Beyond MFA: A Zero Trust User Protection Strategy

Perfect, let's get started with today's session. Firstly, thank you so much everyone for taking out the time to join our latest Cisco security webinar.00:10Good morning, good afternoon, good evening based on wherever you're joining us from today. Today the topic for us for the discussion is a zero trust user protection strategy which spans beyond multi factor authentication. So we'd be spending.00:20The next about 60 min talking about this and and talking about how Cisco Duo and our user protection suite is going to help you secure every access point. Now I'll start with a quick round of introductions because all of us have put in a lot of time and effort to make this session worth your while.00:36I'm your host shreya Sing and I'm also one of the presenters and panelists on this webinar today. I'm joined by my amazing colleagues Anku Yasar and Andrew, all of us together want to make sure that after this 60 min session, you have all the valuable information you need about duo about.00:56User protection suite and you can go and implement some of these takeaways in your environment. So that's the objective that we are coming in with today.01:16A few housekeeping items as always before we get started. So you might have seen I've posted like a meeting code in the chat that is for your Slido survey that we'd be doing shortly, but basically we've put all lines on mute to make sure we can run this session smoothly. We have a dedicated.01:25The Q and A panel in the bottom right section of your screen. So.01:44Make sure you're posting in your questions while we are presenting. We have some dedicated time for Q and A towards the end of the webinar as well and also please tag all panelists when you are posting your questions so that all of us can see those questions and make sure that those get answered.01:48And this is a QR code that I would also be sharing in the upcoming survey that we have planned for you. So we'd be talking about this in detail shortly. So, let's look at what are.02:05About 60 min are gonna look like from here on. So we're already done with welcome housekeeping. We are coming up with an audience poll shortly. We start talking about why multi factor authentication alone is NO longer enough, right? If you're talking about your security strategy as an organization, if you're trying to secure users, trying to secure.02:20For your applications and access to those applications via multi factor authentication alone might not be the right move. We then talk about the Cisco user protection suite and the zero trust approach.02:40We then dive into identity trust, and risk based access and how you can utilize utilize this in your existing environment. We have some really fun demos planned for you as well. Yasir has put in a lot of time and effort to customize those for you. So we'd be walking you through those in today's session. And then.02:53Towards the end we talk about your overall security model maturity, use cases, deployment scenarios, takeaways from this session, and we have some time for Q and A and next steps.03:13So let's start by looking at where you are with your user protection journey today. So, you basically, I'm sure have some sort of, tool in place already, right? So where like where are you with your user protection journey? Like, do you only have multi factors?03:24Authentication on some apps, do you have MFA everywhere?03:44But NO device checks. Do you have MFA plus device trust or do you have risk based adaptive policies? I'm keeping this screen up for a few seconds. You have the Slido code, the QR code for Slido on the right hand side of the screen. It's only gonna take you a few seconds.03:48If you could just scan that, put in the passcode and give us your vote.04:09We'd like to understand where our audience is today with the user protection.04:13Okay, I'm giving you a few minutes to vote and while you do that, we are quickly gonna pull up the results on the side.04:32Let me know if anybody's facing any issues with logins, access, anything like that Perfect, so we.04:54We have a few words that have come in and and thank you for taking out the time to vote. Well, if you see the metrics based on the words that we've received so far.05:14A lot of people agree that as of now your user protection strategy only focuses on multi factor authentication on some applications. Then there is a 25 % work towards MFA plus device trust. The 3rd one is 25 % again for risk based adaptive policies, and then MFA.05:23Say everywhere, NO device checks. I think we have a mixed group and, you know, if you are on point A, e.g., which is MFA on some applications, I think this session is.05:43Really beneficial, and even if you are on MFA plus device trust, risk based adaptive policies, I feel like this session has a takeaway for everyone and we are happy to hear from our audience, some of our attendees on how they are planning out their user protection strategy today. So thank you for sharing those metrics with us.05:54The conclusion or the winning option is MFA on some applications so we'll make sure we structure our discussion around that in today's session.06:14With that, I think we are good to end this call and oh, we have some more more votes coming in, so I'm gonna keep this open for a few more seconds. Yeah 50 % people are on multi factor authentications on some applications already.06:22And we have a we have.06:41We're glad that we're doing this session. We have a group that can definitely benefit out of today's discussion. So thank you for sharing those metrics with us. Perfect, so we'll just stop the survey now and move back to today's discussion because we feel like based on what we've seen in the survey.06:43There are a lot of great points that you want to cover with you today. So we'll get started with that.07:03Now, to start this session and to set the stage for what we are planning to present today, if I were to tell you to hold one thought, that would be identity is the new perimeter and verify every access, not just the login. This is something that that should stay with you throughout this session.07:11And the reason we say that is because if you were to look at different surveys, even the surveys that Cisco's very own threat intelligence and research organizations Cisco Dallas has done, users are the easiest target for breaches.07:31And that is something that we are going to tackle today. Now let's look at a typical users Monday, right? What security tools frustrate users and attackers, how they're exploiting that, right? Now we've heard from customers because all of us on this call are working with.07:44With customers day in and day out talking about identity security, user experience, authentication, all of that. So we've heard that, you know.08:04The one common thing that everyone's trying to address is that I should be able to log into my work machine once and not have to sign into eight different applications. And sometimes when you have to sign into eight different applications, that also creates user