Achieve Duo Outcome: Unified Identity Intelligence​

Hello, everyone, and good morning, afternoon, and nights to all who have joined. My name is Amika Chinoi and I am the customer experience programs lead for Duo within.00:10And Cisco customer success. For the next 45 min or so, we'll be reviewing the ins and outs of Cisco Duo unified Identity intelligence. So thank you all so much for joining as we have some really great content lined up for you today.00:20To get us started I'd like to introduce the duo specialists who will be presenting and assisting during today's webinar. All of our presenters and panelists today are seasoned zero trust Technical customer success specialists here at Cisco. Our main presenters today will be Rich Heblo and Aaron Hart and our panelists who will be working to answer your.00:33Questions as they come in will be Abid, Akanka, and Namita.00:53Next slide. So speaking of asking questions during today's session, you can ask questions at any time. In fact, we highly encourage it. All we ask is that you type your question into the Slido Q and A panel at the right side of your webinar screen, and our online panelists will respond to your question as soon as.00:58Possible. If you're currently unable to view the slido Q and A panel, please click on the button labeled Slido at the bottom right side of the screen to go ahead and enable it.01:18So with that, I'm gonna go ahead and pass it over to Rich to jump into the specific agenda and get us started. Thank you Rich. Alrighty, thanks Mika. Welcome everybody. So let's go over the agenda that we're gonna cover today. So 1st we're gonna get you introduced to the topic. We're gonna talk about some challenges.01:31Is that you all are facing today.01:51We'll then give you an idea of what Cisco can provide with comprehensive identity visibility. We'll then talk about a metric called user trust score. And then we'll talk about how this system can enrich your security stack. After that, Aaron will give a great demo of Cisco identity intelligence.01:53We will then talk about how Duo can help you with your user identity and access management issues, and then at the end, we'll send you off with some closing remarks. Okay, so.02:13We did a survey of 650 IT and security leaders, and we found that 73 % of them said that security is an afterthought in identity and infrastructure decisions. This means that.02:29In today's priority list, security is always behind three other top issues, whatever they might be. Security is always behind something else. In that same survey.02:4475 % of respondents said that complexity and identity infrastructure is a key security challenge. So what we've learned was that security is often an afterthought in identity decisions and complexity in identity is causing security issues.03:00Yeah. So let's look at some of the key identity security challenges. Number one, we have limited visibility. You have opaque identity infrastructure, there's NO centralized insights, and there's often noisy or.03:18Isolated alerts. Two, you have gaps in protection. There's areas where MFA coverage is incomplete or weak forms of MFA are being used, and you also might have limited device trust into applications.03:35And then number three, it all amounts to a frustrating user experience where we have high user friction. There's an increased IT burden to go across all the different systems and it all accounts for a clunky configuration. So let's talk about Cisco's comprehensive identity visibility.03:50And see how.04:10We solve some of these issues. So with the limited visibility challenge, for those of you who manage complex hybrid environments, this slide is not foreign to you all. We're juggling a mix of legacy and on prem systems like active.04:11Directory.04:31Alongside modern cloud IDPs like Okta, Entra and Google, all while trying to reconcile user lifecycle data from sources like work day. And the reality is that these systems often operate in silos and this creates significant visibility gaps. So when your identity data is fragmented across these.04:32Platforms, you lose the ability to see the full context of an access request or detect anomalous behavior across the entire chain.04:52This fragmentation isn't just a headache, it's also a security vulnerability, and attackers are looking to exploit it. And with Cisco's unified identity intelligence approach, we're bridging the gaps, we're unifying the sources.05:00Into a single cohesive view so you can stop playing catch up and start securing the entire identity life cycle. Now what we have here is an identity graph and this shows the foundation for Cisco's approach to identity intelligence.05:17In today's digital landscape, identities are more than just usernames and passwords. They're a web of interconnected relationships between the users, machines, the applications, and services. And this graph provides a good map of the identity's sprawl problem.05:37It allows us to see exactly how your environment is structured and how data flows across it. By visualizing the complex dependencies from the HR systems and cloud platforms to individual devices and sessions, we can provide deep actionable insights necessary to secure your infrastructure and ensure the right users.05:53Have the appropriate access to the right resources.06:13Okay, so let's talk about a couple of the things that Cisco Identity Intelligence can do for you. We've seen the identity graph and we've got an idea of how we're connecting the dots here, but let's look at some of the features. So among the features you have.06:18The ability to create user inventories, you can see MFA adoption and usage metrics again across all the different platforms you guys use. You I have the ability to get advanced reporting and analytics. It's easy to investigate the user sessions.06:37And there is continuous posture and threat detection. Now, the system uses something called checks, and there are two different kinds of checks. One, you have posture checks. Inside of posture checks, you see things like idle licenses, inactive user accounts, inactive guest accounts, week MFA configuration.06:54And then you also have threat checks. And inside of threat checks, you'll see things like MFA floods, admin impersonation, admin activity anomalies, and on the right hand side, in the bottom right hand corner, you get a little bit of an idea of some of these out of the box checks that Aaron is going to dive a bit deeper on when he does.07:15Just the demo, but that just gives you a sneak peek at what's to come.07:35Okay, so now that we have an idea of how or what information you