Breaking Active Directory Attack Paths with Cisco Duo: From Visibility to Prevention

Thank you again everyone for being a part of today's customer success webinar for Cisco Duo. Good morning, good afternoon, good evening, based on wherever you're joining.00:10Bringing us from today. We welcome you to our session where we talk about breaking Active Directory attack parts with Cisco Duo and how we help you move from visibility to prevention, enhancing visibility and enforcing zero trust access controls.00:20A quick introduction for your team today. My name is Shreya Singh. I'm one of your presenters and the host for today's session. I'm also joined by my fellow colleagues and your other presenters for today's session, Yasir, Andrew, and Anku. We're all a part of Duo's customer success team, and we work with Duo customers to.00:36Make sure that you're getting the most out of your investment in the product and our objective today is to cover one such topic with Cisco Duo to help you secure your on prem active directory.00:55A few housekeeping items before we get started. We want to make sure that we use the next about an hour in the most efficient manner, so all the lines have been put on mute. However, we want to make sure that all your questions get addressed. So we have a dedicated Q and A panel in the bottom right section of the screen.01:06And we highly encourage you to keep posting your questions throughout the session. We'd be answering that in the chat and also we have dedicated time towards the end to answer all those questions for you. So whatever you need to ask us, this is your opportunity and we'd make sure that you have the answers you need throughout the session.01:25Okay, with that, let's start talking about Duo identity and access management because that's the foundation of what we are trying to discuss today and where Duo IM fits into all of this. If you've been a Duo customer for a while and if you've been using Duo customer or sorry, you've been using Duo.01:43You as a product or you have some experience with it. I'm sure you know that Duo is actually known for its integrations and partnerships, right? With the Duo IM solution, which we call the identity and access management solution, what we are trying to do is we are trying to bring a security 1st approach to identity.02:02Now the do IM solution is broadly divided into three different buckets, which is the 1st one is security 1st identity. 2nd one is end to end phishing resistance and the 3rd one is unified identity intelligence. If you have been a part of some of our previous webinars, we have covered these three individually.02:21But today we're going to be talking about how we are we are going to show you how you can deploy phishing resistance across the common edge cases that most vendors might just gloss over. And one of these is basically you being able to secure your legacy Active Directory or on prem Active directory. So that's what.02:41We're gonna cover today. The reason why some of these discussions have become important now more than ever is because if you were to look at identity security, maybe.03:01Ten plus years ago, you having a multi factor authentication solution was just enough, right? You had MFA that was this one big wall, everything was secure, everyone was happy and you were good to go. But now there's an uncomfortable truth that we have experienced while working with a lot of customers in this space is that.03:11Attackers are actually prepared for you to have MFA. And MFA alone isn't the fishing finishing line anymore. We are seeing a huge increase in a lot of these different kinds of attacks and techniques that attackers have been using such as.03:31Brute force or passwords pre attacks, stolen session cookies that attackers keep authentication entirely. There is gaps in coverage, the logins nobody remembered to protect and straight up MFA bypass. And unfortunately.03:47That's not just one moment anymore that they are targeting. It's the whole identity journey from your enrollment, your OS login, your app login, mid session, the help desk, the legacy Active directory. Attackers are actually exploiting things like physical access to a device.04:03Falling back to a weaker MFA method when a stronger one is inconvenient and this one, the last one is raising a lot of eyebrows which is eapfake social engineering aimed at the help desk to get a password reset or MFA re enrollment pushed through. Now.04:20This tells us one simple thing, which is what we were trying to do with just multi factor authentication few years ago is not enough anymore. Now, this also tells us that if attackers are evolving and especially a lot of this can be attributed to AI, we also have to evolve faster.04:37Right? So this means that the new identity attack surface, by the new identity attack surface also needs new ways to protect the different entry points where an attacker could get unauthorized access. What we are trying to do with Duo is that.04:56We are trying to embed identity security in each of these different points. So the 1st thing we do is we establish deep trust at enrollment and reestablish it at points like the help desk, so a deep fake voice on the phone doesn't get someone into the system.05:132nd thing we do is we deliver phishing resistant MFA, including web auth, and pass keys, the Duo's own proximity verification, so you get security without giving up on your duo mobile experience, which we know a lot of users love.05:31Using on a day to day basis. The 3rd thing we do is we enable seamless secure trust transfer mid session. So a stolen session cookie doesn't