friction.08:12And unfortunately user friction is not what's going to stop attackers from exploiting users. In fact, that could be the easiest reason why users could be relying on shortcuts, easier passwords, things like that, and that can become an entry point for an attacker. So let's look at one example that we see on our screen here.08:29A typical user working from home starts their Monday, they're logging into their computer, just the usual, they get a prompt to log into an application which they ignore, then they get a prompt to log into their VPN, which they again ignore, then they encounter high latency.08:48For which they raise a help desk ticket and unfortunately they end up clicking on a malicious site, which then means that without them realizing their credentials were stored, which then means that the attacker was successful in carrying out.09:08Which then means that an attacker was successful in carrying out an MFA flood attack, which then ultimately leads to a breach. So this is a very clear example of how your user can become the easiest target for an attacker to carry out such attacks, right? So that obviously tells us that these new ways in which attackers are carrying out these different attacks also.09:28Thing that we need evolved ways to protect our users and our systems. So let's look at the reality of all of this. I've already spoken about how users are the easiest target and you can see right 80 % of the breaches have targeted users as per Cisco Talos incident response data. And you know, we we feel that.09:48If if you attackers were to, you know, attack users, they have a variety of methods in which they're doing this today. They have things like social engineering, they have phishing email, MFA attack, something that we saw in the previous example. Then there's browser based attack, there's a malicious website stolen credentials.10:08Also something that we saw in the, in the previous example and the issue is not the fact that.10:28Organizations don't have security tools, they do. Most organizations today if you look at data, about 90 % 94 % of them have endpoint security, 93 % have email security, 97 % have access management, 78 % have secure internet access. So having tools or security tools is not.10:34Not the, not the issue here.10:54The issue is that sometimes these different tools that companies have are distributed across different vendors. So this is like a disjointed experience because and it's also very expensive, right? So this is a challenge that we are trying to tackle today and we're gonna be discussing more around how Cisco is planning to help our users with this issue.10:56And let's look at then obviously going back to the survey, a lot of us said that we only have multi factor authentication in our environment and the number was 50 %. Now, let's address the gap here. It's great that you have multi factor authentication, but unfortunately, given how attackers are evolving.11:16So that might not be the only thing that you need.11:37Right? Let's let's look at different ways in how attackers are trying to trick users. The 1st of course is push fatigue and fishing. So approved prompts can be socially engineered and not every factor resists attack. There are multiple ways in which you could actually combat this. You have.11:40Have methods like verified push you have different phishing resistant authentication methods that that would help you combat some of this.12:00But push fatigue is a very real scenario for users and a lot of users have been targeted via that. The next thing is unknown devices. Now, a correct login from an unmanaged or unhealthy device is still a risk, right? If your device is running a very outdated version, if your device does not have any sort of a screen.12:08In log or a biometric requirement or if it's an unknown device, a device that that has not been used by the user to access an application, that could also become an entry point for an attacker. The 3rd is a static policy. Now, the same rule for every context ignores very important criteria such as location from which the log.12:28Login was taking place, behavior and risk. So e.g., if your user has logged in from your office at 9aM. And then at 09:20 A.M. you're getting a login from the same user but from a location that's possibly 3000 km away, that automatically states that something's fishy, right? So you then.12:48Will have risk based adaptive policies to step up authentication methods for that user and.13:08If needed, block access for them. So that's something that's extremely important to have those risk based adaptive policies that vary based on context. And last but definitely not least, it's a very important point is siloed visibility. Now you have all these different fancy security tools in your ecosystem, but all of these.13:14If they are siloed, you.13:34Sorry, is there a lag in my audio? Just checking? I saw a message come up. Not fair, the audio is quite good May I proceed? Okay, thank you. The last of course is siloed visibility, so while you have all these amazing tools, security tools in your environment.13:38If these are separate tools spanning across separate dashboards, NO central visibility to identity to devices, to your users login life cycle journey, things like that, none of that is going to help you out. You need something that's integrated that's centralized and.13:57That that is something that you can track on an ongoing basis. So, so it to sum it up, now that we know that there is a gap, if MFA is the only thing you have, we're now gonna start talking about what is Cisco doing to address this gap. And for that, I'm going to sorry before that, sorry, I'm gonna.14:14Talk about one more thing, which is the three layers of zero trust user protection that we're working with today. And we've covered some of this in the previous slides as well, but the three layers that we work with today is strong authentication, device trust, and contextual risk based access. Now this is just diving in further to the previous depart.14:33That we discussed in the previous slide, but strong authentication basically means to understand if it is really you, right? And we are trying to move from password plus attack to verified phishing resistant proof of identity. There are different methods that we are offering via Duo for you to be able to do this. Like as I mentioned earlier, there is verified.14:53Do a push with number matching that defeats the push fatigue attacks that a lot of users unfortunately get targeted by. Then there is pass keys and two security keys for phishing resistant sign in. We are looking at a lot of organizations nowadays who have a management mandate to move to phishing resistant methods for authentication, so you already have that.15:13That available via duo. And of course, single sign on cuts passwords for all across cloud and on prem applications. 