Achieve Duo security outcome: End-to-end phishing-resistance

I'll right, folks, thank you all to those who have joined. Sorry about that little issue in the beginning there. Just wanted to make sure that we are alive and with.00:01Yeah, we are about a minute in, but I do see quite a few folks still jumping on, but in the interest of time, I think we are gonna go ahead and get started with today's webinar on end to end fishing resistance. So with that Shruti, let's go ahead and move to the next slide.00:20Okay, thank you. Again, hello everyone and good morning, good afternoon, and good night to all who have joined. My name is Amika Schnoy and I am the customer experience.00:48Programs lead for Duo within Cisco customer success. I'll be serving as the host of today's duo end to end phishing resistance webinar. Thank you all so much for joining as we have some really great content lined up for you today. To get us started, I'd like to introduce the Duo specialists who will be presenting.00:59And assisting during today's webinar.01:19So we'll go ahead and move to the next slide. Alright, all of our presenters and panelists today are seasoned technical customer success specialists here at Cisco. Our main presenter today will be Shruti Hoisala and our panelists will be.01:22Be, working to answer your questions today and they will be Adam, Abid Jay and Sheila.01:42Next slide please. Okay, really quick. I think I'm having some technical issues here. Just give me one quick sec.01:50So there we go. Okay I think I'm back. Sorry about that folks. I'm having some technical issues here on my end. But let's go ahead and continue on. So into.02:21Today's session, we do want to make sure that you have the opportunity to ask any questions as we run through the content. In fact, we highly encourage it. So we ask that if you have any questions, you type those questions into the Q and A panel, which you can locate by clicking on the three dots on the bottom right hand side of the screen and selecting the Q and A on.02:41Option. So I'll give everyone a quick minute to go ahead and locate those three dots. Again, Q and A is what you're looking for. That is where you're going to be entering in your questions. Please remember to select all panelists from the dropdown list, click send and one of our online panelists will respond to your question as soon as possible.03:01So with that, I will go ahead and pass it over to my friend Shruti to go ahead and jump into the specific agenda and get us started. Thank you. Thanks Amika. Welcome everyone, and thank you for joining. I'm Shruti Heisella. Today in this webinar, we will start with the problem, which is the identity.03:20City is the primary attack surface and traditional MFA leaks gaps. Then we'll cover the risks such as phishing.03:40Push fatigue and session theft that can still bypass protections. Then we will move over to the solution such as adapting phishing assistant MFA, strengthening device trust and moving towards passwordless.03:49In the end, we will close with the outcome of stronger security with more seamless and user experience. According to Cisco Talos incident response, 60 % of all breaches involved identity inside.04:06One way, whether that's credential theft or session hijacking or MFA fatigue attacks. This tells us something important. Protecting the perimeter isn't enough anymore. The new perimeter is the identity. When credentials are trust.04:25Tokens are compromised, attackers can move freely across systems. So when we think about phishing resistance, it's not just about blocking bad passwords or phishing emails. It's about breaking the attacker's ability to exploit identity as a weapon.04:46Securing identity is hard because attackers don't play by the old rules. We have moved past simple username and password attacks. Now we are dealing with fishing proxies, MFA fatigue, and even deep face.05:06Like social engineering at the help desk.05:24Attackers target weak points such as enrollment and fallback, mid session token theft, and the human factor at the support desks. Traditional defenses often treat authentication as a one time event. But Duo's approach is to make it a.05:28A Living adaptive trust model. One that continuously evaluates risk and maintains assurance throughout the user's session.05:47Attackers today don't just stop at brute forced attempts. They change their techniques, maybe start with password spray, then pivot to MFA fatigue and later escalate to session hijacking.06:01They will look for inconsistencies such as enrollment processes that are monitored MFA channels that can be spoofed, helpdesk processes that rely on outdated verification options. Understanding the full attacker life cycle helps us.06:18Identify where control breaks down.06:38And that's what Duo is solving by securing each phase of that life cycle with phishing assistant technology. For a long time, this was the mindset across the industry. Once we had strong authentication in place.06:41It felt like problem was solved. We introduced MFA, we implemented password policies, and we assumed that attackers would move on to easier targets. The login bridge especially the application login, this became the focal point for defense.07:00It looked like a straightforward formula. Users enter credentials verify with MFA and access is granted. But as we soon learned, the story didn't end there. Attackers of course adapted. When they couldn't bypass MFA directly, they started targeting the weakest link.07:18The users themselves.07:38They focus their efforts right here at the point of authentication, manipulating users into approving fraudulent