automatically mean stolen access through things like dual passport and device trust.05:46And the last thing that we are doing is we are tying all of this together with what we call identity intelligence to give you visibility across your different IDPs, different cloud applications, and also giving you a way to send out notifications via different channels if needed.06:02So there is full MFA coverage, session type protection, and that's the goal we are working with. Now, we want to obviously make sure that we, when we talk about identity security, we also close a very big gap, which is around active directory.06:18Right? AD or Active Directory is still a very critical part of nearly every customer's environment that we've worked with. If you were to look at metrics, Gartner actually stated that 50 % of organizations still have NDLM running in their environment. An authentication protocol that does not natively support MFA.06:38And that is a big blind spot in protection.06:58That is exactly what we're discussing today, and that is exactly why we built out AD defense. A near term way to extend identity security directly into your active directory environment without the whole rip and replace project. So that's what we're gonna cover as part of our topic today.07:01Now, just to make sure that we also, you know, structure today's discussion around some of the challenges that you could possibly relate with, we have a quick poll, which we have set up on Slido. All you have to do is go in and vote. I will quickly share my screen to show you the details.07:21And you can go and start voting and share some of the challenges that you have possibly encountered or you relate with as a customer and then we can start talking about some of the other points in the session. Okay, so while your words come in, right, some of the major challenges that we see is.07:40MFA coverage is a major challenge. There's shared admin accounts have NO good MFA options. As I said NTLM is still there, where service accounts are used and inactive accounts are placed NO one knows. So all of those challenges are much more are.08:00Things that we've already heard with customers and we'd love to see your votes as well, right? So you have these five challenges common scenarios that you could possibly vote for if you relate to any one of these and of course we'd love to discuss that throughout today's session as well around how we can help you tackle some of those challenges.08:15If you're facing any issues in scanning the QR code, you can go to Slido.com, put in the number for our survey, and you have a passcode right below it. Just giving it about two, three more minutes for everyone to get in and cast their votes.08:34Okay so what.08:52If you look at the metrics so far, we see that visibility into a single pane of glass continues to be the highest rated challenge followed by managing service accounts, auditing permission levels, MFA not only on basic services but management tools, and the last one is compliance.09:09So there is definitely a prioritization so far in terms of visibility being the highest challenge. You have one more minute to vote if you'd like to vote and share. Awesome. Visibility is still leading the charts. Thank you for your vote so far.09:26And I might want to mention that since you are facing challenges around visibility, you're definitely in the right session because that's one of the key things that we'd be talking about today. So you're definitely in the right place to get this challenge resolved today.09:47Okay. Well, thank you for your votes.10:07As we know, some of these challenges that we see on the screen are challenges that some of our attendees have faced, and this is what we're gonna be discussing throughout today's session where we're going to help you address these challenges via duo. With that I will quickly bring us back to our presentation.10:14Right, here we are. Now of course visibility was one of the highest rated challenges and thank you for your votes there. But as you can see, we see some other challenges on the screen. Now, this is what some customers have told.10:40With us throughout the way, right? Integration with legacy endpoints, accuracy of data, cleaning up old account old accounts, parts and plan to migrate to native to native cloud IDP. These are some of the additional challenges that we've seen and heard from customers. And we are glad that you've also shared some of your experiences in today's session with.10:52Yeah, so thank you for that. So, to keep the discussion going, I'm now going to transition and obviously address one of the main challenges visibility in this next slide, and I will hand it over to my colleague Anku to run you through this. Over to you Anku.11:12Thanks. Thank you so much for and thanks everyone for those slido poll answers. So I saw a lot of familiar things comes through service accounts role MFA gaps on things like RDP and SSH and PLM still hanging around out there.11:29Honestly, that's almost the perfect setup for what I want to cover next. So let's dig in. So as you all know that identity isn't just one system anymore today. So most of you are probably running active Directory on prem.11:48Plus Andra IT in the cloud, maybe Okta, Google or Ping on top of that. And then there are specialized platforms too, like, Workday for HR, AWS for cloud accounts, githubs for your developers.12:06There's a lot of places where an identity lives, right? So the problem is all all these tools work in their own little bubble. So each one has its own dashboard, its own rules, its own view of the world, even Microsoft one of the