2nd thing is device trust. Can we really trust this device that your user's using to log in?15:33So a valid login from an unknown or unhealthy device is still a big risk. So you have to have certain policies in place to make sure that the device your users using has an upgraded OS version, there is firewall in place, encryption status, and other health signals should be tracked on an ongoing basis. And.15:45And if you have users logging in from, you know, devices that you have given to them as company owned devices, you could always tag those as trusted endpoints. So that separates from known and unknown devices if somebody was trying to get unauthorized access by their user account. And then untrusted or non compliant device.16:05Devices are blocked or told how to remediate. So if a device is you know running a very old OS version and and or the browser that they are trying to possibly access applications from is really outdated, there should be certain restrictions around that and they should be told to remediate before they can actually access applications in your environment because we don't.16:25On that weak device, that unhealthy device to become.16:45An entry point for an attacker to access applications in your environment. And the 3rd, I've spoken about this in the previous slide, but basically contextual risk based access. So as I was explaining, right, if a user has logged in from a certain location at 09:00 A.M. and then within the next 15 to 20 min they're logging in from a location that is potentially 3 h.16:49And 3000 km away, that's not possible, right? So we need to have some adaptive policies in place that assess the risk and then step up authentication for the users. You could set up these policies per app per user group and step up when the risk rises and these risk based signals can then trigger stronger verification.17:09And only when needed. So it's not.17:29Every day that a user will have to step up their verification every time they try to log in, it's only for risk is identified. And the 3rd of course is if for whatever reason you you see feel like this this request seems fishy, then you have the authentication logs that give your admins a very clear view of who, what and why in terms of.17:32Who was trying to log in, where they were trying to log in from and why we got that risk alert. So these are different ways in which you could track this, and these actually make up the three layers of zero trust user protection. So to.17:52Dive further into how Cisco is tackling this problem and how we are trying to frustrate attackers and not users. I'm going to hand it over to my Colleague to walk you through the remain next part of the presentation. Over to you. Thank you. Thank you Syria. Thanks for your wonderful start and for setting the stage.18:06So in this slide, let's see, and so in this slide, so we are basically going to look into the different you know available flavors of user protection suites in terms of the licensing.18:26Right, so let's talk about the challenge that every security team faces today. So how do we stay ahead of Ethicas without making life impossible for our employees? The goal here is simple, but.18:43Execution is the key, so we want to frustrate that across not the users. So the Cisco user protection suite is designed exactly around that philosophy. So we have structured this into two primary tiers starting with our essential track. So this is all about implementing zero zero trust.18:58For the individual users. So you get two advantage for the essential layer of identity intelligence, multi factor authentications and passwordless authentication. We pair that with secure access essential, which handle your web gateway and zero trust access.19:18Along with email threat defense to stop business email compromise before it even hits the inbox. So it's about building a solid secure foundation that users can actually navigate comfortably. So when you are ready to scale the security to the entire workplace, we move.19:37Into the adoption tier, so this takes everything from essential and adds significant layer of deft. You get secure access advantage, which brings in advanced capabilities like remote browser isolation and importantly data loss prevention for your gen AI applications, so which is vital for.19:56For keeping data safe as your teams use these new tools.20:16So we also include ICE premier for granular network authorization and secure endpoint advantage, which gives you deeper visibility into your device with malware analytics and risk based vulnerability scoring.20:21So this isn't just about individual components, so it's about the bigger picture. So if you want a truly proactive and a responsive security posture, you can pair this entire suite with our protection suite that gives you the full XDR integration. So, you are.20:37Not just reaching to threats, so you are getting a clear view of what's happening across your entire environment. Next slide please ok.20:56So now that we have covered the suite structure, you might be wondering how all these pieces actually talk to each other. Duo is really the heart of the user protection suite and it works seamlessly across both the essential and advantage tier to make your security smarter.21:12So in the essential tier, think of Duo as your primary gatekeeper. When you pair it with secure access, Duo SSO X as your identity provider. Running security policies right at sign in. From there browser based ZTA takes over to handle the connection to your primary.21:31It effectively limits escalation by ensuring only verified users get through.21:52We also see that same identity context being used with email threat defense as well by correlating those detection with within Cisco XDR. We are able to stop credential theft right at the source before it it becomes a bigger headache. Moving up to the advantage.21:58Last year we add even more intelligence to the mix. When you integrate Duo with ICE Premier, you are embedded MFA directly into your network authentication flows. It uses secure group tagging to ensure your access policies are perfectly aligned across both ICE and secure access.22:18Which is a highly effective way to stop the lateral movement of users and devices across your network.22:39Plus there is the integration with secure endpoint as well. Here those device trust and posture sex actually recognize the health of the endpoint. If a device is compromised or just showing signs of being unhealthy, it is simply denied access before it can cause any real.22:45Trouble.23:05So the thread that ties every single one of these signal together is Cisco XDR. So it takes that identity data, email thread, endpoint status and network signals and pull them into one unified incident view. It is really about getting that comprehensive visibility so your team is.23:06I'll start digging through fragmented alerts when every second counts. Next slide please ok to bring this all together let's look at.23:26So to bring this all together, let's look at what two zero trust for the workplace actually look like. It is about being able to secure absolute absolute absolutely every user and every device regardless of where they are.23:46And or what they are trying to reach. So you can see on this flow that we