Getting Started with Duo IAM

Hello and welcome everyone to this Duo success capsule for the topic getting started with Duo identity and access management. My name is Haya Elzid, a security customer success specialist, and today I'll be walking you through the.00:05This agenda. We will start with an overview of Duo identity access management. Then we will cover the duo main building blocks followed by a demo of the duo admin panel walkthrough, and we will conclude with a call to action.00:20Let's dig in. Now that you're ready to take the leap to a fully secured identity infrastructure, Duo offers everything you need in one place. With Duo directory, you can easily sync users and attributes from external sources and as well create local Duo users as your main identity. Then leverage our role.00:39Bust single sign on and MFA capabilities to provide seamless access management.00:59Let's go through each one of these components. You can run Duo standalone with our Duo directory or thanks to our identity routing engine, you can use Duo as your identity broker. And lastly, you can use Duo side by side and existing IDP for your contractors or 3rd party.01:06Users.01:26Let's break this down. On the 1st piece, you can run Duo standalone. We've added a complete built in directory custom attribute store, so that Duo can serve as your one and only identity stack. Single sign on, user provisioning, all the basics that you need. But if that does not fit with your environment.01:26Duo can also now run as an identity broker in front of your existing identity systems to help provide a consistent secure layer and consistent user experience in complex environments with multiple IDPs. If you've ever acquired a company or been acquired, you know how messy it is to deal with.01:46These kinds of integrations or if you've ever worried about the problem of identity resilience and you don't want to rely on just one IDP.02:06We can use Duo as an identity broker today. And finally, if you don't want to put us in as your primary IDP, we can run side by side with your existing IDP for a subset of your user population, whether that's contractors, vendors, partners or other 3rd parties who might not belong in your.02:15The main directory. Duo now has three deployment models for maximum flexibility.02:35Now let's talk about Duo single sign on. Duo SSO is a cloud hosted SSO solution with robust MFA that allows you to define access to an unlimited number of cloud and on premise applications. Duo SSO is for SAML two point O and some open ID connection.02:41Act for OIDC applications. Duo SSO offers out of the box passwordless authentication reducing reliance on passwords for end users.03:01Duo single sign on can integrate with different IDPs and leverage dual routing rules. Let's look at this use case for routing rules. Organizations like yourselves have complex environments that often consist of a multiple identity providers.03:11And directories.03:30Whether that be Active Directory or other IDPs. With Duo SSO, we support multiple Active Directory and multiple SAML sources to be concurrently enabled. Based on a set of custom defined conditions, Duo will automatically route users to the appropriate downstream sources.03:32Duo Central is a cloud hosted portal that your users can visit to get access to your organization's applications and links. It is integrated within Duo single sign on, which means SSO login capabilities and features will be applied to the portal with custom configurations for.03:54Your organization like name or get help links. Duo Central gives you the ability to enable a duo hosted self service portal for your users to manage their devices.04:13Now let's talk about phishing resistant MFA. With Duo, you can enable fish phishing resistant MFA by requiring the highest secure options like web off Fido two standard or verified push. While we support SMS and phone call MFA, it is not shown here in the slide as it.04:26There's the lowest level of assurance type of MFA that we support and we generally do not recommend it.04:46Moving to a passwordless environment is a major step forward for organizational security. With Duo, you can eliminate passwords entirely, not just for daily access, but by removing them from your enrollment and fallback workflows as well. It does not matter if you are leveraging Duo direct.04:54Directory external cloud providers like oh or your existing on premise Active directory. Duo makes the transition seamless. Essentially, your identities NO longer need the password, allowing you to build a more secure efficient, and user friendly authentication experience.05:12Moving to device health and trust. Duo mobile has a built in security checkup that your administrators can easily manage from the dual admin panel. We know that an outdated OS.05:33Are easy targets for attackers to exploit and compromise due to the lack of updated security patches and known vulnerabilities that are NO longer being fixed by the providers. And how about phones that don't have screen locks configured? It's like hanging your keys on the front door.05:46Security checkup helps users identify and remediate issues such as disabled screen lock or out of date OS that may compromise security or block authentications. Duo desktop is a lightweight client that is installed onto your machines that runs in the background.06:05Once duo desktop is installed on a machine, the logo icon will appear on the taskbar and will have an easy and helpful user interface to review the machine's security posture as you see here in the example picture. Linux machines work a bit differently. Duo desktop does not present a Duo icon in the task.06:24Or on a Linux system as it operates as a background service only.06:44Due to this, the app has NO standalone health check or home screen. However, all the checks listed here continue to run and get reported for the Linux endpoints, allowing you to set up your policy enforcements just the same for the rest of your PCs. Duo desktop gives organizations more control over which laptop and desktop devices.06:49Can access corporate applications based on the security posture of the device.07:09Or presence of duo desktop installed on the endpoint. We can review these features one by one starting with the presence of Duo desktop installed on your machine, having your windows or Mac OS up to date. If the system password is set, if your system encryption is enabled and if the machine firewall is enabled.07:13Now we've talked about the dual mobile and desktop clients that can help strengthen all of your endpoints from mobile to desktop. We've checked and answered if your device is healthy and can set up enforcement policies if we find that they're not. Now, are your devices also trustworthy?07:35Our dual trusted endpoint feature allows you to combine all those device health checks and enforcements we've just talked about