Hello, and thank you for watching this tool cyber capsule. Today we are going to cover an introduction to Cisco identity intelligence.00:06My name is Sheila Vita and I am a security customer success specialist. In this section, we will cover three key things. We will cover the key identity security challenges.00:16But you might be running into in your organization, we'll give an introduction on what Cisco identity intelligence is, and we'll share how common identity data and insights help drive your workloads. We'll close it off with a demo of a Cisco Identity Intelligence interface.00:30There are three key challenges that you might run into in identity security. The 1st part is around limited visibility and how there are individual silos of information between your platforms and your alerts. One of your provider might have greater information about that particular use.00:51Source. And another might have the same.01:11Valuable insights, but only for entities in that environment. But in general, these platforms are not connected with its with each other and we can push data to a seam, but that normally does not capture events and only adds.01:15Some of the contexts that you have. 2nd challenge is around the gaps in protection. As much as we try to implement multi factor authentication as much as we have, we can. Coverage is not.01:31Always complete. The strength of the MFA used and overall device trust are things which also get lost when we are trying to protect our environment. Lastly, total visibility.01:46To get that visibility today can be a lot of work. We'll need to export each system, csvs or JSON files in response to management requests for audits. You might have heard another cyber capsule about the features of the Duo identity and access management.02:02Management.02:21And I've heard about our security 1st identity features along with our end to end phishing resistance. But today we are going to focus on the unified identity intelligence that CIA provides. All of these features together set on top of the world class user experience.02:22That Duo is known and loved for. So what is Cisco identity intelligence? Cisco Identity intelligence provides unparalleled.02:42Cross venture visibility delivering over 50 and growing critical identity posture and threat alerts to protect your organization. It provides this holistic approach from creating this user inventories.02:57Collecting information across all your different sources to monitoring different versions of accounts that you have in your environment from your employees to external users. It also captures information around your MFA adoption and usage.03:13And gives a robust identity reporting in analytics. You could also utilize this as you do your user or session investigation when an incident is reported. It provides this continuous posture and threat detection.03:30From the moment you light it up and every single time that it receives information, these are a list of the sample posture and threat checks that CII provides. In a nutshell, this is how.03:46CIA works. In the data source section on the left side of your screen are all the different ways that we could gather information, either from your identity providers, like your SAML based options like Okta, Google Microsoft, and even your Duo integration.04:04And recently we added active directory in the mix as well. Identity information might also reside from your HRIS systems and that could be added to your mix to help with the analysis. Information about your devices and your applications and other threat feeds.04:23Are also possible to be integrated in CII to help with how your overall insight will be analyzed. It can both come in a form of static data or event streaming depending on the source.04:43These all go inside the posture management and the section and response engine of Cisco identity intelligence and powered by checks would allow you to surface things that you might need to improve in terms of making your.05:00Overall security posture better. It can also provide information on how to detect certain tactics, techniques, and procedures and see how your admins are getting monitored. Lastly, you can integrate the insights that CIA provides into your operational.05:16Systems, whether that's.05:36Giving, giving you an ability to notify your administrators, integrating it to your other workflows like your secure access, login, access policies and insights into XDR and other messaging platforms and mitigation solutions that you have.05:38I have briefly mentioned that Active Directory Defense for legacy infrastructure is something that is recently integrated with CIA. Historically, we've had SAML based sources, but now Active Directory is something that we could also get.05:57User and group insights about and start highlighting on our checks. At the core of Cisco identity intelligence is what's called an identity graph. And what it does is it gathers information across all the identities that you have in your environment.06:15And it finds a connection among all all those different elements. So you might have a user existing in one of your identity source with all these attributes in that particular source you have.06:35That it's gonna connect it to the machines that they have logged in with and getting information from a HRI HRI assistance to get their employment status. You can then use this to drive your workflows and your platforms in terms of the access that you want to give them.06:51On the apps that they are accessing. The squares that we see here allows you to give the actions that you will be doing to remediate the findings that CIA highlights for you.07:09And CAI does this continuously, correlating the signals to provide a comprehensive, interconnected view of all the identity behaviors and elements in your environment. And this is what helps you understand who.07:26Is doing what, where, and with what to enable you to create stronger security decisions for greater efficiency. Cisco identity intelligence provides common identity data.07:41And in this diagram here, we've covered kind of like the the bottom part here where insights from multiple sources in terms of users, devices, networks, workloads, apps and data could all be fed into Cisco identity intelligence.08:00But the identity intelligence graph is actually a bi directional API and streaming. The upper part of what you see here is how CII is actually central to your Cisco secure workflows because insights that.08:16Are gathered and collected in CIA could be used to drive your policy decisions in duo, getting collected in XDR or driving your access policies and secure access, your firewalls and other Cisco security.08:32Solutions that you might have. Now let's do a quick demo of what the CII interface looks like. There are two ways that you could, initiate access