are not just looking at one piece of the puzzle. So we are addressing the entire ecosystem.24:06It states on the left, with the identity and device whether you are dealing with a human identity verified through duo, preventing facing attacks at the email layer or keeping tabs on machine identities via Cisco eyes and endpoint security. So all of these signals are cu.24:20Connected upfront. It is about knowing exactly who and what is trying to connect.24:40Covering everything from your managed laptops and BOID phones to on premises, hardware like cameras, printers, and even gas registers. The real magic happens when all the context flows into the enforcement phase, which is Cisco secure access. Think of this as the center.24:46Engine for your workplace by requiring sign in via dual SSO secure access creates a verified connection point that sits between your user and their destinations. It doesn't matter if they are heading out to the public web, accessing SAS and AI application managing IT.25:07The, devices are connecting to your private internal apps. The security policy flows them throughout the entire journey. So by standardizing on this flow, you gain a repeatable secure way to connect your workforce to the resource they need. It moves you away from fragmented security and into.25:26Way unified model where every access request is authenticated, authorized, and continuously monitored ensuring that your workplace remain productive.25:46And most importantly, it is secure. Next slide please ok we all know that facing is the most common entry point for attackers.25:57And without the right defense, one bad email can lead to a dangerous domino effect in a typical gap fill environment and expose email which is a user, they accidentally provide their credentials.26:14The attacker takes over their endpoint and then they have free access to move literally across your network. So it is a nightmare scenario that happens way too often. But with the Cisco user protection suite, we turned that around by giving you four distinct chances to.26:31Stop and attack in its tracks. 1st, email track defense blocks malicious messages before they even reach the inbox. If something does slip through, Duo uses facing resistant authentication to keep those credentials secure. If a device looks suspicious.26:51Secure endpoint automatically prevents it from accessing resources. And finally, if an attacker manages to get a foothold, the combination of secure access and eyes stops them from moving literally across your systems.27:09So we are essentially closing every gap that attackers rely on ensuring your environment stays protected at every single layer So do as an identity broker for 3rd party access. So many.27:25Using access for the people who don't work for your company like the contractors or vendors or partners is often a major administrative headache, right? So you don't want to clutter your primary identity provider with gas accounts that you have to constantly create track and.27:45So dual solves this by essentially becoming the directory for the 3rd party users. So you keep your employee in your existing identity providers like Andra Active Directory or Okta, but you move your 3rd party employees contractors in.28:06To Duo's own directory. So Duo Act as a identity broker, seamlessly connecting these external users to your SaaS cloud or on prem applications.28:25And even legacy applications. So it is a much cleaner, more secure approach that removes the need for extra gas switch or managing complicated account life cycle in your main directory. So it is secure, simple, and keeps your primary environment focused on your core workforce.28:37So finally, security is in a one time check at the front door. So it is a continuous.28:57Process of evaluating trust and responding to risk in real time. So we break this down into three simple stages. So 1st, we evaluate, is the identity healthy? We check if the user is active or not.29:13If they should even have access or not and how we can proactively improve their identity posture. Next, we authenticate the sign in, we ask if the specific attempt is safe by verifying if there is strong MFA checking for excessive privileges.29:31And ensuring the device and location are known and expected.29:51The final, and perhaps most important stage is enforcement continuously applying policy based on everything we have learned so trust is neighbor assumed and is always being reevaluated as condition change.29:56Next slide please share. Okay so how does this look in practice?30:14The beauty of, user protection suite is that, it is inherently context saver. Take this scenario, an employee is using a managed laptop on our known office network. Everything checks out. The device is trusted.30:27The health is good and they have used a verified duo post because all those signals are healthy. The policy decision is a simple allow. But here is the key if you have that context for any of other scenario listed on the left.30:44Like an employee or on a personal device, right? Unencrypted laptop or an executive signing in from a different country, new, new location, the system doesn't treat those requests as the same way.31:03The signal changes, the risk profile shift, and the policy decision updates automatically to match the new reality. So we are not applying a resid one size fits all rule here, so we are making intelligent real time decision based on the actual context of every single sign in attempt.31:19Okay, one policy model across cloud. So the final piece of the puzzle is consistency. In today's world, your applications are spreaded, some in the cloud, some on premises and many of many in the mix of both. Traditionally, this meant.31:43Managing fragmented security policies for each environment, which is where gap and mistakes usually happens. So with the Cisco user protection suite, we provide one unified policy model that works wherever your apps lives.32:02So whether you are securing SaaS and web application in the cloud using modern modern authentication like SAML or OIDC or protecting your legacy on prem resources like VPN, RDP or SSH. So you manage it all from one place.32:17By using secure access zero trust access for your private application. So you keep those resources completely hidden from public internet. So best of all, that policy actually, follows the user. You get consistent device trust checks across every application and your.32:34Logs and visibility are unified into a single dashboard. So this is how you eliminate the complexity of hybrid security.32:55To one policy, one model and complete visibility across your entire footprint. Next slide please. Okay so we have talked a lot about modernizing security and a huge part of that journey.33:04Is moving from traditional VPN.33:24To a true zero trust network access model. It's not an overnex switch, it's an evolution, so we start with the traditional VPN, which as of as we know, provides a broad network access level access that is notorously difficult to control at the application level. From there.33:27Many