will see inside of Cisco Identity intelligence, let's take a look at how we get this information. So on the left hand side, you can see data sources. These are all of the different locations.07:43Where we're ingesting information into the platform. All of this information, all the user, group, app, device, everything is coming into the platform, where we're getting posture management and detection and response out of the platform.07:59And then you also have outputs there. So on the right hand side, you see the take action column. And in here you see a couple of different things. There's a few different security products that Cisco owns that you can have, outputted information to, and we'll talk a little bit more about that in the coming slides, but you also see we have your IT service.08:15Management, the instant messaging platforms, and there's also also some remediation actions that can be taken directly from the platform. So you can have this information where you want it. You can have automatic ticket creation, you can have automatic instant messages to your help desk or your.08:35Your desktop group depending on what the situation might be, and you can also have users mitigating things inside of the platform if you wish. So what AD defense is one of the new products that has been released and this is especially interesting because.08:54Cause one area where my customers have been surprised is in the discrepancy between AD, on prem and entre user accounts. Often we think it's one to one. After employing AD defense, we see that that's actually not the case.09:13So with AD defense, what we have is, not only on prem information into identity intelligence, but we also have the ability to protect the hard to reach in legacy applications leveraging NTLM and Kerberos.09:27So this gives admins the ability to not only see on prem user identity and access, but take action by implementing two FA where it was not previously possible. Now we're gonna dive into user trust scoring inside the platform.09:43So user trust levels are based on all of the identity data. It's not just one set or source of identity data from, say, entra, but if there's Okta, tra, and Duo in an ecosystem, data from each of these sources will feed into identity intelligence and it will continuously calculate and affect this.10:04Singular singular user trust level. So the trust level is helpful as a prioritization metric. So e.g., you can say we have nine users who are now considered untrusted.10:24Why are they in this state? And this is gonna help you prioritize your daily actions. The user trust levels are really good for two things in specific. One, it's very simple. So you just have those five levels you see on the screen from trusted to untrusted. Everybody gets classified in that, in one of those.10:36Those buckets. But it's also making something.10:56It's actually very complicated, quite simple, and it's distilling it down to a single attribute. All of the different data sources and and this is actually a really powerful metric. Not only is it simplifying things, but it's also easy to explain. So what this means is we don't just give a random marker.11:00We don't just say, hey, it's just a number that doesn't mean anything. We say how the score was calculated, which of the checks.11:20Influence the decision in how we got to this point of calling somebody questionable, e.g.. And this is really helpful because a lot of times when I talk to customers, they say, ok, you said that trust score was untrusted, but what does that mean? We can quickly dive into it and explain this.11:27So let's talk about some of the use cases for the user trust level, and it can affect the authentication, authorization, and access decisions. It can leverage, you can leverage the score as a condition of the security policy, you can be.11:51Use to help limit access for untrustworthy users or at least require additional assurance. You can step up authentication or required.12:09A managed device as well. And then there's also some things you can do with Cisco Secure Access, ICE, firewall, and Meraki, which I'll give you some examples in the next slide. And then also as we mentioned for threat prioritization, it can help you influence the overall severity of a threat if the user trust level is.12:17Is questionable or below, then you might increase the priority of the incident.12:37So again, on its own, you can use the trust level to identify users who need deeper inspection, but there are some synergies like I mentioned to be had when you're using the other Cisco products. So if you have, e.g..12:45Cisco Duo, you're using Cisco secure access and you have secure firewall deployed in your environment. If you're using Duo and CII, one of which commonly is the case, one of the things that can happen is if CII identifies that a user's identity is compromised or behaving abnormally, it can.13:01The signal to duo to escalate authentication requirements, so it would force a higher authentication factor.13:21Or block the authentication attempt entirely, even if the password is correct. In another example, if you're using cisco's secure access tool, if a user's trust level drops due to a suspicious behavior detected by CII.13:27Secure access can automatically restrict that user's access to sensitive private applications or even force them to re authenticate. Now let's talk about how this tool is gonna help you with the rest of your security stack.13:44For those of you who are already using Splunk or Sentinel, your team has a significant investment in those tools, and instead of forcing you to log into a new console, we bring the identity context to you. The identity intelligence platform has built in essentially turnkey integrations.14:05That can be quickly set up to send data directly to these platforms. And we also understand that your SOC team lives in their sim and Soar tools. So to reduce further that swivel chair operation, the identity intelligence system supports open and.14:24Available data streaming via webhooks and AWS S3 buckets. And this allows you to ingest that high fidelity identity signaling into your existing workflows.14:44And that's gonna enable you faster incident response and automated remediation. And with that, we are gonna hand it over to Aaron and he's gonna give a nice overview of CII.14:54Give me 1 s here to share my screen. You just confirm that's good for you Rich? Yep. Coming through. Perfect. All right, thanks everybody. I'm gonna try and give you a kind of an overview of what everything is in CI.15:12Where it lives and kind of how to navigate. I 1st want to kind of call