pushes or handing over credentials in real time. Whether through fishing kits or adversary in the middle proxies or MFA fatigue attacks.07:40Adversaries learned how to exploit the human side of the process. In other words, they stopped trying to break authentication and started trigging people into completing it for them.08:00That brings us to where most organizations still are today. For many years, out of the box MFA, a username, a strong password, and a second factor, it has been considered good enough.08:15It stopped casual attacks and raised the overall bar for security, but good enough isn't good enough anymore. Today's attackers use advanced our automation, AI driven phishing, and session hijacking to bypass even the strongest traditional MFA.08:31That's why the industry and Duo is shifting from basic MFA to phishing resistant authentication. Securing not just the login event, but the entire session life cycle. Because our goal isn't just to authenticate users. It is to continuously verify trust every time I.08:50And everywhere it matters.09:10Once traditional authentication became harder to bring directly, attackers didn't give up. They expanded their targets instead. They realized that identity isn't protected at just one point, expands multiple stages of users life cycle.09:14So instead of focusing only on the application login, attackers now probe for weakness everywhere. They do it at enrollment when a new user or a device is added to the system or at OS login where credentials might still be crapped or reused. And at the application login, which.09:33Remains a primary entry point for many attacks, even during mid session where they try to hijack authenticated sessions. And finally at the help desk where human error or social engineering can undo even the strongest technical controls.09:53In other words, attackers stopped thinking like hackers and started thinking like identity architects. They map out every possible trust checkpoint and look for that one moment where defenses are weakest and trust can be manipulated.10:12And as they expanded their targets, they also upgraded their techniques. Let's walk through what this looks like across each stage. During enrollment, attackers attempt brute force or passwords pre attacks on newly created accounts. Sometimes before the employee.10:31Even starts, they know new accounts often have weaker initial credentials.10:50At the OS login, they exploit physical access or stolen device stolen devices to compromise local credentials or even cached tokens. At application login, they attempt MFA bypasses using adversary in the middle phishing kits.10:56Or push fatigue attacks. Turning MFA into a social engineering challenge instead of a technical one.11:16During mid session, once they are inside, they try to steal session cookies to maintain persistent access even after logout, what we call session hijacking. And at the help desk, and in perhaps the most concerning trend, attackers not.11:25Of use deep fake voice or video to impersonate users and trick IT staff into resetting credentials or MFA.11:44Every one of these techniques highlight the same truth. Attackers don't need to hack systems anymore. They just need to exploit trust. That is why phishing resistant can't stop at login. It has to extend across every stage where.11:55Test is established, reestablished and transferred.12:14Now, as attackers expand their targets and evolve their tactics, there's another challenge working in their favor. Identity sprawl. Most organizations today are managing identities across multiple environments, be it on prem, Active Directory or.12:20Multiple cloud identity providers, SaaS apps with their own user stores.12:40And often accounts that NO one even remembers exist. What that means is there isn't a single source of truth anymore. You might have duplicate identities orphan accounts and inconsistent controls across systems. Attackers see this fragmentation as an opportunity.12:47Each of these stacks from enrollment to OS login to application access to mid session all the way to the help desk becomes its own mini identity island. The more fragmented the environment.13:08The easier it becomes for attackers to find one week link to exploit and then move laterally across the rest. This identity sprawl makes defending the full access life cycle significantly harder. And it's exactly what Duo is designed to help.13:24Consolidate and protect. Now here's the reality. Most organizations do have strong controls in place. There is MFA at login, password policies for OS access, device toss policies, and help desk verification steps.13:43But even with all that, attackers are still getting through. Why? Because identity continues to be the most attractive and most exposed target. All it takes is one misconfiguration, one legacy avatar MFA or one helpdesk agent tricked into.14:02Setting a credential.14:22And the entire chain of trust can collapse. So even as we strengthen our defenses, we have to recognize that the attack surface isn't static. Identity is living, breathing and sprawling, and it demands continuous protection, not point in time control.14:24That's the shift we are making towards end to end phishing assistance, protecting not just login events, but every interaction where trust is established or reestablished. For years.14:45Priority has been uptime and connectivity, Making sure users can log in. Security has often come second mainly because adding controls used to mean adding friction. The result was, I AM systems that work but don't always protect.15:02We are seeing organizations rethinking that.15:22Realizing that