with an added device trustworthiness validation check. Some key components and benefits of adding a trusted endpoint validation check is that we're able to assess and confirm with high certain.07:53That those hundreds of multi.08:13Hundreds to multi thousand devices are safe and meet your organization's security standards before the users are granted access. But what about devices that aren't on your authorized list of endpoints to access your applications? We can block access from any unmanaged and unknown endpoints without requiring an MDM service.08:15Software in place, which will lead to minimizing the risk of unauthorized endpoint access to your protected applications.08:35Now how does trusted endpoints actually work? To secure your environment, we need the visibility into every device attempting to connect. Our device trust policy integrates seamlessly with your existing MDM solutions or do a desktop to verify that only trusted devices gain.08:43Access. If a device is out of date, unmanaged or unknown, we can block it automatically. Even better, we provide guided self remediation, empowering users to resolve their own device issues and significantly reducing the burden on your help desk.09:03Duo risk based authentication is one of our key capabilities. Duo can dynamically step up an authentication or under a membered device session when one of these risk patterns is detected. Duo captures data during your user's authentications. We can analyze the IP address reallocation, time sequencing, and pattern recognition to tell when a.09:22And an authentication seems unusual.09:42RBA comes in two flavors over policies. Risk based factor selection requires the user to complete a more secure form of authentication called a step up authentication when a risk is detected. 2nd one is risk based remembered devices. It builds on remembered device.09:46This policy by adapting the duration of remembered devices sessions in response to risk based.10:04Attributes like IP address history and Wi Fi fingerprint. Admins can configure how long a device is remembered with assessment of risk based on 30 days of successful authentications. We will be posting another success capsule dedicated to risk based authentication for more details.10:11Now let's look at the dual building blocks. These are the five dual building blocks we will cover in the next few minutes. Starting with administrators and users. Duo administrator accounts manage your dual deployment. These accounts are treated differently than a user account and is also managed.10:32In the dual admin panel.10:52To manage administrators and administrator settings, you need to be logged in as an administrator with an owner role. These are the admin roles available by default in duo. Each role with different access rights and capabilities, and you can also create your own custom admin role with dedicated rights as you.10:53You see fit to your use cases and teams?11:13Onboarding your users is the foundation of setting up your duo tenant. You can manually create users in Duo and you can sync users in the form an even wider range of external directories. Pull in users from Active Directory, enter ID, Google Workspace, Okta or in.11:18Open LDAP directory or use our admin API to build your own user sync. Duo can automatically email users individualized links to our cloud enrollment portal where they can enroll Duo passwords, traditional MFA factors, and passwordless capable authenticators.11:38When we set out to introduce support for dual passwordless, we decided to revamp dual enrollment as a whole. To do this, we separated enrollment from authentication. This gives you the freedom to control enrollment of new users and devices without impacting the way your users access their.11:58The applications.12:18Let's talk about configuring your applications and integrations. You can protect nearly any application with Duo. Remote access VPN, Citrix, Netscaler RDP, Web applications, legacy applications, OS logon, and robust API with SDK.12:23Is for popular programming languages.12:43The application catalog page on your Duo admin panel lists the different types of apps, services, and devices you can protect with duo. Labels shown on each application such as SSO and two FA indicate how Duo protects that specific application and what additional features maybe available.12:45Whenever you click add to add an application, a link to the configuration guide is available. You can also utilize Duo Central to create customized launching path of your protected applications. Here is some guidance on what applications to be added based on the type of protection that you want to have.13:06Now, how can you manage your users, your applications, and the access of these users to your dual protected applications? Let's look at the dual policy stack. There are four major categories of policies in the dual policy stack. Those that affect user.13:28Login behavior, checking device posture and health, make determination based on network characteristics. And those which check if an authenticator is secure or not. The policies available for you are dependent on your duo edition is marked here.13:46Policies are applied in Duo following this hierarchy. A policy can be applied to a specific user group on a specific application. That's the application group policy. To all users on a specific application and that's the application policy, to a specific user group on.14:06In all applications, that's the user group policy or in the default global policy for all users and all applications.14:25You can leverage the policy calculator which shows the president's order of policies. App group policies on top followed by app policies, user group policies, and the global policy as the baseline. And how the calculated policy draws each section from the top.14:34Top of the stock.14:53Remember that you don't have to enable every section for every policy, so the calculated policy could draw any given section from any layer of the stack. You want to keep an eye on all that's going on with your users and your protected applications and which policies are being.14:55Applied where. So at Duo, we believe that better design can enable better security. We also know that many customers have a sim.15:14Splunk, e.g., where they're aggregating logs from many different systems, often including Duo. Duo's built in logs and reports gives you your data with all the signals and NO noise. You're trying to figure out what happened, where, to who and why, and that's why, that's what we give you.15:24But these three reports will likely encompass a large part of what you'll need while configuring dual integrations or doing any troubleshooting. The authentication log is your go to for providing that clear who, what, where, when, why, how, that you need.15:44The authentication log also gives you information on risk based authentication