strongest identity vendors out there.12:25Keeps android ID and active directory somewhat separate. So security teams end up asking where does this user actually have access and nobody has one clean answer. So that's exactly the gap Cisco identity intelligence closes. Think of it like a.12:45Single map, that connects user machines.13:05Apps, user behaviors and data. So NO matter which system they are they come from into one identity graph instead of separate dashboards, you get one picture. So that's the map. Now, let's zoom into one piece of it that's still doing a lot.13:08Lot of heavy lifting. Next slide please. So even with all, yeah, all this movement to the cloud, active directory is still the backbone for most of the organization.13:28So it's the system that manages who, your user are and what devices and resources they are allowed to access. So AD has been around for more than 20 years, so it's old, but it's not going anywhere. Even cloud 1st companies still have AD.13:45Quietly running in the background. So if we want a real complete visibility into identity, so we simply cannot skip Active directory. So it has to be part of the picture.14:05But found foundational doesn't mean mean simple. So let me show you what I mean. Next slide please. So here's, here's the cats though because EDD is show measured and has been around so long. People assume.14:19It's simple and well understood.14:39It's actually the opposite. So there are layers of complexity buried in there. Let me walk through a few of them. 1st, as you can see in the screen cust custom configuration. So if every AD environment picks up little tweaks and work arounds over the years.14:42Setting changes for one specific app or one specific team. After a while, it says there nobody wants to touch. So because nobody's sure what it will gonna break, right? 2nd multiple domains, a lot of companies didn't start with one clean AD setup. They grew into.15:01Several domains often through mergers and acquisitions. You buy a company, you inherit their AD two, and now you are stitching two messy environment together inside one.15:21So the 3rd legacy system integrations think old applications plugged into AD ten or 15 years back with dependencies, nobody ever fully mapped out, touched the wrong settings and some app stopped working and nobody knows why.15:34The 4th problem is generation of admins and privileged accounts. So different admins over the years, each with their own way of doing things means permission drift over time. People end up with more access than they actually need.15:51And nobody circles back to clean it up. And the 5th temporary user service account and non human identities. So non human identities, so scripts or application that a login.16:10Their own with NO clear owners. Simple example, a service account set up in 2018 e.g. to run a nightly backup. Nobody remembers it exists anymore, but still there, right? So pull, put all these five together acknow.16:26Was a real enterprise environment and you can see how messy things gets.16:45Right? And that that mess isn't just an annoyance. It's actually dangerous. So, why does this messiness matter? Because attackers know what to attackers know about it too and they loved it according to.16:50To cisco's Talos 44 %, almost half of identity based attacks specifically target active directory. So why did because those forgetten service accounts are, like unlocked side doors and attackers doesn't need to break down the front door.17:10Right? It if there is a service account sitting quietly with admin rights and nobody watching, once they are in, they move sideway and blended because on proper and account locks normal. So the real question becomes, can we string that blast radius?17:30Can we limit what these accounts are actually allowed to do without prompting people with MFS? So often they get annoyed and start ignoring it. So I want to review something that captures this perfectly.17:49So it's a form of real customer conversation. So next slide please. So as you can see there is a quote here from a CISO at a e commerce and a transportation company. What is said?18:06AD has been in place for 20 years and it's got 20 years of stuff in it. So people are trying to move away from it, but, I don't know anyone who actually has. So many hands have touched it.18:21That nobody wants to touch what something else will because it's indecipherable, right? So that sums up exactly what we just talked about. It's it's not that people don't want to fix ED, it's that it's genuinely a hard to know where to start.18:37So let's actually answer that, where do we, where do we start from? Where, where can we start from, right? So there are basically two components visibility and protection. So what do we do about it? This is where the.18:56Comes in. So built on a simple idea, you cannot protect what you cannot see, but visibility alone doesn't stop an attacker in, in the moment. So we built two pieces that work together. So the 1st 1st one is visibility and intelligence.19:15Right, so really understand your active directory environment, finding overprivileged and domate accounts confusing group memberships that accidentally give someone access they shouldn't have, right? 