out here the how you get to CII and provision CII, right? So if you're a duo advantage or Premier customer, you come right into your duo admin dashboard, come into monitoring, and you'll see Cisco identity intelligence here. You click provision.15:31You know, this sets up with Duo SSO really easily, if you already have duo SSO, that processor is really straightforward. Even if you don't, it's easier than ever now with Duo directory to kind of stand that up. So I'm not gonna spend too much time on that today, but then you would once you, you know, you have that, you come into monitoring, you click launch Cisco identity intelligence.15:51I'm gonna be showing you a, a demo environment that we have, and this is an environment that you can also come in and play with and get your hands in the platform and kind of click around especially if you've learned better that way. We'll send the information to you post the, the webinar here and I forgot to.16:11Start my camera, so I apologize. So we'll send you this link, but it's dashboard.stage.org.io. And again, we'll get you that info so I don't expect you to remember that, but you'll come in here and click login. It's gonna bring you up to a prompt that's gonna ask you to like log in using some sort of social credential, google. I forget what they all are.16:31Or I'm using my Cisco credentials. But once you do that and you'll land on a page here, it'll ask you for the organization. That organization is going to be called genie. So like a genie in a bottle or something like that. So you'll, you'll click continue and then you'll, well now it's going to ask me to log in, I apologize, so again you can.16:51To pick there, I'm just logging in with my Cisco information. But when you land in identity intelligence.17:11And this is probably where you'll land. And actually if it's the very 1st time that you come into CII, you'll probably land at this setup page here. And this kind of gives you a quick little checklist of how to set up your 1st integration, gives you a little overview of CII, your 1st, you know, notification target and and things like that. So you can use this to kind of.17:17Walk through kind of initially setting it up, but then going forward, you know, you're gonna kind of land at your dashboard. What I like to do when I'm kind of showing off CII is kind of work backwards. So that's great because we have this all configured, but you're not going to, right? So the very 1st thing is if you were coming in to configure CII is.17:37We have this little puzzle piece here on the left for the integrations. You'll click on integrations and you can see this demo tenant has quite a few of them set up, but for you, you're not gonna have anything in here yet, so you'll come in and click add integration. From here, we kind of have the list of everything. So at the top, you'll notice the providers, this is kind of gonna.17:57Be the eyes and ears of the platform, the things that we're ingesting. So, you know, things like.18:17Okta, Entra, on prem AD as Richard mentioned earlier, we can bring in HR information if you happen to have, we have a direct integration with workday, but even if you have a different platform and it supports SKIM, we can bring in things that way or even manually upload certain information within the platform. So these are all of the pieces that we can get to.18:24Telemetry from and ingest into the platform to, to kind of analyze for you. As you kind of move down the page here, you're gonna notice the notification targets. So these are gonna be the places or the voice of the platform, the things that we're going to reach out when you know we notice something from those posture or threat assessments, you know, we can have.18:44That generate an email, it can go to, if you have a help desk system that, you know, it creates tickets via email, you could set it up just like that. But you can also, you know, send this out to, you know, specific teams groups, Slack, webhooks, Amazon S3 buckets, you know, Webex, all of that can kind of be customized and you can have.19:03Multiple different targets. So different teams, you know, might work on different things. You can kind of really co customize how that communication from the platform goes out to the folks that it needs to go to, really trying to reduce that overall noise that you can get from, you know, a platform that is ingesting this much data and really tailor.19:24Learning the messaging. As I kind of had alluded to here with like the email ticketing, we actually have two direct integrations with both Jira and ServiceNow. So if you have other of those platforms, the system can actually generate a ticket for you. And then again as Richard just kind of talked about and touched on the sim ingestion.19:44And we can send directly to Sentinel and Splunk. We have some API stuff as well. And then by default, the platform's going to send the email from our domain and that sometimes if you're direct targeting direct users or even your admins can people can kind of question, you know, or it can kind of hurt the deliverability depending on how that is. So we.20:03We do have integrations with sungrade and mailguns, so you can kind of customize that as well. So that's the overall kind of integrations page. The 1st thing you're probably gonna do is look at this list and go, ok, what are we gonna bring in? Maybe that's entra. You would simply click add integration here and every one of these integrations on the right hand side is going to have.20:23Documentation that goes out to explain how to set it up. So if I was to click on this, you get really nice, well documented instructions with screenshots from both platforms. Let's kind of kind of walk you through step by step what the settings are in this instance for entra. If that, if that's gonna look a little different if we were to, you know, come over to.20:44On prem AD or any of the other integrations. So, this is kind of where you'll start and land to kind of configure the pieces of, you know, where you want to bring in the data and then also where you wanna send that data out essentially. From there, we kind of take that data and we put it into four different buckets. So we have these.21:04Four buckets over here on the left, we have our users, we have our applications, our devices, and our non human identities. So if we look at, you know, non human identities, this is gonna be things like service accounts, shared mailboxes, and in today's world with the.21:24Need at which AI is happening, agent apps and and agents and things like that are being brought in and Duo's and and CII team are currently