to your CII.08:49From within your dual admin panel, if you go to monitoring and then provision, it will give you a setup to light up dual SSO access to your Cisco identity Intelligence interface.09:05In my setting here, it's already pre configured. So let me just show you what that configuration is for my setup. So I descriptively called it most secure Cisco identity intelligence.09:20And I have given admin access to members from this group of users. And then if I go back to that page where we were at, from this page, I could click launch Cisco identity intelligence.09:36And it will lead me to log in with a user which is part of my Duo configured identity sources. And this is one of my admins that I will be.09:55Using to log in to be given access to CII, and I am rightfully prompted for both primary and secondary authentication, which I will now receive.10:12And I'll skip the passwordless functionality for now, and this is what the Cisco Identity Intelligence Interface looks like. You are greeted with a dashboard which gives you an overall view of the different.10:30Components of your setup from users, non human identities to your MFA posture devices and applications. For the purposes of this demonstration, I am gonna jump to what's called an ISA report. And as ISA report is an overall view of all the.10:49Components which CIA have gathered and it.11:09Has this widgets highlighting your IAM hygiene, your MFA health, and the threat insights and unusual activity in your environment. Actually, let me switch to what's called a genie tenant that we have that.11:13Actually, the public has access to, to show you a setup which is more insights on it. Likewise, you are greeted with a dashboard. And in this particular interface, there have been integrations which are already configured, and integrations are both the data sources that we have.11:30Or the notification mechanisms that you might be using for your environment. In the setup, I do have any and every source that CAI supports because this is our demo environment. And then you also would see that we have some information here which are manually uploaded like CSV files.11:48About office information and our notification platforms in terms of.12:08Slack and other notification targets and ticketing systems. So we recommend starting with a dashboard to see the critical items that CIA recommends you take a look at. And then as I have mentioned, you have multiple tabs here and you could go through each one of them.12:14For focused information on specific aspects of your identity hygiene. On the options on the left is where you can deep dive for each one of those elements. So let's take users, e.g..12:34And the format is the same across all the pages. You select users, there are available filters here for you to segment the the information and once you've created the filter, you could select a saved filter there.12:49And we do have this information in users, applications, devices, non human identities which include both the AI identities and also the service accounts.13:04Practically anything non human identity you have in your environment. Checks is the heart of CII. These are the posture and the threat detection checks that allow you to identify what part of your environment needs correcting.13:23So let me take the NO MFA configured check, e.g., and it has a description of what a check does, and it will highlight for you the users that are failing that particular check. I'm gonna go into this.13:39Page a little bit in a little bit. Reports are the available reports that are prepared for you. If there is a report that you're interested in getting, you could click request report and give us much insight as possible and our team will review it and see what we can do with it.13:55We covered the integrations part, and then you do have your system logs and tenant settings. Now let me wrap the session up with an actual investigation of a check which was highlighted based on information gathered by CII.14:16So let me click this NO MFA configured check that as I have described, it will tell you the details of that particular check and give you a list of the users which are affected. So let me try to select.14:33Controversial account here, so we'll, we'll select this particular user who apparently has failed in not just one, but three different checks. So let me go back to that check real quick. And what you can do is click on any white space next to the user information.14:53And it is going to tell you information under recommended action for that particular user. Now let me close this one and let me click the user again because as I have described, this will actually link you to the user's page.15:12And from this point, you can get all the information about this particular user. We see that they have been exported from the demo Okta integration that this identity also exists in your datadog setup. And these are attributes directly pulled.15:28From those sources. It will tell you the activity that this user has done in a particular period of time that you could set, which is three days by default. Give you insights on the networks that they have tried logging in from, give you the devices.15:46That they are accessing the applications that are listed here. Moreover, much like where we started, it tells you where they are failing in terms of posture and threat detection. So for this particular one, let's focus on the NO NO MFA configured.16:03And we can see here that from within the CI interface, you could either send a notification to the notification sources that you do have, so someone can take a look and investigate it further, open a ticket for check, view the logs.16:22Or if you know that this particular user has a reason why they are excluded from a check, then you could do that from here as well. And in a nutshell, that's what the Cisco identity interface looks like. Now to wrap this module up.16:39We will give three key points and three key takeaways that we would recommend you check out after completing the cyber capsule. Cisco identity intelligence provides comprehensive visibility and insights for identities throughout your ecosystem.16:56So if you do have dual Advantage and up, we highly recommend lighting it up under monitoring and provision. Before you deep dive into analyzing CIA, we recommend that you thoughtfully baseline and segment analysis of data.17:14To get meaningful actionable items for your security cleanup. Lastly, the rich insights from Cisco identity intelligence drive overall Cisco security workflows because it helps you.17:33Identify if an identity is trusted, untrusted, unknown or inactive, and based from those depending on integration, you can use it to drive your access policies. Thank you so much for joining us.17:48On this duo cyber capsule session. Have a good one.18:04