organizations move to VPN as a service model to get better control and easier cloud based management.33:47So the next lip is ZTNA, so where remote users move away from broad network access and instead get precise least privileged access to this specific private application they need. So finally, we reached universal GTA.33:54Which is the end goal, any user, any device or anything connecting securely with least privileged access to any application anywhere. The best part, you set the pace for this transition.34:12We use the same client and common policy throughout and you have the flexibility of both client based or browser based connection. So with that I'm hand, I will hand over to my colleague Yasil. So Yasir will help us to walk us through the demo demo part of this.34:28Okay, thank you for walking through what a user production suite does for our customers. So now it's time to show how this works, you know, two partners, same patterns supply chain vendor and existing logistics teams, all those come into the picture.34:51So today, you know, I'll walk you through two demos with a similar pattern. Demo wants completely deals with supply chain vendor who has a full access to vendor portal. The trust signal is a trusted endpoint, which is registered to do, you know, dual desktop basically. Whereas 2nd demo.35:08Revolves around external logistic team, they basically have a read only access to tracking, you know, a tracking application. The trust signal here changes, you know, we are not looking at a trusted rather we are looking on health of the device. Because at certain scenarios, you know, we cannot.35:28Maintain similar a level of trust, that's where the flexibility comes in. That's where we can make use of user production suite where you know, these two different partners are trying to access similar kind of an app with different privilege, just using their browser, they're coming out of traditional VPN relying on secure access completely.35:47Using browser based ZTNA and the, and they're relying heavily on Duo not only as.36:07A multi factor authenticator but also an identity part and then how the device check happens and all those things, that's what I'll go walk you through. Let's go to the next slide. See when it comes to identity mapping, that's where the strategy lacks. People often.36:13Up either leveraging their intra or whatever identities they are using IDPs.36:34And they end up losing licenses. When it comes to duo, you know, it can be used as a full blown identity identity provider or also it can be used as a broker. In this scenario, you know, each partner keeps their own.36:40Identity that comes with their own UPN, they don't need to change their login identity when they're logging to access the application. You know, they don't need to log in with cisco.com. They could be coming with their own identity which do is capable of supporting and it also uses different routing rules.36:55Which I'm going to demonstrate how it works. It's just what we do is basically, we can block anything right in the 1st example, what I'm going to demonstrate is that, you know, we have a vendor, basically they come from supply chain. They are trying to access an application using a trust.37:12Tested in point.37:32When they're using that application, a trusted endpoint, their access is working similarly if credential thread happened or the device got compromised, they're trying to use their personal laptop, how their access is blocked. That I will demonstrate to you, but I'm setting the tone right now how the behavior looks like. Next go to next slide.37:33So, basically, you know, when the user is trying to access despite, you know, they are coming with all security posturing from a posture perspective, everything is running, but they're not coming from a trusted endpoint. So that's where the policy, you know, kicks in and it's going to block their access. This is one part of the demo.37:53Again, when the same user comes with the same login, but they come from a trusted endpoint, their access works.38:13They're going, they will straight away access the application what they are trying to do. I'm a little bit rushing here because, you know, I want to demonstrate basically what we rely on is the authentication strike, basically, we look into the device part, you know, whether the device is trusted or the health is good. We can look.38:18Looking to the location where they are coming from and also on the behavioral analysis what we can do. I mean I can apply one policy.38:38Based on that and then we can take a different actions, you know, in one case we can completely allow the access. In other cases we can step up if the access is coming from a new country or something or we can block it completely if the device is trusted. This is more about the demo what you're going to see. Let's.38:49Jump into the next part. This is again a similar kind of demonstration where we are not relying on the trust of an endpoint wire or however we're relying on the device health, you know, but basically a bad actor could come could capture.39:06The credentials and then, you know, they are trying to use their own endpoint to access an application. That's where, you know, the device health part comes into the picture where we can look into see whether the disk is encrypted, the firewall is disabled or enabled, all those kind of things and then, you know, we can either allow an access or we can block an access. So what I.39:22What do is share let's go to the next slide. What I will do is I will walk through this process. Let me just share share my screen so that you know we can see this in action.39:42So let me just share my screen. You know, I'm relying on two components of the user protection suite. The goal here is to maximize the investment what you have done with Cisco. Just not only duo, but also from secure access. You could see my two different dashboards. What I'm relying on.39:55Is that on the use case what I mentioned, I've got two different users here, but one user, you can see that you know she's part of the logistic team and the user is created within Duo.40:15Okay, and they can make use of duo. They're using Duo as their identity and this is their they're maintaining their upn. They don't need to rely on a traditional UPN where which my company is applying, so I can allow them that way the identification becomes much easier how they are accessing and.40:29There is also a second user which I have created for the for the pair of trusting that's leavy, our supply chain partner. Again, this user is sitting within duo as an identity and these users are basically, you know, synced into.40:49Our secure access where you could see that, you know, the users are connecting through do as an identity provider where you know you can see those users are already sitting. They're coming from two different groups. When they are coming from this duo SSO users, these are the 14 users coming from that group and.41:05Also I have a user who are coming from my entry ID, which you can see here that you know when I'm syncing, you