security and usability aren't really opposites. With modern solutions like duo, it's possible to design for both Strong security that's invisible when things are normal and only steps in when something looks wrong.15:26Even security team has heard this before. Why do I have to log in five times a day or why am I getting so many MFA prompts? User frustration is real and if we ignore it, people start looking for shortcuts.15:47What Duo does differently is eliminate those redundant authentication events by establishing continuous trust. Once a user proves who they are and their device is verified, Duo lets them move across apps securely. Reducing friction without reducing.16:06Using protection.16:26It's not just end user, you know, admins feel the pain too. Maintaining multiple MFA systems, integrating different directories and troubleshooting authentication failures, all of this can be really exhausting.16:30Duo simplifies this by centralizing policy, visibility, and control. Admins can see who's logging in from where, with what device and take action immediately if something looks off. That operational simplicity translates directly into strong.16:48Longer security and definitely has less burnout for IT and security teams.17:07There are three key benefits of continuous identity security. The 1st one being cross platform visibility. You get a unified view of identity across systems like Workday, Microsoft, Okta.17:16Turning siloed data into continuous actionable insights. The next is stronger protection. It helps close security gaps by extending MFA and strong authentication across all applications, including areas that are typically hard to protect. The next is better.17:34For user and admin experience. Users get seamless, secure access with minimal friction while admins benefit from simpler management and fewer support tickets.17:54Achieving true end to end phishing assistance means more than enabling MFA on few apps. It's about securing enrollment, authentication, session integrity, and recovery all under one framework.18:12Duo covers that full spectrum, proximity verification passwordless access, session theft protection, and help desk identity verification. When every phrase is hardened fishing loses its power.18:30That's the holistic defense model organizations have been waiting for. Now let's talk about MFA bypass. Attackers expect multi factor protections, so they have developed a toolbox to get around them.18:47Common techniques include sim swap, portout attacks that hijack SMS or Y second factors, push bombing and social engineering to convince a user to approve a notification and more sophisticated relays or adversary in the middle proxies that capture.19:06The credentials and forward them in real time to the target application.19:26There are also cases where attackers compromise endpoints or steal session cookies and never touch the MFA fla flow at all. The important takeaway here is that.19:32These are not theoretical. Many of these techniques are automated and they operate at scale, which is why relying on legacy MFA methods leaves an organization.19:48Exposed. Most effective defenses today is moving to phishing resistant authentication such as and hardware security tokens. These methods significantly reduce risk.20:02Risk from attacks like phishing proxies, push fatigue and sim swaps because they rely on possession of a cryptography key or trusted device. From a security standpoint, this is a strong improvement.20:22The trade off is operational. Deploying and managing hardware tokens introduces additional cost of course, life cycle overhead and potential use of friction. In short, stronger security can come with added complexity. The goal is to strike the right balance.20:37Maintaining high assurance authentication.20:57While minimizing user friction and administrative efforts, the most or one of the most exciting innovation is proximity verification. This uses Bluetooth low energy field to ensure the authentication device and the.21:00Access device are physically near each other during login.21:20So even if an attacker tricks a user into approving a request remotely, the attempt fails because the phone isn't close enough. It's a seamless upgrade to a familiar dual push experience. No new hardware required but a huge boost in resilience.21:24We ensure that the access device and authentication device are physically closed. From a user perspective, the experience is pretty simple. Your mobile device just needs to be near your laptop while you are working.21:47Behind the scenes, the access device communicates with the authentication device. This requires dual desktop on the endpoint and Duo mobile on the phone using Bluetooth low energy to verify proximity. You can also require biometrics, adding an extra layer of phishing.22:05Assistant authentication. This approach is highly secure because it effectively blocks remote attack vectors. Treat threats like sim swap, push fatigue, and adversary in the middle attacks all rely on attacker being remote.22:25Trying to trick users or rio's credentials from a different location. With proximity verification, access is only granted when the authentication device is physically near you. Unless an attacker is in closed physical proximity, they cannot complete the authentication.22:44This significantly reduces the risk of remote compromise and strengthens overall access security. This is how one large telecommunication customer described their experience in after using proximity verification.23:04Stronger MFA it's a security requirement and we were struggling with the friction to roll it out more widely. Proximity verification using Bluetooth made it really intuitive and everyone is loving it.23:25It's the most used authentication method today for them. This really captures what Duo aims to deliver. Strong security without compromising user experience. With that.23:41We have covered proximity verification and MFA bypass. Before we move into session hijacking, let me show you a quick demo.23:59I'm sorry ok I'm really sorry I'm having technical difficulties here.24:16Yeah. In this demo, there are two parts. 