Hi, welcome to this Cisco Duo success capsule. This time we're talking about Duo desktop. I'm Catherine Zuniga, a security customer success specialist, and today I'll walk you through Duo desktop and.00:06How it bridges identity with endpoint posture to enforce zero trust access with zero help desk friction.00:20Let's check our agenda. We will go through a brief overview of this integration, then we will show you what the prerequisites are and some key components for initial configuration. And finally, we will work together on a simplified step by step guideline to get it done on our lab.00:27Okay, let's start with the overview. We all agreed that identity alone is not enough. Verifying user credentials for who is authenticating but fails to evaluate the device health. So compromise machines with disabled firewalls or unpatched flaws, torn legitimate logins into critical enterprise bridge vectors and more.00:49Hence, do a desktop shows up for us. Think of this app as the eyes and ears of our zero trust strategy. It's a lightweight application that sits on the user's access device, whether that's Windows, Mac OS or Linux, and it performs a quick non intrusive health check every time someone tries to log in.01:10Plus is the base baseline for many other dual security capabilities.01:30Let's get a good review of visits scope and configuration. Do a desktop is a key component for a variety of features, and that's what makes it the main character. So let's check a little bit about it. It unlocks do a passport, collects device health.01:36Trusted endpoints verification analyzes and enforces risk based hotters such as Wi-Fi fingerprint, device telemetry and acts according to the policies that we have configured. It also provides guided remediation for small fixes.01:52Let's see what the prerequisites are. Before deploying dual desktop, there are three main areas to validate. You 1st need to confirm that the organization has an eligible dual subscription and also make sure that you understand what dual capabilities are within is product team.02:10It can vary from essentials to advantage and premier tier.02:30You should also have an appropriate administrative role and have access, have applications that have access to the universal prompt. Second ensure that the endpoints are running supported versions of windows, Mac OS, and Linux. And finally, verify the devices meet the necessary hardware, network, and installation.02:33Requirements.02:54Now let's move to our configuration piece. We're going to cover the deployment, some policies that we can configure and some of the duo desktop capabilities. So deployment options, for smaller or self service environments, users can install the application when prompt b.02:56During authentication.03:16It really offers flexible deploy deployment based on the organization's size and device management strategy because besides that, for larger and managed environments, IT can deploy it centrally using existing endpoint management or software distribution tools to automate the process and provide a consistent experience across.03:18Cross supported platforms.03:38All right, now that our lightweight agent is deployed across your endpoints, you have decided which method you're gonna use, let's step into the admin panel and review the policy gates, the torn, the device visibility into real time security enforcement. Dual desktop policies allows us to make access decisions.03:42Based on the security posture of a device, not only user's identity, we can evaluate key controls such as operating system status, encryption, firewall, and supporter security signals.04:03One policies can also be tailored to specific applications, user groups with outcomes from monitoring to warning or even blocking access. And a major benefit is that users can receive remediation guidance when their device is not meeting their requirements that we have set.04:16Now let's study what the actual authentication flow looks like and what it is about. So we 1st start with a request from the end user and then do a desktop is gonna be doing proactive health checks. There is an automatic validation during.04:35Login is gonna check for OS version, firewall status, disk encryption and antivirus presence.04:55Before we move on into the authentication itself, do a desktop is gonna do a security policy enforcement. So according to what we have configured, access is blocked if security benchmarks are not met, preventing vulnerable devices from reaching protected applications.05:01And there is also an intuitive guided fixes, so users can receive clear step by step instructions via do a desktop app to resolve security gaps independently without a security ticket to your help desk team.05:19And finally, once everything has been verified, do a desktop lets the user continue with their authentication as long as the device is compliant with policies. Perfect. Let's move on now and take a moment to discuss the.05:38Telemetry.05:58Whenever an end user authenticates to a protected application, Duo does far more than record is simple, allow or deny. If admins go to reports authentication log in the duo admin panel, administrators can receive a complete time stamp forensic snapshot of the physical machine security.05:59The Posture at that exact time of the authentication. This provides security teams with continuous temporary system visibility into the hygiene of every laptop and desktop across the entire enterprise. And also remember the telemetry can be exported to your preferred CM. So that's another option available.06:19And now that we have covered enough about Duo desktop as a brief overview because all this information can also be confirmed and reviewed in our public documentation, we're going to move from concepts to configuration in our live demo. We'll switch over to our test endpoint, we're gonna run.06:40And a self installation, run a disabled local firewall and then see how do a desktop blocks the access.07:00Okay, so here I'm logged in already in my dual admin panel, and I've chosen dual Central as the application that I want to test the policies for dual desktop.07:10So if you go to the application, you can create either a new policy or you can just use one of the policies that you already have for some of your users. Remember that there are different policy types that you can apply. In this case, I'm using an application policy, so we're gonna work here with device health.07:27Policies test. I'm gonna click edit because this policy is already.07:47Configured, but we're gonna review what we have done. So the focus of this test is in the dual device health posture check