can see that, you know, let me go to a secure access application, how it has been synced. The users are provisioned into secure access from the dual that.41:25From a provisioning perspective, you know, you can see how these are the two groups which you saw there which have been sent into secure access and they will get an access. The moment someone leaves, I can block the users straight away in door rather than going into deleting from intra, and then deleting from secure access or deleting from a different identity.41:44I have just a one control. So what I have done is I have integrated the users, the users are activated, that's one part. 2nd part is we were talking about dual routing rules. You know when what I would do is I would just walk you through the routing rules.42:05Well, what do you mean by routing? You can see that I have got multiple authentication sources. I'm using entry ID, I'm using Active Directory as an external authentication source, and Duo also is an.42:22Will be used as an authentication source for some users. When it comes to routing use rules, Duo is quite you know easier to allow you to configure the rules you want. Like e.g., you know, my supply chain vendors are coming. I just create a supply chain rule, a routing rule.42:38I just select a group, whoever part of this group are part of this role, and if they are coming from certain domain, I'm controlling the domain name here, you know, whatever the domain they are coming with. I'm controlling here so that you know the the my access is pretty much limited to my trusted partner. I'm not going with any other.42:57There you know, I have that control and I'm selecting Duo as an authentication source. This is where we are leveraging more on.43:17Utilizing or maximizing the investment what you have done. So now what I would do is that, you know, these two users like what I shown in my example, they are trying to access an application, basically let me access an application.43:27For a supply chain manager you know the supply chain team. You know basically the supply chain team is going through an act application which has been hosted behind my secure access, ok? So it's a private application which is hosted behind secure access where the supply chain team updates.43:44You know, the shipping or the details. The moment they log into the private application which is sitting behind the secure access, it is taken to the duo SSO where they need to log in with an identity which has been created within Duo.44:04Okay, I just for the sake of easiness, you know, I copied those users. So I'm trying to log in to that user. Let me just enter the password here.44:21This is a typical login, how a user logs in and you know their access will go through. If the device is trusted, the access will work. If the device is not trusted, it will be blocked. You know, right now it's checking at the back end whether the device is trusted or not. You saw that trainer was talking about verified push.44:39That's what the user is, I want to ensure that you know the bad actor even if they get the credential that they don't need to fooled by pushed creating, you know, the end user is able to do a verified push and they could be able to access a private application which has been posted behind.44:59Find the secure access. They can go ahead and they can, you know, just go and do the updates for the shipping details, whatever they're doing, they can just go ahead and they can just see, you know, at customs.45:18Cisco just say this one they can update an application, they have a complete access for this one, you know, they can look into this. Imagine that, you know, the same user, same login credentials, they are coming from a machine which is not trusted.45:31You know, they've tried to access from an untrusted machine. Here I'm using a different machine, just assuming that that you know the user details got compromised or they started using a different machine rather than using a trusted endpoint.45:46The partner, you know, he shared the in order to simplify the screen, he shared the credentials with one of their colleagues and they want to fulfill their job. So they shared the credentials, let's imagine, ok? They try to log in ok they go through their primary credentials, they access the.46:04This one.46:24And they are expecting that, you know, the authentication goes through and they can access. So what's happening here is you can see that, you know, Duo desktop looks at the trust signal or the signals and they see that the device is not trusted. It is not allowed by the organization. They are coming out with an with.46:27The machine which is completely untrusted. So their access is blocked because that's how the policy is working. So that blocks my access here. So what I want to show you is that, you know, you can see.46:47What happened within panel? You can see at the initial stage, Lee was able to access the application. She was using a Windows eleven machine. It was coming from a trusted endpoint you can see.47:01It's a little small, I believe, but if it's it's a trusted by your desktop and where it is coming from, what's its IP and all those things, and you can see it's coming from verified push. That's.47:17The one scenario where the user is coming from a trusted source, Whereas in 2nd scenario you can see that, you know, the user was completely blocked because the endpoint is not trusted. You can see that, you know, the, the user is running encryption is off firewall is off, the agent could be able to see that, you know, the password is set for the.47:32Operating system. It's also having a security agent running despite matching few of the posture checks.47:52It's not a trusted endpoint. That's where the access is blocked. That's the beauty of duo when you combine multiple features of user protection suite. That way you can either allow an access based on the context what you have.47:58Rather than, you know, to go through and see that, you know, that the account takeover is happening. Coming back to the next scenario, which we were talking about, right? What just I was talking was that, you know, let me just close this session because, you know, the caching will be there which might stop me from accessing the access.48:15So.48:35Here is our second, you know, the logistic team city. He's trying to access an application. This time let's go or you know other way around, you know, they are coming from a machine where, you know, they have disabled encryption and all those things. It's a similar output, but you know the posture.48:36You know, you, you are not you going through a trusted endpoint option, but rather you're taking an approach of non trusting device. So when the user tries to log in, it goes through single sign on process again, you know, we are trying to access here right now with a tracking.48:55App that we use the tracking user which has been created within duo. So let me try to log in.49:15It's looking for, an authentication part. So let me enter the credentials and see whether my access will work or not. So straight