1st, a user logs into a user Windows device protection by Duo with proximity verification.24:36Then we'll look at the access to web application like Salesforce. So in this, a user logged in into their Windows machine by just using their username and the user clicked login button. And then a Duo push was sent to their mobile device.24:54And as you can see, it happens everything quickly. I paused the video so that I can highlight the important parts here. So when a duo push was sent onto the mobile device, the, in the background, the proximity, proximate proxim proximity verification is happening, like making sure you're nearby.25:13And once that's done, a Duo push will be accepted and approved and the user gets, you know, logged in into their computer. Behind the scenes, Duo mobile is doing a lot of things to make this more secure. Now let's see, let's try to log in to a.25:33A web application. I will log into a dual central dashboard and through this, let's use Salesforce as an example application here. Now, when user tries to log into Salesforce.25:53You can see that MFA is already in process, a push was sent, and it's done and it's it's MFA has succeeded and user gets access to it. You can see it did, it did a push and it did a proximity check and it ensured everything was perfect, and then the user was.26:10Logged in and you can see that it's all pretty seamless and how quick the whole.26:30The pushing proximity verification is. Okay coming back, let's talk about session hijacking. Session hijacking happens when an attacker steals users session cookie and takes over.26:37Were their active session.26:56No password or MFA needed. Today's standard defense is reactive. Detect the theft, share alerts across systems and trigger a universal logout. It works, but it's messy.26:59Section isn't always immediate and forcing a logout can interrupt legitimate users and flood the help desk.27:18So while this direction helps, it's not a complete solution. It still leaves users frustrated and admins overwhelmed. Here's what the trade off looks like.27:29Security improves a bit, but user and admin experience take a real hit. Logging everyone out feels like control, but it's disruptive and hard to manage across complex integrations.27:45Ultimately, this approach reacts after the damage is done, which is exactly the gap attackers count on. So what is Duo doing? We are not saying that you shouldn't try to detect session theft and log everyone out, but we are.28:00Adding a new technique here, which is removing the cookie altogether from Duo's authentication.28:19Joe is removing the session cookie, so there's nothing for an attacker to steal. This solution is more elegant, but most importantly it is proactive. The attack is prevented before it happens, not remediated after the fact.28:27If an attacker goes to steal your session post authentication, there's nothing there. And the user experience isn't affected because they are inappropriately logged out. If something gets detected cause there's nothing for the attacker to steal.28:45And it's also so much easier for the admins as to proactively prevents the attack from succeeding. The admins don't need to configure their products for detection and response in case a session is being stolen.29:02Some of you may have heard of evil jinks. It's it is a fishing kit that people set up to steal credentials, but also session tokens. And here in a screenshot of it.29:21What you'll be able to see is, here it's basically when it works an attacker can steal username password, and they can even steal tokens. You can see here at the bottom of the screen. However, if you're using Duo with session theft protection, that token field.29:37Is returning nothing. It's basically null, which is really effective way of s.29:57Effective way to stop any form of attacks. It really is a much more elegant solution, so something that's included in our end to end phishing assistance. Enrollment and fallback are often overlooked attack surfaces. When a user.30:03Forgets their password or loses access to their MFA device.30:24They request a reset and that fallback process is where attackers thrive. A threat actor who already has stolen credentials can impersonate the user, trigger a recovery flow, and re enroll using their own device.30:28Similarly, weak or unverified enrollment methods make it easy for attackers to establish persistence under a legitimate user's identity. The reality is that many organizations still allow fallback to weaker.30:48Factors are unenforced password resets and then that's where account takeovers quietly begin. So how are organizations addressing today? Honestly, there's not much happening here.31:06Today. Most organizations, they rely on legacy enrollment flows that depend on passwords and they allow fallback methods that we can overall trust. Few have adopted stronger identity bond enrollment process that verify the user's identity before reestablishing access.31:25This leaves security low user experience inconsistent and administrative overhead really high.31:45This is a critical gap, and attackers know it. If a new account is created but