working on a lot of different integrations to really make sure that people can get their hands around AI as far as MCP servers and all kinds of things. But.21:42These are often accounts that have access. They have high levels of access and trying to separate them out from your normal user groups can be kind of tricky and trying to, you know, make sure that you're managing them well. So what this does is gives us a really good insight into those accounts and how they're being used within your environment. All of these.22:01So can it kind of be laid out in a similar fashion here? We're gonna have on the left hand side, you know, all of our sources and kind of all of the things that we can filter by. So if I only wanted to look at my Azure accounts, I can click here and kind of see these are, you know, the specific non human identities from within Azure only. We kind of get, you know, a base.22:21Line level of what each one of these are. We can click on these and kind of dive deeper into them if need be to look more at the account as well as, you know, again, we get like a quick level overview here on this page. I'm kind of moving backwards here a little bit. I'm gonna move into devices. Similarly.22:41You're getting an entire kind of inventory from all of your identity providers that any device that we are aware of from the telemetry that you're sending that has connected to your applications, right? So we have an entire list here of, you know, and and you're also going to see what platform that device is being used in. So in this case, this device is being used.23:01Used within Duo and within Azure, you know, is it a Windows or is it, you know, iOS? Is it a shared device or, you know, is it encrypted? We kind of get a quick, again, in whole high level overview right here, we can click and kind of get some more information here on the right side. One of my favorite things about CII is.23:21Not everything, but almost everything is clickable. So if you when in doubt try, you know, generally you can get additional context from, you know, just just clicking on the item that you're kind of interested in looking at. Again, on the left hand side here, we can filter by all kinds of different things, whether that in this instance is by the OS.23:41If I just want to look at my windows machines, I can kind of filter all of this, like customize and kind of, you know, really tailor that. Up at the top on all of these as well, there is a box here where you can use Kibana query language. And in this instance, you know, you can just search by serial number or a computer SID or whatever.24:01You might have to try and narrow down that specific device.24:21And then moving into that next bucket here, we have applications, and this is giving you again and a complete and entire inventory of all of the applications from within all of the different data sources that are bringing in. So if you're bringing in Okta, if you're bringing in Duo, if you're bringing in attra, we're pulling all of those applications.24:26Into this list and giving you a picture of not just that that application exists, but how it's being used in your environment. So, you know, if we look at this plugin right here, this five nine adapter, we can see that, you know, it's assigned to 46 people and eight of them have used it. It's got a 17 % utilization.24:46This can really help with things like application sprawl or if you're trying to track licensing from within applications to find out, you know, are folks still actually using this? Do we have, you know, applications that maybe we didn't know about? Somebody installed a plugin, we weren't aware that they had access to install, and now that's in our environment. It can really kind of help you get your.25:07Your hands around that and understand what's actively being used as well as again be used as something for you to kind of look at and say, you know, maybe we don't need to be paying for as many licenses to this product. It's it's going really underutilized. You'll also notice here that there's a sensitive flag. So by default CII will try.25:26And mark anything that it knows would have PII in it as sensitive. So for instance, you can see our workday integration here is toggled to sensitive. We're gonna know that that's an HR system. It's going to automatically kind of flag that, but you can also come in here and toggle these on and off as well. So in your reporting, you kind of know, you know.25:46How many people have access to those applications that are have, you know, PII or sensitive information within them? Again, these are clickable. We can kind of get additional detail through all of these and kind of look at, you know, what the activity of that application is, who's you know logging into it, and any additional detail here is, you know, we can pull out this.26:06Direct information and export it if we need to as well. One thing I like to point out in most of these is I think it's the users and the applications. If you've gone through here and you've clicked and you're like, I want my AD application and I want utilization of this specific amount, right? And kind of you've clicked a bunch of different filters.26:26That are helpful for you. You can save that as a filter so that you don't have to kind of rena re navigate that in each and every time that you come into the platform if there are views that you find helpful to use. And again, up here at the top, you know, we can search as well, but those filters can be really helpful especially if you've gone through.26:46Go and selected a bunch of different options to kind of really narrow a scope of something that you're trying to track, just to make sure that you can kind of flip through those quickly and kind of get a view of what you're looking for.27:06And then the users, which is probably where my coast customers at least spend the majority of their time when they're coming in and kind of like either threat hunting or trying to track down what's going on with the user. Really, you know, the users are still kind of the the biggest piece of identity here. So this kind of.27:18Again, high level overview that gives us an entire list of all of the users across platforms, and we can see those sources that the user's coming in from. We can see if the account is active. We can see as Rich was talking about earlier that trust level. So we get a quick kind of look at, you know, what that trust is for those users. You know.27:38How many different IPs they've logged in from, you know, all kinds of different information here. And again, we still have that, that, list on the left where