capabilities. So for it to work best and get all the information that we need, we're gonna.07:52Request to a desktop as a policy enforcement for Windows machines and you can also do it for Mac oS or Linux depending of your case.08:12We're also gonna check for device health. So according to our OS system, we're also gonna enforce some security health checks that we want to have. So, e.g., bit locker, we want to make sure that we have all the information that we need.08:22For either our tests or your live environment. So these are the security health check postures that you can make with a desktop. You can check firewalls enabled, firewall as well, system password is set, you can exclude as well virtual.08:40The chance if you need to, and you can do it for windows, Mac OS, and Linux.08:59Perfect. Now, another important policy that you can add is device registration. So that means that once a user has logged in with in their endpoint with Duo desktop, Duo desktop is gonna register the device ID in.09:05To dual. So that's gonna create a record of the device and it's gonna map it to this user. You can even block devices presenting currently registered device identifiers so it cannot be used across other users if that's something that you need for your environment.09:25In my policies I'm also working with authentication methods just to show you that here is another part where duo desktop can be used because you can also use it for authentication. So that's another option that you have there.09:43You can definitely use it for risk based factor selection is gonna serve as a baseline to gather the information that you need. And you can also use it for trusted endpoints. In case we want to make sure that only trusted devices are accessing our applications, dual desktop is gonna gather that device.09:58Device ID is gonna help us make sure that only managed devices are accessing our application.10:18Right, so enough with the policies, this is already configured. I'm gonna go to my lab, and I already have opened the Windows machine that I'm using for this test. And what I'm gonna do is to log in to dual Central.10:25Now this user needs Duo desktop to be installed. Remember that we enforce it in our policies? So what it's doing right now is looking for dual desktop presence.10:47As it's not there and the user doesn't have any installed by their IT team because this could be also managed, but we're gonna do the self installation experience so you can see what the user will see.11:02And right now we have this prompt telling the user to install do a desktop. So we're gonna follow the prompt, and this is gonna take a minute. I'm gonna run it right here, and once it's done, I'm just gonna refresh.11:17And make sure that I have oh this is great. Remember that we also are in tra are enforcing trusted endpoints. So we're gonna make sure that our device is also registered.11:36Oh Perfect. Now what I have done is that I added a trusted endpoint for my Windows lab, and now that it's been added, I'm able to receive a push, and we're gonna check the locks in a minute.11:55So I'm making sure I approve the push on my cell phone and I'm in. And that's pretty much all about it. Now dual desktop is installed, that's great. We can perform a health check which already did because it would not let me access without it.12:14And something that we can do is that we can actually just disable the firewall to run a brief test. So here, e.g., I can turn it off.12:32And say, ok, I don't, I don't want it. I wanna see what happens. And if we try again to log in and I'll show you here what the device health is saying that the posture is.12:49Now it's gonna change and inform that firewall is not enabled and it's going to provide the user with some steps to remediate this and make sure that they gain access whenever they need to authenticate. So we can turn it on and again.13:06And we will be able to perform a health check that is compliant one more time. So perfect, let's check the logs for a minute. So again, if you go to reports, authentication log, we're gonna see.13:24What's been happening behind the authentications. So 1st of all, here is where we started. There are some locks that I've gathered, but basically what I want to show you is that when do a desktop is not installed, the user can authenticate, so it looks denied and it says that the.13:42Your desktop was not installed.14:02Now, once we had done the installation for Duo desktop, what happened next is that as Duo desktop is now gathering information, it analyzed and noticed that this was not a trusted endpoint, which is also enforced in our policies, so it would not allow the user to continue.14:05Once the trusted endpoint keys was fixed, which I added to our trusted endpoint configuration, and you can find more on the content that we have available about trusted endpoints, and this was remediated by the admin, of course.14:24Then the user try again and they are completely approved. Now, here we can see what information dual desktop gathered and we can see here how it checks device posture as well. There are plenty of information that will be reported thanks to Duo desktop, and you can find it all here in the reports.14:41Now Duo desktop also does the device registration that I mentioned during our overview, and you can see here how this user was registered to this computer thanks to Duo desktop device registration policy which was enabled before.15:01Perfect. Now, that's in a nutshell what Duo desktop can do for you. With our live verification, audit trail complete, we can jump now to a summary slide to review some key takeaways.15:21To conclude this Cisco dual success capsule, I'm gonna bring it all together. So let's start by saying that zero Trust cannot stop at identity verification by linking primary credentials and MFA with real time endpoint health, dual desktop closing.15:38Is the critical gap between who is logging in and the security state of their device.15:57It offers a seamless deployment either is self installation as you notice or a silent managed rollout. And remember that it also provides a strict privacy 1st architecture where only it is limited to inspect security hygiene only.16:03Also enforces continuous posture assurance across firewall, this encryption EDR through our enhanced security policies and allows the user as we could notice on our lab.16:22That the user can self remediate, which eliminates helpdesk tickets. All this data gathered on easy access authentication logs that could be exported to your favorite CM. So yeah, in a nutshell may I say in a capsule, that's our dear dual desktop companion.16:37