MFA isn't set up yet, an attacker can easily enroll a device on user's behalf and take control before legitimate user even locks in.31:55That is why Duo is approaching this differently by eliminating passwords altogether. With Duo, we are unlocking complete passwordless enrollment and fallback. That means removing passwords not only from.32:12On daily authentication but from the very start during enrollment and recovery.32:31Instead of relying on a password reset, Duo enables users to securely verify their identity through phishing resistant methods and re enroll using trusted devices. The result is strong security, simpler admin workflow.32:39And a smoother user experience. No passwords to steal, NO weak fallback to exploit. Just a secure seamless process from start to finish.32:58The key security feature of Duo's directory is that it can be completely passwordless. Users don't need a password at all. Passwords can be removed from the enrollment process, the fallback process and.33:12Can even be prevented from being created for a user at all.33:32That said, in many scenarios, especially when syncing from an older external directory, a password may still be required. This doesn't mean Duo has eliminated passwords entirely.33:38As there are use cases where they remain necessary. The real benefit is for users created directly in Duo directory. For cloud applications and a wide range of other use cases, these users can start completely passwordless and be.33:52Configured to never have a password. This represents a significant step.34:12Forward compared to what the industry currently offers. In this last piece, we will be talking about social engineering at the help desk. Here an attacker tries to use advanced social engineering.34:18Sometimes even deep fake tactics against support staff.34:38We've actually had solutions for this for quite some time. I mean Duo had this in place. Duo offers a feature called Duo push verification, which is, which in most case is the right approach. Think about it. A legitimate user who hasn't lost.34:47Both their password and their phone on the same day can be verified easily.35:07Here's how it works. If a user forgets their password and requests a reset, help desk can send a push notification to confirm they are indeed the legitimate user. This was works perfectly when person is who they claim to be and only lost their password.35:13Now consider a more sophisticated scenario. An attacker impersonates, let's say, a CEO or a VP of a finance claiming they have lost both their password and their phone.35:34Demanding and immediate reset. They are leveraging urgency and fear at the help desk. Traditional security questions are effective here. Since attackers can often research answers in advance like someone's mother's made name.35:48So to a solution for that is adding a seamless identity verification at the help desk using a government issued ID. It's essentially a way to quickly reestablish strong test with.36:12The user. The process is pretty straightforward.36:31User completes a guided ID verification workflow showing a government ID and Duo conforms their ID through a secure step by step process. If we move to the next slide, you'll see we have this.36:35Verify yourself with persona, which is one of our partners where we can say, hey, if you use your government ID and complete the verification steps with them, you are trusted. We will reset your credentials, we'll help you with your phone. And this is really helpful especially in the age of.36:53AI where somebody's, you know, maybe doing a video screen and looks like the person or sounds like the person.37:13This is a great step to streamline verification at the help desk. Make sure they are who they say they are or and if they're trying to claim that they need everything reset. Here's the outcome we are in.37:22Aiming for. Frustrate attackers, not users. When you implement phishing assistant authentication the right way, attackers run into walls they can't climb.37:42While users barely notice the extra security, admins have all the controls. That's the dual difference. Security should feel effortless for the right people and impossible for the wrong ones. By combining usability with resilience, duo.37:54Helps you, your team stay protected and productive Attackers don't need to be creative. They just need you to be inconsistent.38:14They look for weak spots, outdated MFA, unmanaged devices or misaligned access policies. These gaps create what we call flimsy defenses, and that's where attackers thrive.38:33The key isn't adding more complexity. It's building consistency. Consistent enforcement across every application, every login, and every device. Duo helps eliminate those weak points, making it harder for attackers to find a way in and easier for legitimate users to do.38:50Get their work done securely.39:09Once those flimsy defenses dipsappear, the shift is traumatic because identity stops being your biggest risk and starts becoming your strongest perimeter. This is what that transformation looks like when.39:12That every identity, device and session is continuously verified, the parameter doesn't disappear.39:31It evolves. With Duo, identity itself becomes your new security boundary. Resilient, adaptive, and protected by phishing resistant authentication. The result is a stronger overall posture, fewer gaps for attackers to.39:39Deployed and a smoother experience for users and administrators alike.39:59That's the core of duo's vision for end to end phishing resistance. Making identity not just secure, but the foundation of trust across your entire environment. To recap, the goal