we can filter and narrow this down. This one actually has an AI assisted search, which can be quite helpful, so if you're not an expert in writing Kibana queries, which I'm not either.27:58You can come in here and kind of say, show me duo, accounts without.28:18MFA, and you can use natural human language to write a query and it will translate that into that Kibana query for you and kind of pull that information up. So that can be really helpful as you're trying to narrow and track data down. The.28:26My favorite part of this though is when you actually, you know, you have a user you specifically want to come in and look at, we'll just randomly pick Aaron Park here and you click on it, and this is really kind of one of the, the nicest pieces here of CII from somebody who's trying to manage identity, right? When we look at Aaron's.28:41Page here on the left hand side, you're gonna notice you have a card for each one of these identity sources. So we have, you know, his Azure account in here. We can see when he was last logged in, you know, what his MFA was, what the passwordless policy is on this, all kinds of different information that's gonna be helpful and useful, but.29:01We also get that same card because he's being pulled in from Duo and seeing where all of that information and what that looks like from a duo perspective. We also get, you know, he's bringing brought in from workday. So his HR information is being brought in as well. So for every one of the integrations where this user is pulled in, we're gonna get this card.29:20And kind of.29:40This three 60 or identity graph as Richard mentioned earlier, and we're getting all of that information. We're also getting the activity flow, which I picked a really bad example here and I apologize, I'll show you one in a little bit later, but generally what this is showing is just where the user's coming in from, what they're hitting, and it can get.29:41Completely very complex or it can be really narrow scope, and we'll kind of go over that a little bit further here. But we get the trust level right here at the top, you know, and if you ever are trying to remember, we kind of covered that earlier, what the trust level exactly is and how it's weighted, you can kind of hover over here and it kind of gives you some context about what we're looking at.30:01Around the user's behavior and stuff like that that generates that trust level. You also see all of the authentication factors here.30:21All of the groups that the user belongs to, and I can click into this and pull up all of those different groups, the applications that they're allowed to access as well as unused applications, and they're most frequently. If you happen to have Jira ServiceNow and we have tickets in here, we can see these as well. And then in some instances, say.30:29And Park here is an admin within our organization and maybe he has a randomized admin account like admin 77743. We can come directly down here and link that user so that the system knows that that account is tied to him as well because not everyone, you know, there are certain scenarios where they may have an account to them that is.30:49Sign that might not match, you know, the criteria that we're pulling in there. So you can kind of manually navigate that as well. So this is just like a really high level overview and then all along the top here, you're going to see all of these different kind of sections that we're breaking out as far as the activity of this.31:09Specific user. So if this user's logging into, as we can see, we've got a windows sign in for we've got things going on with entra. We would see anything from Duo or Okta here as well. Basically any piece of telemetry that we're getting out of the activity logs from one of those identity service providers or any of those pieces of telemetry we're ringing.31:29And you're gonna see here in the activity log. We're going to see what networks that it's coming from. So we'll see, you know, the the if there's multiple different networks from different locations, you're going to see all of that information kind of broken out here. We'll see a list of the devices, so we can see that, you know, we have, you know.31:49Two different Mac OS devices and they've logged into, you know, Azure and this one into duo. We're also seeing the authentication device. So they're probably using Duo push, right? And we can see the iPhone 14 that's used for that. So it's really aggregating all of the devices that this user is using within your environment. Similarly for applications.32:09You're gonna get a list of the and all of the different applications that the user has access to. You're also going to kind of see how it compares to other users. If you have your HR data, a lot of times it'll show you a comparison to people in the other, the same department as them. That can be helpful in scenarios where, you know, if somebody has doubled the application.32:29Of everyone else in their department, you know, maybe that's a an issue where, you know, they transition to a new role and, you know, the the admin team forgot to migrate them out of user groups that they needed to be removed from. So it can kind of help you track that down and look for anomalies there as well.32:49We can also see, again, all of the groups that this user belongs to within here. So it'll pull from all of those different systems. And then lastly, we'll land on checks and I specifically picked this one because it doesn't have any checks. And Richard kind of talked about those a little bit earlier, but I kind of want to go through that with you now and we'll come back in.33:07Pick a user who's failing checks because these are all the data pieces, right? We talked about all the, you know, we brought the information in. This is all of the information broken out into these four different categories and that's great in everything, but what do we do with all of that data? And really the hard and soul of that is the check system. So the checks are what.33:27They're doing the heavy lifting, they're doing everything on that. They're looking at that telemetry. As Richard mentioned earlier, we have both identity posture insights, so things that are more around hygiene, things that you can change and manage, you know, whether that's users without MFA or users using weaken methods of MFA, right? Those may not pose an immediate flow.33:47Threat to your environment, but they're an overall hygiene issue or thing that you can manage to make the security better within the environment. And then we have identity threat insights. So, you know, you can, again, we can toggle