sequences. For single sign on apps, the SSO log provides additional information on primary authentication and passport session details. Finally, the activity log, our newest report, aggregates all of the non authentication related logs that you care about.15:59E.g., users adding and removing devices via the self service portal.16:20Or admins adding new devices or APIs and directory syncs creating and deleting users and so much more. And as we said, Duo integrates easily with many popular Sim solutions if you want to export your dual logs for long term storage and high level analysis.16:25There are also a couple of dashboards that are worth mentioning in different places of the admin panel where you can see a visual representation on multiple data points in the application. We will see the summary view and the homepage in a couple of minutes when we do the demo, and under devices there are device insights which give you a graphical sort of.16:42To unfilterable view of the devices on your setup.17:02There are also specific reports like the deployment progress report or the policy impact reports, which displays exactly that. They highlight your adoption journey and see how certain configurations impact your environment. Duo takes pride.17:06In being not just secure but being easy to use. There are certain functionalities that allow us to lighten the load in the administrators and help end users self remediate. All of these are configurable per application and policies can be used to control access.17:23With the rise in phishing and social engineering attacks, it's more important than ever that users are able to securely manage their authenticators, whether that's replacing their old phone with the latest model or enrolling a new phishing resistant authentication factor, Duo self service portal allows users to take charge of these fundamental device management activities.17:40Without needing to reach out to the help desk. The self service portal is enabled on an app by app basis and protected by a standalone policy separate from your other duo apps. This means you can require stronger authentication factories to access the self service portal.18:00E.g., forbidding phone calls or SMS passcodes and enforce other dual policies such as trusted endpoints. Now let's go through the dual admin panel. Before we jump into the demo, I just wanted to describe the different editions of duo. So if you're just testing out Duo.18:15Go for a trial, you're on the do a free edition, and then we have our three paid editions, essentials, Advantage and premiere. The features available in the demo that we're gonna showcase today is on duo advantage. And you.18:35Can have different features depending on which edition you're on. The duo admin panel is your management platform for the entire Duo deployment. It is accessible from any browser supporting TLS one.two, which most modern browsers enabled by default. Depending on the duo edition that you have and your duo administrator.18:50The rule, the options presented will be different.19:10Let's look at a live duo admin panel demo. So the 1st thing you have to do is log in as an administrator and you can use a pass key for phishing resistant authentication into your duo admin panel. Once you're logged in, you can see that home report that we talked about.19:13The overview of your users, devices, authentication methods, and the recent, the last ten attempts in the authentication log.19:33If we go into the menu on the side, you can collapse it or expand it. The 1st is the home menu, users, devices, policies, applications, reports, and these are all the things that we mentioned in the slides earlier on.19:41Now, I can click on the help button and see all the helpful documentation, knowledge based articles, and what, what, what is the status of the dual deployment I'm on by going to the system status page. You can see your deployment ID and you can go into the.19:57Release notes from here to see what are the latest releases and the release notes from the dual product team.20:17Back to the dual admin panel. Let's explore the AI assistant. We haven't mentioned it yet, but basically this is your AI agent inside your dual admin panel where it's like a chatbot that you can talk to and ask questions like devices that have been recently registered. You can find all this information in the.20:24Reports as well, but this is an easy way to ask the assistant about it, get quick information and provide your feedback so we can always enhance and it can enhance itself and our product and engineering teams are always looking for your feedback here. Let's ask it another question to look at the last ten failed authentication.20:43In the environment with the applications and usernames affected. Now again, you can go to the Duo authentication log, you can go to the user profiles and you can see this information there. However, this is a way to pull that information quickly and accurately so you can keep track of what's going on in your Duo tenant.21:03And don't forget to always leave your feedback so we can always work on enhancing our AI assistants and other capabilities that you have in the duo admin panel. Now, let's go into settings and there are a few settings here that we haven't mentioned yet. E.g..21:22We can go into custom branding and you can add your logo and the colors that you want your pages to show. In notifications, you can enable notifications and user communications that are customized to your users or your admins. E.g., in the help desk message, you can customize the number that you want users to contact or an email.21:42Email address or a link that users can click on any universal prompts to access or or to reach the help desk.22:02We can also look at more settings like the lockout and fraud, and these are customizable settings per account. E.g., the unenrolled users, if users have not enrolled their devices, you can lock them out in 90 days, e.g.. You can also go to the dual mobile app settings like instant restore.22:12To for for easier user administrator of their own dual mobile applications.22:32Now I was logged in as an owner, but if I log out now and log in as a help desk admin, you will see how the dual admin panel will have a few differences of what I'm allowed to do as a help desk admin. The user list, the devices lists or the policies, they, not everything.22:37Is allowed for every type of admin and we showed that table of what's allowed and what's not per administrator.22:57Before we wrap up, I wanna leave you with a few calls to actions before we bring it home. And just keep in mind that you will find more success capsules about the different topics that we talked about today in this community page. And if there is a topic in mind that you have not seen, please leave it in the comment.23:06Or reach out to your duo account team or your customer success team. Thank you.23:27