is to establish strong trust.40:05Form enrollment. Enforce phishing resistant MFA everywhere, protects sessions with cookie less security, provide seamless identity verification and trust transfer, and continuously monitor with identity intelligence.40:25We believe end to end phishing assistance represents the highest level of security and in today's threat landscape, it's also the baseline requirement for defending against identity based attacks.40:44Choosing Duo for end to end phishing assistance ensures not only rubus security but also smooth experience for both users and administrators. Now I'll hand it over to Amika or our host for Q and A.41:00Wonderful. Thank you so much for that fantastic presentation on end to end phishing resistance should be. So let's take some time now to review some frequently asked questions and and a friendly reminder folks, if you have any questions and you haven't yet asked it in the que.41:20Q and A box, feel free to drop it in and we can have one of our panelists provide some insight.41:37So with that, we'll go ahead and jump into question and answer. The 1st question is how secure is Duo passport? What mechanisms are in place to make the session management secure? Alright, let me take this one.41:43Dual passport is actually, my name is Sheila by the way, and I'm a customer success specialist like everyone else in this group. Yeah, dual Passport is one of those quality of life quality of security improvements type of feature and at the heart of it is what's called the the dual desktop app.42:04Application, which is installed on the, that particular device that you are having shared SSO with. And a big part of the security.42:23Let's say definitions of passport is within Duo desktop. So whenever you light up a dual passport configuration, the dual desktop available on your access device goes through what's called the device registration process. And when, when that happens, a crypt a crypto.42:35Traffic key pair is stored on on the access device and then the public key is stored in the, in the dual cloud. And what that does is it ties that particular user, the account, and the access device, and in your admin panel, you could also see this registration process and that.42:55Gives the administrator the visibility on what devices are part of a passport workflow.43:15And gives them an ability to manage that. So in whatever we do dual passport, there's this requirement for TPM two.O or secure enclave if you're using Mac and that is to protect this payload whenever a dual passport workflow is initiated. So.43:22So in in summary, the core of the.43:42Security features of dual Passport relies on the duo desktop, having its secure payload and the device registration process. I hope that's helpful for anyone who is up for trying dual passport. Yes, absolutely. Thank you, Sheila for that level of detail as well.43:45Alright, next question. After changing the MFA mechanisms used in my applications to more phishing resistant methodologies, how can I see and report on the changes and ensure there are NO applications still using unwanted MFA methods?44:03Hey there mike. I can take this one. G Pearson here. So this is a question that comes up a lot in, in conversations with customers because ultimately what we really like to try and get out there as a concept is that you really want to be iterative in how you approach a product like duo. When you get access to it and you stand up your duo instance, you really want to.44:21Get through it and obviously start a POC and, and, and get a an application onboard, get some users using it. But as you continue to do so and you continue to bring applications, on, you wanna, you wanna go through.44:41You want to go through all the capabilities that are available in, in duo. And you want to try and make them secure like all the things that we've talked about here in today's session. But you also want to be able to see and report on how that's going. And so there's a couple of places that I, I call out for customers to to look at to sort of see.44:55As they go from, you know, MFA mechanism A to B to C and and down the line, there's a couple of reports that'll give a bit of that information. The primary one is, if you look in the reporting section of your duo instance, you're gonna see a report called the authentication summary. This basically gives you sort of the perspective.45:15Of what.45:35The MFA mechanisms are being used as, you know, a period of time. This is a report that you can scale out from seven days to a hundred and 80 days, and that'll give you the ability to see a bit of a trend and you can see as you go from MFA mechanism A to B to C, you should start to see the.45:37Those weaker MFA mechanisms slip off the the listings here and start seeing the more well defined and robust mechanisms becoming more prevalent. This is a report that can be printed, it can be exported and and used. Now, authentication summary or the authentication log, can also provide.45:57Information like this because it has a very powerful filtering capability which allows you to look for specific MFA mechanisms and then.46:18Report on those. So if you have people who are still using something that you don't want to see, you'll be able to see in the authentication log which applications are, are, are allowing that. I think the final thing I want to call out is that there is a tool that is available to duo accounts that are at the advantage or premier tiers.46:28Called Identity intelligence or CII, and one of the most.46:48Most powerful elements of this particular product is the idea of reporting on MFA mechanisms and