back and forth. Similarly, just with all of these over here, we can kind of filter what we're looking for on the check side as well. So if we wanted to look at.34:07Got some posture insights, we can filter this here and look at all of the different posture insights we have. One thing I'll call out about checks is there's a lot of checks in here. You still are only gonna pull in checks that are relevant to you. So if you don't have Okta, e.g., you're not gonna see this Okta check because it's the system is not going to bring it up and highlight it for you.34:27So it will, it is smart in that way that it's just going to show you the checks that you have available to you. But, and then we have the list of that check. We kind of get a score of how you are doing within your environment. So if we look at, you know, NO MFA configured, we can see we're at an 82 %, meaning, you know, we have 18 % of our population.34:48That has NO MFA configured, and we can see this is critical. And again, you can filter based on severity as well because the 1st time you come into CII, you maybe a little bit overwhelmed with all the different amount of checks. So one of the 1st things you can do is kind of come in here, sort these by critical and look at what.35:07We've called out as going to be the ones that we perceive as to the largest threat and kind of look at those and see how your organization is doing and then kind of work to remediate those. So if we pick one of these checks, and I'm just gonna pick new MFA configured here because we were just talking about it and we can see we have a hundred and 60 folks.35:27Here that are failing that check and we click on it.35:47Every check is going to be laid out in kind of this way. You're going to have the details about the check. In this instance, this one's pretty self explanatory, right? These users don't have MFA configured, but that could be depending on what the check is, this will, you know, if you're not exactly sure, this will explain it completely to you what's going on and what we're.35:50Looking for as well as giving you the recommended actions of what to do to remediate that. So, again, what it is and how to remediate are on basically on every check that is provided from within CII, we can see the compatibility of the check. As I had mentioned earlier, if you, you know, if it's an Okta only check, you're.36:10And I see only Okta in here. In this case, this check is compatible with multiple different platforms, so you'll see each and every one that it is, as well as any of the frameworks that are kind of references to whether that's NIST or CMMC. We'll see that here and then kind of, again, does this falling like a compliance and identity posture or is it a threat ins.36:30Site will kind of get that information as well. You'll also find at the bottom down here all of the users that are failing said check, so we can download this list so if we wanted to assign, you know, someone to go and take a look at all of these, you can pull these down and grab them. You can also come in here and start clicking through these users and finding out who's failing.36:50Checks and kind of doing an investigation as to why they maybe failing that check. And then I want to call out on the right hand side over here the check settings. This is pretty important because every single check is going to have either different settings or they may not have any at all. They're not completely.37:10Be 100 % customizable, we're using the data sets that we're using, but some things are. So for instance, this specific check has a grace period of new accounts for 14 days. And, and that may work for you or it may not. Say you bring all of your users in and you know you onboard them and it's at least 30 days before they ever go to log in.37:30Then, well you're gonna wanna adjust this grace period because you know if this is set at 14 days and it's, you know, 30 days before a user gets in, you're gonna be getting information about that user failing that check on day 15, and there's nothing that anyone can do about it because the user hasn't even been onboarded yet, right? So you can, you can.37:50Scale this out to whatever you need it to be. Maybe you make that 45 days and then a user has essentially two weeks from, you know, when onboarded from 30 days in and then, you know, so again that these variables are gonna vary check to check. Not all of them are going to have the same things and you kind of want to when you're looking at each one of the checks.38:08Kinda wanna investigate what these settings are and kind of tailor them to your environment. You'll also see the notification settings on these checks.38:28So what do you want it to kind of, where do you want the report to go? And that's kind of those those pieces that we set up earlier, right? When we were talking about the voice of the platform, maybe we want one to go to a specific Webex group and and send a message there. Maybe we want another one to go to teams or to Jira or an Okta workflow or a webhook.38:37Right? You could have multiple different teams that work in different ways and still make sure that you're getting that information to them tailored to whatever it is that their workflow is. So, you know, really trying to reduce the friction and and lessen the amount of noise, really making sure that the people that need to get the information are getting it and they're getting it in a way that.38:57Is, you know, comfortable and easy for them to consume hopefully making it more likely that they'll be able to act on it as well. So that's kind of what each of the, the, the checks look like from from that perspective. Again, there are many different ones. You know, we have a whole new set of that them that have come in. Again, you can fill.39:17By the compatibility of them here. So, for active directory, these are all pretty new with the on prem AD piece that we've brought in and we're able to get, you know, they're, they're adding to this list, but we're able to kinda now see on prem and things before where the platform was mainly IDP focused. You know, now we can see inactive users on prem, we can see users that.39:37You've never logged in, and as Rich was talking about earlier, it is quite normal for on prem and Entra to not always match. You can have cloud only users, you can have service accounts that only live on prem, all of those different things and can can have you know difference in variance between the two platforms, and this can really help you get your hands around.39:57Those differences and if there's any legacy hygiene issues on prem, which there often is