away, you know, I'm not prompted for an MFA.49:20Or anything since the endpoint which I was using was not it didn't make the posture requirements here. You see that is capable of telling you what the things need to be fixed and it's also, you know, guides you how to fix that, you know, it says that firewall is not enabled here.49:37You can straight away go and enable the firewall. If the device is trust is posture is matching, you can look into that.49:57Or else it will box straight away. The same user, but if they are coming, let's say from, what do you call this from from a machine which is let me just minimize this. Yeah, if the same user is coming from the machine which is the posture is you know.50:05Which is Matt, they can straight away access that let me show you demonstrate you quickly, and then I will walk you through.50:24The logs So the same user which has been created within Duo had been panel with a different UPN.50:31So they just log in, it's looking for Okay let me try to log in You can see that.50:48So far I have not have been stopped. It looks like it's going for multi factor authentication. Let's see. So I got a push in my phone. I accepted the push, and then I can access the tracking application and this user is having only.51:05Read only access, right? So that's where the posture requirements are little less. We are looking into the compliance of the machine or the posture of the machine rather than trusted and he can go ahead and check read only access for the application what he or she has. That way you know we are not, We are addressing two things. We are not.51:24Only.51:44Stopping the bad actor from taking, but we are also relying on Duo's identity where, you know, you can create the user within Duo and you can apply the policies within duo. You can also control certain things from secure access, right? If this like a role based access control where.51:46Let's say that our user who is supposed to access just a read only application but they they try to access.52:06Rewrite part of the application that will be blocked, that can be gone. You can see in my 1st example, it's coming from a Windows server and the access was blocked because you know the firewall encryption was off sorry firewall was off encryption was off despite its training a security agent. That was the reason why, you know, the device health requirements were not met the tool was.52:15The reason why the access was stopped. Whereas in other case the access went through and the user was able to access.52:35This, like e.g. now this user goes through, you know, we are NO longer doing any business with this user. I just need to don't need to go at multiple places, you know, I just go let's say this user is NO more, I can deprovision the user straight away, you know, send to trash, this user will be thrashed and the moment.52:44The sync of happens between duo admin panel and your secure access panel, the user is deleted and if they are, he or she tries to access.53:04Their access get prompts. 2nd part what the 3rd part what Anku was mentioning about, you know, the user trust level, you know, you can see the user trust levels, different part here, you know, untrusted, questionable neutral, favorable trusted. These are all shown in your panel. If you come across any untrusted or questionable, you can go and see what.53:14Why it is, you can make use of the AI system you have and you can ask the question straight away why that user is untrusted or not. And also it looks into your identity posture, you know, what is the score of your identity? Higher the score better.53:34It's good for you. So that's predominantly what I want you to demonstrate from how Duo can either allow or stop an access for your private applications using Duo as an identity. Can you share, go back and share your screen?53:50Oh, I think I think I think we need to go back sorry so we have done with this all these things, right? I demonstrated them, then why it stopped. You can also test this in your panel, you know? Yeah, let's go back to one slide back this.54:10Oh NO NO NO NO ok I think it's little slow at my end. Let's go forward to slide number 301I want to go. Okay sure yeah so just I want to recap what I want to demonstrate here is that you know both partners are in dual directory. They are coming with the.54:26Their own UPN and both can reach a private app through secure access with NO VPN or secure connect client, right? Demo one demonstrated with a registered device which is trusted. Demo two demonstrated if the trust is failed if the health of device is full. So these are the two different use case scenarios.54:46Use which I demonstrated but this you can use it for your own way you know how the kind of use cases what you have. So the the key messaging what I wanted to share is make use of Duo if you're not using Duo in your user protection suite. What I see is that, you know, some of the our secure access customers.55:06Despite having Duo as an IDP, they are not using all the features that what we have. So.55:26For these kind of use cases, you can definitely, you know, leverage this and also start using Duo as an identity broker. That's pretty much what I want to demonstrate. If you have any questions, we can look into the Q and A session, and then I just want to hand over to.55:34Yeah. So for a great demo, so we now have a clear understanding of how to provision users from Duo into other platforms like secure access and how to enforce zero trust principles by verifying security posture, we also saw how trust levels allow us to create unified adapter.55:51The policy across these environments. So.56:11To wrap up things, so I want to talk about the security measured journey. So most organizations start out with what we call checkbox security. So it's an ad hoc silo and leaves you with major gaps in visibility.56:17And inconsistent enforcement. So it's easy to get stuck in that middle ground cons constantly paying the text for complexity and friction that comes with managing a dozen different point products.56:36So our goal is to help you move beyond that. The transformational phase is all about closing those gaps by forcing on a modern identity and access strategy implementing facing resistance MFA.56:49Consolidating VPN and ZTNA and getting ah handle on missing identities as well. So you stop being reactive and start actually controlling your environment. So from there you reach the sophisticated state, zero trust everywhere, so this is the destination.57:09Where you truly protect every user and every device. So we are talking about fully passwordless authentication, single vendor sassy and advanced guardrails for things like AI.57:28So you are not just patching whole holes anymore. So you, you have built a resilient architecture based on the principle of least privilege with end to end visibility and consistent policy that follows your users wherever they go.57:41Okay, so the the use cases so in the real world.57:58So to give you a clear picture of how this actually plays out in the real world, let's look at the most common ways our customers are applying in this suite. So the 1st is about.58:15Simplifying the experience for your own team, with unified workforce, SSO and MFA. So you get a single secure sign in for both cloud and on prem applications backed by facing resistant technologies like pass keys and verified post.58:31Second, we solve that vendor access problem we talked about earlier, so we can grant 3rd party vendors access to specific private apps without the administrative headache of creating guest accounts or forcing them to install agents.58:51So it is secure seamless and efficient. 