giving you very granular visibility into the behaviors and mechanisms that are, are being used for your application network. So I'll call those those out as as the best ways for customer.46:52Customers to manage and monitor their MFA utilization.47:12Thank you Jay. Appreciate it. And great call out to CII. It's a very, very powerful tool. Highly recommend everyone to take a look. Again, it's available in Advantage and Premier tier. Alright, next question. Does the proximity verification feature work on all duo protected applications?47:18Yeah I'll take that one. Hello everyone, I'm Carson here. So the proximity verification only works with applications that support the the universal prompt, not the traditional prompt. And if you wanted to validate which applications.47:36Do support that, you can log into your admin panel, go to applications, and typically it's right below the configuration data at the top for that specific application and kind of right above the policy stack there. It's a little little section where it talks about the universal prompt. So if it's been a while since you've looked at an application configuration and and say it's.47:56In a couple of years, you might have deployed it initially on the traditional prompt. You can always go in and if you see that universal prompt section there, you can go in there and activate the universal prompt, and then for those applications you can start leveraging the proximity verification.48:15Perfect, thank you Adam. Next question. How does Duo's proximity verification using Bluetooth low energy BLE enhance phishing resistance compared to traditional hardware token based MFA, and what are the deployment considerations for scaling the solution across a large enterprise.48:30Right Amika I think I'll take that one. Hello everyone, this is. I hope you can hear me ok. So I saw a lot of questions on, on the chat as well and then on the Q and A as well as on the slides, there was a lot of information on bluetooth.48:52No energy so good to see that's of interest.49:12So on the duo, proximity verification, so normally it leverages Bluetooth and low energy to confirm that the user's device is physically near the computer, so it's a proximity thing there where the.49:17MFA device in this case a phone with with the with the application on it and then the dual desktop on the endpoint confirms the proximity, providing that phishing resistant authentication without the need for hardware tokens and and the other.49:33Items that I used for.49:53MFA. So this is an app native solution, it's, you know, simpler to deploy at a large scale. If you have Bluetooth enabled devices and and phones that are distributed or owned by own users, so it reduces operational costs because there is NO.49:56Well.50:15Use of hardware tokens as well as from the admin side you can see that there's less management of these hardware tokens and all the logistics that go into a help desk managing those physical tokens. So that makes the cost a little bit lower especially for.50:16Large enterprises. So what I like to do is to distribute that link about the proximity verification configuration, getting the details about how to configure it, but also doing the prerequisites, looking at what you need to deploy it.50:36And the two items are the more important ones. Once you have that, the actual configuration as Adam just answered the question before.50:55You should be able to do it on the universal prompt applications thank you thank you Evan. Appreciate it. All right, next question. How do you break or change a duo passport session? So e.g., one person can hold multiple persona roles at the.51:05Same time. If passport is enabled, they might need to log in as one user type versus another at different times of the day to do their work.51:25All right, let me take this one to continue my train of dual passport feature focus. So when we install Duo desktop as part of the dual Passport workflow, in your duo desktop preferences settings, there will be a new option called.51:36Remember sessions in Duo desktop and that little clicker there dictates whether Duo desktop is a play in your cookie or cookie less management or not. So if let's say as Amika was describing here, let's say you as a human has two roles both as an admin.51:55As an end user. If dual passport is enabled, the, the last, let's say you log in as an admin, that last session will be, will be remembered for the rest of your sessions. And let's say you want to break that and log in as an end user.52:15You could go to dual desktop preferences and then remove that, like disable the remember sessions in dual desktop flag. And then that will invalidate your session and then now you could, you know, like, log into your dual passport as, as usual. The other trick that.52:30That we we'd like to share is because dual passport is run by Duo SO.52:50In in the back end generally. You could also log into your dual central, log off from there, and that essentially breaks your active dual dual passport session, and then now you could log in as whatever persona you you want to be part of.52:56Also as an administrator, I just realized this as an administrator, there's also an option to, like mark a user as having them reauth the next time they log in. And that is another way to also break your dual passport session. If you are a person which are doing two role.53:15Roles in your organization with different levels of access.53:35Thanks, Sheila. Yeah, that's a great call out and a great question overall for folks to be enabled on. Appreciate it. All right, next question. How does Duo's risk based authentication also