to try and and help navigate that.40:17I will call out kind of one other thing that I think is really cool and important because a lot of this information can be overwhelming. Like I said, when you come in and you 1st kind of look at all of these different checks and our score is this and we have these many people failing, campaigns. Campaigns can really help.40:27Help you kind of, you know, try and, and split that the you know don't try and eat the elephant all in one bite as they say rally, kind of split it up into bites. If you look at the templates here, you can create a campaign, say you're like, ok, we wanna clean up our our orphan accounts or dormant accounts. You can use these templates here and, and kind of create.40:46Day campaign that pulls in the selected checks that would help you do that. You can, you know, give it a name, you can make that dynamic or static, so meaning dynamic meaning, you know, if you set a 30 day window here and on day 208a new user starts failing, it'll scale them into the group, Whereas static is, you know, you start at day 30.41:06You know there's a hundred users in that group at the end of the the 30 days it's still that hundred users that, you know, you started with. And you can also target specific populations here. So maybe you wanna start with guest accounts or maybe service accounts and non human identities, right? I know the team is actively working on some things here too, to make this even more.41:26Little more customizable than it is now, but I have had customers find this as a really good way to get started and go, ok, we're gonna, you know, we're gonna start trying specific pieces of hygiene or a specific check even, even if it's not a group of checks, but the campaigns can help you focus that and and really help you look at the criteria of what check.41:46Are used specifically in some of these things, right? So, it can also kind of help distill some of those checks and what checks are important or may, you know, kind of be a cohesive kind of a package to kind of take a look at for you.42:06Then reports, the report reports are cool, but I think a lot of people get a lot of their information from the dashboard as well, but you can come in here and kind of grab and filter these by the categories. You can download these. You can also, you know, enable these and send these to those reporting channels, so if you need to spend, send a specific digest.42:22Of these, the reports that will show up here much like the checks are going to show up based on what you have the ability to get. So you're not gonna see a bloodhound report in here if you don't have the bloodhound integration set up, e.g.. So all of these different things are are in here and available for you. If there is something that is not available, you can.42:41Can always come up here and request a report from the team and kind of give them an explanation to what you're looking for. But these are are pretty cohesive, and again, you can grab them in a, in a CSV file, download them, and again it kind of breaks them out to you for you.43:01The place and going back to where we started, where I find that a customer spend the most of their time at least trying to do their monitoring and taking a look at things is going to be here on the dashboard. And the dashboard's broken up into, you know, really four main areas. The operations dashboard is just what's going on within CII, so our.43:15Are my integrations working, but mainly between the postures and threat, right? So as we talked about earlier, the hygiene versus the the telemetry kind of info we're looking at. So from a posture standpoint, we're looking at, you know, before we're looking at our users tab, we're looking at the posture of our overall user population. We're getting an idea.43:35Identity posture score that's here that's kind of comparing us to other organizations of our size and kind of giving us like kind of a measuring stick to look at, but then also giving us the recommended actions to make that score better. What checks are the users failing? What would help move the needle and what is the most important thing that we need to look at is right here.43:55Here on the dashboard. You know, you can see kind of a high level here of how many users of, you know, are in the environment versus never logged in, you know, kind of different things there. Again, as you scroll through here, we can look at the trust level, the, the risky user distribution over time, admin logins, admins per source, all of.44:15Kinds of different information here within the dashboard itself. This can be downloaded as a PDF, so if you need to send it to management for reporting, maybe you're in an audit and you need to, you know, prove for insurance that you have MFA, if we flip over here to the MFA tab, you can grab this report and say, ok, you know, you know, hopefully your environment.44:35Does not have, it's say a hundred and 60 people with NO MFA configured, but if you can, you know, provide to your auditor a nice big, you know, zero there or an explainable, you know, couple accounts there, you can kind of really take the burden of logging into all of those different platforms, aggregating that information, trying to combine it together, and just, you know.44:55Kind of make your life easier in that regard. So again, we're breaking the posture down into users, the non human identities, we're gonna get, you know, a baseline here as well. The MFA as we had just kind of talked about, it gives us an idea about what factors are being used within our environment. So if we're trying to reduce maybe weaker factors, we can kind of see.45:15How much SMS is going through our environment and, you know, how much is duo push or, you know, whatever that might be, we can get an idea of what those methods are being used in the environment, as well as passwordless enrollment adoption specifically as well and sensitive applications usage as we mentioned earlier, you can toggle that within the applications.45:35So again, we get all of those kind of dashboards and reports, if you will, as well, directly here. And if we flipped over to threats, we're getting something similar here on the threats page. We're, we're consolidating that information and looking at it from, again, those accounts that might be doing something.45:55That we're seeing is anomalous, right? So not just necessarily something where, hey, you should make MFA better or this account hasn't logged in in a while. This would be, hey, we noticed this account logged in and it hasn't logged in in a while. Hey, this user had unreasualistic travel. All of those