s how I know we have a fully functional security program..”

When you have a strong incident response plan in place, you are able to take bigger risks, but where do you start if you don’t have a plan?

All rights reserved to Sandra Cifo

Cisco Incident Response Service

You need proactive plans to help you prepare, and expertise to coordinate and carry out a response.  Cisco’s Incident Response Service provides everything a business needs to develop, implement, and manage the plan, including the option of setting up a flexible retainer to provide proactive and emergency defense services.  An elite team of experts is available and ready to respond within four hours, and they can be traveling to your site within 24 hours.

Cisco Talos is the world’s largest threat intelligence service, to back up the response team.  This is combined with the full Cisco portfolio, including AMP for Endpoints, Umbrella, and ThreatGrid.  These tools not only protect against exploits, but can also identify and trace attempts and breaches across the network.

With all of this, the customer receives the benefit of a stronger security posture through a robust and resilient SOC environment.  This results in a savings of money and reputation and can get a business back to normal operations quickly after a breach.  This solution also works with the existing security infrastructure.

When I came into Cisco, the smartest thing I ever did was partner with people who were smarter than me and could support my learning as I have grown in this career.  The same can be said for our customers – the smartest ones are the ones that realize they can’t do this on their own and reach out to trusted advisors for help.

Continue reading

Drive Your Cloud Services Portfolio with Webex and the Jobs to be Done Framework

How service providers (SPs) can use the Jobs to be Done (JTBD) framework to better engage with their customers and achieve superior results. In this post, we look at how JTBDs are applied for the Cisco Webex suite. We look at key elements of JTBD construction such as the buyer and purchase dynamics.  We then learn how you can extend Webex JTBDs to differentiate and target your own cloud services offer.

Jobs to be Done Overview

As we learned in Part 1, the JTBD framework is especially powerful when combined with advanced digital engagement methods and larger go-to-market transformation initiatives. In go-to-market transformations, SPs apply digital capabilities to better orchestrate customer interactions across digital and non-digital channels through the end-to-end customer lifecycle.

JTBDs are woven into customer touch points and achieve maximum impact where SPs deliver the right message and experience, to the right persona, at the right time.

Using this approach is especially important for cloud services where customer experience is king, and churn is your biggest enemy. Forbes recently reported that 89% of businesses now compete primarily on the basis of customer experience, up from 36% in 2010.

JTBDs take considerable effort to develop. Building these out requires deep customer engagement, rounds of working with product UI/UX, testing via focus groups, and then verifying via A/B testing and analytics. Finally, you bring your JTBD to life through creative teams and designers.

Apply Jobs to be Done for Webex

To give you some examples of this, we will walk through JTBD highlights for Webex. Note that these Webex JTBDs are new. Webex now incorporates a broader set of capabilities, delivering not only meetings, but Webex Teams, Webex Cloud Calling, and Webex Conferencing Devices. These can be packaged and delivered alongside Cisco handsets, headsets, and other enabling hardware. This powerful suite enables you to target more important jobs for your customers. In addition, the expanded Webex suite can be delivered via the Cisco cloud, offering open APIs to third-party applications and better support for customer cloud migration strategies.

One of the first and most important elements of JTBDs is the focus on the buyer. For Webex, there continues a focus on seamless user experience and industry-leading benefits for IT leadership.  With an expanded set of capabilities, Webex becomes even more important for the IT buyer, firm leadership, procurement activities, and businesses operations.

We see two ways that you can apply JTBDs as you engage IT leadership in their purchase process:

1. Buying groups: While IT may lead the procurement process, the decision itself is more likely done in a group setting with multiple interests or JTBDs represented. Sirius Decisions recently reported that 59% of B2B decision-making is now made by “buying groups.” This dynamic suggests a benefit in identifying multiple JTBDs and how they can appeal across different key purchase influencers or personas in these buying groups.

2. Consumption dynamics: Although Webex is typically purchased by an IT Director, CIO or business owner, the success of the implementation depends on user adoption and consumption. Buyers need to reflect the interests of the firm’s target “end users,” e.g., the broader base of employees who need communications and collaboration tools. Not to be too clever here, but one of the “jobs” of the buyer (and buyer group) is to represent the “jobs” of their end-users.

Figure 1:  How JTBDs are “rolled up” to the CIO for communications solutions from 1) C-suite buyer groups and 2) end-user consumers

To address the above purchase dynamics, our Webex JTBDs focus on the IT leader but include the context of other key stakeholders. By taking related C-suite issues into account, Webex JTBDs give you an ability to target the majority of the C-suite as your potential buying group. We also worked in key end-user issues and common challenges related to mobility, device UX, and inter-generational demands.