known as RBA, dynamically adjust security controls based on real time risk assessment?53:40And user behavior analytics and how can organizations balance security with minimizing user interruptions?53:58Amaka I'll take this one. So DO RBA risk based authentication dynamically adjusts security controls by assessing real time risks so.54:06You can think of it like if a endpoint is connecting to Duo from a different location, trying to log into an application or if it's now VPN versus non VPN on site all those kinds of things and many more.54:20All contribute to the risk based dynamic authentication attempt and then based on that attempt, Duo has decides whether it's in a location where it was before, it's been there before and stru trusted in that respect. And so the the real time assessment is made.54:37On the risk, why did this laptop move from here to there? Why this endpoint authenticating from here and this application has done it many times and all that kind of data. Based on that, it'll increase the.54:57Type of authentication enabling a step up authentication only when it's necessary and if that endpoint has deemed to be from the same location for the same app, NO change in behavior, NO change in endpoint then it can step down.55:13And continue to authenticate you normally, and this is very helpful to a lot of organizations that you still maintain the strong security but you reduce the constant fatigue, if you will, of users or or their interactions.55:31So the users are happier, security is not compromised in any way. So this improves user experience and the adoption of this feature. That's our BA. Thanks Avid, I appreciate it. Yeah. We have just a few more minutes, so real quick I'm gonna pick a couple.55:51Questions from the Q and A box and then we'll go ahead and wrap it up.56:11The 1st question is, does BLE functionality for proximity verification work on desktops that might not have Bluetooth functionality built in? And I think Sheila, you, you wanted to answer this question? Sounds good. Yes, NO fabulous question. The answer unfortunately, is it, it.56:16But not. The dual verify verified sorry proximity verification authentication method right now relies on the presence of dual desktop and the ability to connect with the machine which has the dual desktop instance and the.56:36The mobile device that you have. So Bluetooth is a requirement there and what makes that possible is your application needs to have the the dual universal prompt support because it kind of like drives that communication. So at, well, I will not say at this time because I don't know if it's in the roadmap or at least I don't have any information yet.56:55That it's in the roadmap, but at this time integrations which use legacy.57:15Types like radius LDAP as well as Windows log on, Mac log on, and all those type of integrations are currently not supported yet with proximity verification. Thank you, Sheila. All right, one last question.57:24Is proximity check via Bluetooth available for RDP sessions and vdis? Does it require some type of Bluetooth redirection to work? And I think Sheila, you again answered this in the chat. If you want to take it, otherwise anyone else can jump in. Amika, that's that's the one we just we just answered. Oh, I'm sorry. I was reading the wrong one.57:41Is there a way to verify a user is who they say they are that doesn't involve extra service like persona, like sending a push notification or text with the code?58:01Yeah, so Sheila answered that one in the in the thing the the Q and A channel, but ultimately that mechanism that she outlines in the the user page is probably the best bet for that, but it ultimately requires that person to be onboarded and validate.58:10And confirmed in the 1st place. So I think check that URL that is provided cause that's probably the the best mechanism for that.58:30Thank you Jay. Appreciate it. All right. Let's go ahead and move to the next slide. Wonderful. All right, as we wrap up today's session, there are a couple things that I wanted.58:40To point out to make sure all of you are aware of. The 1st is that a recording of today's session will be provided to everyone via email. In about three to four days, we'll send out an email that has not only the recording but also any links that we provided in the chat today. So if you didn't have access to the Q and A or the chat box, NO worries, we'll make sure that.58:59We provide that information in the follow up recording email that we send. Also wanted to note very, very important we got this this question in the Q and A, but I wanted to highlight it again. We do offer the opportunity for you all to request a technical customer success specialist engagement. All of our presenters as well as our panelists today are.59:19Our customer success specialists with duo. And so it's a great opportunity to, you know, take some time to work one on one with an engineer to review your deployment, to have them answer any, you know, questions that you have, make best practice recommendations. It doesn't have to be questions around the content that we covered in today's webinar, but it is a good opportunity.59:39Opportunity to make sure that you're, you're syncing with a specialist to make sure that you have the strongest zero trust posture that you possibly can for your deployment. So please keep an eye out for that email. And with that, I wanted to thank everyone for joining today's webinar. We do have a number of webinars coming up in future months, so please keep an eye out for the.59:59Those emails, but we appreciate your time and we will see you on the next one. Thank you.01:00:19