3rd, we handle the reality of partners using their own hardware. We allow read only access, but only when the device health meets your specific policy requirement.59:06If they fall out to fall out of compliance, they get guided self remediation, which saves your IT team from having to manually troubleshoot every device. Finally, we are breezing the gap for legacy and on premises environments so you can extend modern MFA.59:21And ZTNA to your traditional VPN RDP or ssh's connections, bringing those older apps into your modern zero trust framework. So it is really about giving you a consistent, flexible way to secure everything from your core stuff to your external partners.59:41Yeah, let's look at the face part to zero trust. I want to leave you with a clear face part for your journey towards zero trust.01:00:01So you don't have to overall everything at once. So we recommend starting with one step. Establish your foundation, simply roll out MFA and SSO to your most critical applications. So this immediate step gives you strong identity assurance and a solid base to build upon.01:00:20Once that is stable, step two is where you add device trust by developing dual desktop and trusted endpoints, you can begin setting clear health and trust policies. The immediate outcome here is that you gain control and share only known.01:00:39And healthy devices are allowed into your environment.01:00:59Finally in step three, you adapt, this is where you turn your turn on the intelligence risk based policies and extend ZTNA through Cisco secure access. So by this case you have moved beyond simple.01:01:03Dates and into a model of consistent context error enforcement.01:01:23It is a logical manageable progression that takes you from basic identity security to a fully realized zero trust infrastructure. So to close out us, I want to leave you with three key take down that summarizes.01:01:29Our beyond MFA approach to security. So the 1st one is remember that MFA is just the starting line, not the entire strategy. So it is a vital piece of the puzzle, but to be truly secure, you must bear that authentication with.01:01:48Real time device trust and context every policies. So you cannot rely on password alone in today's threat landscape. Second, start trusting the device, not just the credential. So credential can be compromised anytime, but device health is much harder to fake.01:02:05So by leveraging tools like trusted endpoints and dual desktop health check, so you ensure ensure that even if someone has the right password, they still cannot gain access unless they are using unknown and healthy and secure device.01:02:24So finally aim for one unified policy model that spans your entire environment, whether your application are in the cloud on prem or in a hybrid mix, your security should be consistent. So our essential and advantage here are designed to give you that unified enforcement.01:02:40So you are not stuck managing fragmented rules for different parts of your business. So it is about creating a resilient scalable architecture that works for you, NO matter where your user or your apps are located.01:03:00So with that, I will hand over to my colleagues Sria to close this webinar, yeah. Over to you. And thank you yourself for the detailed demo I'm sure it was helpful for our audience today. So now is the time for Q and A you can post in your questions in the chat.01:03:16I know we've gone over by a few minutes, but we still want to keep give you some time to ask questions live and we can answer that on the go. In the meantime, some of the questions that we've often seen customers ask is that how do we move from MFA everywhere to risk based access without frustrating users? We spoken a lot about that in today's session.01:03:35So we hope you've been able to get an understanding of that. We also talk, we also hear about how.01:03:55We on board 3rd parties without intra Okta licenses. So we've spoken about that, where should device trust start managed laptop, BYOD or 3rd parties, and what does a realistic 1st 90 day of deployment look like? These are some of the questions that come up. So yes, we can share the recording with you after the session. You.01:04:03Also get a survey and this is the 1st time we've done a session like this where we talk about user protection suite in detail, what it entails, how every product works with you and so on. So we'd love to get your feedback on.01:04:23You know, you know, if you'd want to see more of these sessions in the future and yeah keeping this open for a few more minutes for Q and A And of course I'd also like to add that if you have any of these follow up questions even after the session, and if you would want to make some of these changes in your environment, because I know that when.01:04:36Some of the attendees voted 50 % of our audience was purely just relying on MFA and there was not a lot of focus on risk based access and so on. So please feel free to get in touch with your customer success point of contacts at Cisco and we'd be help you or we'd be happy to help you in, in figuring this out in your existing.01:04:56Been set up. We have about two more minutes for questions. If there are NO live questions coming up, we will be closing out the session in about two to 3 min from now. And yes, while.01:05:16Thank you so much, Sankar, thank you for joining. And while we wait for questions, there are some key takeaways that we have for you that we that are stated here on the slide. And then we also have, you know, feedback, we also have some.01:05:34Product pages that we've linked here in different qrs so please take some time to review this, ask us any questions that you have regarding some of the key takeaways and next steps. Okay, so we don't see any questions coming up. I know we've already gone over by a few minutes, so.01:05:51We should be good to wrap up the session. Once again, we would really appreciate if you could take out just a few minutes to answer the survey that you receive after this session. It just helps us plan our future sessions and we really hope this was worth your while. Thank you so much for joining us for this session. We have another one planned for.01:06:09For you in the month of November so we would see you then and of course if you have any follow up questions, please feel free to get in touch with your customer success team contacts and they should be able to assist you further.01:06:29Thank you so much for the appreciation, everyone. Thank you.01:06:43