Webex Jobs to be Done Summaries

In sum, we identified three starter Webex JTBDs and have presented them in the tables below.  These tables include the target C-suite personas, the C-level purchase priorities, the JTBD classic statement format, and a small amount of supporting third-party data:

JTBD 1	Workplace Transformation to Serve Agile Staff
Targets	CEO, CIO, COO
Priorities	CEO, CIO, COO
JTBD statement	- Employee engagement - Retain top talent - Productivity & execution
JTBD statement	“Agile workers are the future of our business but struggle with an antiquated and inconsistent communications experience. Webex offers ease-of-use, device flexibility, and analytics to transform the workplace and create a connected business environment. This helps us retain top talent and lets agile workers not only engage in the business but achieve greater productivity and execute against their targets.”

JTBD 1 key insight: Webex is not about meetings or calling but about managing your workforce, employee retention, getting the most from your talent, and the culture of your organization.

JTBD 2	Cloud Migration to Drive Growth Initiatives
Targets	CIO, CFO, COO
Priorities	- Drive growth initiatives - Control costs - Support distributed workforce
JTBD statement	“Moving business applications to the cloud is a strategic imperative. The cloud is key to growth and better supports our distributed workforce. We need a path to the cloud with minimal disruption and at a pace that fits our unique mix of site needs and budget. Webex provides hybrid support, flexibility, and channel support to let me move mission-critical calling, collaboration, and contact center applications to the cloud with assurance and confidence.”
Snippets of supporting data	“Data and Analytics” and “Cloud” are cited as #1 and #2 disruptive technologies (77% and 74% impact) affecting how businesses are running their operations, i.e., driving productivity, running workflows, moving goods and services, operating infrastructure, and carrying out business activities, according to KPMG, 2017.

JTBD 2 key insight: cloud migration is the number one initiative and all-consuming for many CIOs. It is a huge gating factor to growth and breakthrough leaps in efficiency.  Webex gets you to the cloud faster.  Tap into that.

JTBD 3	Secure Communications or Lose Our Jobs
Targets	CIO, CFO, COO
Priorities	- Protect customer data - Reduce loss of intellectual property - Manage compliance & reduce regulatory risk
JTBD statement	“Security is now a critical part of everything we do, especially with sensitive communications and customer data. I need communication and collaboration solution with security "baked-in" so we can focus on growth initiatives and sleep soundly at night.”
Snippets of supporting data	The Conference Board reported that US CEOs rank cybersecurity as their #1 external concern for 2019. Security is the #1 management issue cited by CIOs and other IT executives surveyed by the Society for Information Management (SIM).

JTBD 3 key insight:  security is  non-negotiable.  It keeps CIOs and other C suite leaders up at night.  IT staff lose jobs over security.  Piece-part security solutions create enormous amounts of work and headaches for IT.  Do your customers an enormous favor and remind them of the depth and breadth of Webex and Cisco security capabilities.

Use Jobs to be Done for Your Offers

We feel that these JTBDs offer a strong starting point to engage prospects and customers. Instead of talking “product-out,” your sales teams and marketing content should lead with the customer concerns, or “customer-in” challenges. Instead of talking about specific features, hardware, or phone systems, the discussion might start with business objectives, growth plans, and customer experience.

These JTBDs are just the beginning for partners. As partners wrap their unique capabilities around Webex, even more compelling JTBDs are created. You can tackle the bigger and even more important “jobs” of your customers by combining Webex solutions with your broader solutions portfolio. Partner services that align with Webex include network solutions, managed services, migration services, systems integration, and overall service assurance. Not only does this help differentiate your Webex offer, but it can you drive an improved overall experience and set of outcomes for your customers.

Another important consideration is where you can enhance Webex JTBDs in combination with additional Cisco technologies and services. This includes Webex combined with Cisco networking, hardware, security, and channel certifications. These extended JTBDs bring even more tightly orchestrated and compelling value to customers, and even greater benefits for the CIO and key stakeholders.

In conclusion, SPs face an incredible opportunity to target and win the $2.1T enterprise spend on digital transformation that IDC forecasts  for 2019.

To best address this opportunity, you should:

1. Embrace digital engagement,
2. Lead with Webex and the greater Cisco portfolio, and
3. Use advanced go-to-market frameworks such as Jobs to be Done.

Continue reading