things were kind of aggregating that risk and kind of throwing.46:13Showing here on the threat dashboard. So again, different, different teams might be interested in different pieces of these data or these different dashboards and they can kind of look at where users try to sign in from, and get a kind of a breakdown of a map here of where that is as well as like sign ins by country over here.46:33You know, account activity on insights and unusual activity, which this part right here can be really helpful because you're looking at your threats dashboard, you can come down here and you can also pull those checks that we're looking at right here to kind of see that unusual activity and kind of dive deeper into each one of those. And then.46:51Lastly.47:11The ISA report. So this is going to be kind of us aggregating everything together and kind of giving you an overall identity and accent management kind of hygiene report. This can be a report that oftentimes I see people send, you know, out to to their, their superiors on a fairly regular basis just to try and.47:13Give them an idea of what identity looks like within the environment. It's a pretty quick and easy to understand report, talking about, you know, how many accounts were identified, how many inactive external users, right? Like all of this stuff is, is pretty, pretty straightforward and easy to understand, as well as again consolidating some of the stuff.47:33From the other reports about like what MFA factors are in use, how many users have NO MFA configured, right? So this can be kind of distilled down into a little bit of everything and be a really good high level overview for somebody to get an over idea of the hygiene within the environment. So hopefully I didn't hammer on.47:53Too much there rich. That's pretty much everything. I I do implore you guys especially for those of you that have access to the platform already, if you're an advantage or a premier customer, take a look at CII, take a look, come into this dashboard that I've shown you today. Again, we'll send that information out. Click around. Again, I couldn't show you.48:13Everything, but it's certainly if there's something that piques your interest and you're like, I want to know more about that, come into the demo environment, take a look and and try and see if you could investigate that further and and kind of see if that use information would be useful to you in your own environment. And again, if you're an advantage or a premier customer, you already have access to this platform.48:33Platform. It's just a matter of setting it up and setting in the data sources and and you can, you know, obviously start making your environment more secure.48:53Hi Rich. All you. Yeah, awesome, thanks Aaron. That was fantastic, really comprehensive. I think you touched on something that everybody could value from. Like I all of my customers are either going through compliance audits, trying to cut costs via user licenses.49:06Or looking at, you know, who's using Microsoft Federation to skip over Duo MFA, so that was a really good appreciate that demo. So let me switch back to the presentation.49:22And let's wrap it up. Okay, so why is everything we've been talking about important? On this slide you see that from Cisco Talos, they reported that 60 % of breaches leverage identity as a key component.49:38I've seen numbers that are actually higher than this, but we, in essence, we used to think that MFA was the silver bullet and this latest Talos report shows that attackers are now focusing on session hijacking and MFA fatigue, and that's proving the point that we need the evaluation of risk signals that the identity intelligen.49:56Platform provides. Just having MFA alone is NO longer sufficient. We need to verify the trust of the user and the device in real time.50:16And now I want to take a few minutes and just talk about where Duo is at with identity and access management. So at its core Duo is a security company, and we recognize that a lot of orgs are.50:33Are increasingly frustrated by the complexity and limitations of legacy identity access management. So this slide illustrates the evolution into a comprehensive security 1st identity and access management platform that goes beyond traditional MFA.50:47By integrating our core strengths like device trust, as you see here, SSO and passwordless with new advanced advancements in user identity and automation, what we're providing is a smarter way to manage the entire identity life cycle, and this.51:02Shift allows you to move away from the friction of traditional systems intoward a more intelligent, automated approach that proactively minimizes identity risks while also simplifying the user experience.51:22And then here on this last slide, we want to talk briefly about Duo directory. So Duo directory, if you are not familiar, is a virtual Foundation that incorporates all the principles we have discussed today. It gives you the flexibility.51:40Ability to build your identity infrastructure exactly how your organization needs it.51:57Whether you want to run Duo's user directory as a standalone cloud identity provider for a simple fast deployment or if you want to integrate it with your existing IAM stack and utilize it as an identity broker.52:02Or maybe even you want to leverage it as an isolated directory for, more 3rd party contractors to save on licensed costs in your primary IDP like Entra or Okta. It can be customized to fit however your company needs it. So tailor it the way that you.52:18You want to use it?52:38And you're off the races with your directory. So that is the last slide that I have. So I'm gonna kick it over to Laura to wrap it up. All right, well thank you guys so much for that fantastic presentation on unified identity intelligence. And folks, as we.52:40To Wrap up today's presentation on Cisco Duo Unified Identity intelligence. We will be sending out the recording of today's session for future review. Also, please note that if you'd like to discuss your duo deployment further with a technical customer success specialist, we'll be including a hand raiser link for free engagement request.53:00Feel free to submit a request via this form in order to chat with the technical specialist.53:20To answer any questions you may have, review your current duo deployment and receive best practice recommendations to ensure a strong identity security posture within your application security environment environment. And so with that, thank you all so much for your time today and we look forward to seeing you.53:25You on the next one. Have a great day and goodbye.53:45