2nd part is the protection.19:33The enforcement side of it, e.g., NTLM is an old authentication protocol that still handles roughly about 60 to 70 % of the AD logins today. So it was never built to support a second factor like MFA. So think of a door with.19:48Nowhere to even put a log. So do insert MFA directly into this legacy protocols and flows.20:09And does the same for command line across like all cell and SSH, which is increasingly how attackers move around one inside. So basic basically visibility tells you where the doors are. Protection, make sure even the doors you haven't fixed yet still have a look on them.20:17So, let's unpack each of these two pieces a little further. Next slide, please. So on the visibility side, we detect misconfigurations surface identity drift.20:37Difference between on prem AD and cloud identity that shouldn't exist. Run continual hyzen checks and report and compliance. So on the protection side, one consistent workflow for end users instead of dozens of login experiences removing admin workarounds.20:55Covering legacy protocols and CLI tools and importantly inserting MFA directly directly on the domain controller, so it applies broadly instead of app by app basis. So what does visibility actually look like day to day? Let's, get specific.21:15Okay, next slide please. So quick note before we dive into this slide, Cisco identity intelligence or CIA it's it's really the engine behind everything we have been talking about for visibility.21:34And connecting your active directory, to CII, it's pretty light lightweight, just a small, open source script generated API credential in CII, run it once to encrypt them and then it syncs the AD data to CII daily over API. So Cisco identity intelligence runs.21:51More than like 90 automated checks continuously.22:11So, on the cloud side and we checked things like is MFA even configured or not? Is this guest account is still active or not, right? Are two people sharing the same authenticator?22:15Right, that's like 58 total secs are there. On the active directory side, so there are 15 secs. So, which is responsible for password failure check, service accounts with NO clear owners, users who have never logged in.22:33Etc. So in plain terms, that's an account where an attacker can request a ticket and try breaking its password offline so without touching the real system. So a weak password there become an easy quiet target, right? So we also check Okta.22:50Githubs, AWS Salesforce, workdays, the workday. The real value is not one check alone. It's connecting them all so you get the trust score per identity. So let's zoom out one more time and see how all this actually fits.23:10Together. So Cisco identity intelligence pulled data from everywhere where identity lives, right? E.g., duo, your Active directory, Andra, Okta, Google, workday, right? SAP.23:30Right, Cisco eyes and your applications. So we now also pull in agent activities as you can see in the left hand side, right? Open AI entropy co pilot, right? So because AI agents are becoming identities too.23:49From there, we do two things, as you can see in the middle, one is the posture management, finding MFA gaps, domain accounts, privileged access, and threat detection, right? Supporting suspicious behaviors and trust level changes in real time.24:05Right? And the part that I want you to remember, none of this matters if it is just sits in the dashboard. So we turn it into action through remediation campaigns, right? Scopes who is affected.24:24Drive the fix, track it to the closer plug into tools your teams actually use like zero ServiceNow, Slack, right? Even like Cisco secure access and firewall. It's a loop, see the risk, understand it, and actually do something about it continuously.24:39So that's the visibility part, and the intelligence side of the AD defense. So finding the risk, understand it and turning in turning it turning it into actions. So Andrew's going to pick it up from here to recap that visibility piece for a moment and then.25:00Take us into the protection site. So Andrew it's over to you.25:20Thank you and a very cool slide, the previous slide probably one of my favorite ones sharing with customers. It's CI is one of those tools, the more we put in, the more we get out of them. But speaking with the theme of visibility for the moment, let's keep talking. So once organizations gain deep visibility into Active Directory by adding it as a source and identity intelligence that Anku just outlined.25:24They start to unlock powerful benefits across their identity ecosystem. 1st, the user inventory expands to include not just human users but also non human and service accounts giving a complete picture of who and what actually exists within the environment. Especially with those from 04:20 years of stuff can build up a lot of who and whats that we may not even realize existing.25:44So with this enhanced visibility organizations can report on active directory compliance and run continual hygiene effects, making it easier to address technical debt and keep AD secure and efficient at the same time. It also helps surface identity drift, which is discrepancies between on prem AD and cloud identity systems.26:04Which helps host gaps and improve consistency. Posture insights make it possible to detect issues like MFA misconfigurations or missing protections, shrinking security across both hybrid and cloud environments. Ultimately, this comprehensive approach enables better identity security posture management and identity threat protection response capabilities.26:22Leading to a more secure compliant and resilient identity foundation. Next slide please. So team, we're gonna hit play on just it's actually a demo environment that we show customers through when running through CII for the 1st time. It's just gonna go through how to add an integration. It won't go.26:42Step by step, but you'll see it's got its own tile, we type in the name, you follow the bouncing, but we do have actual documentation on how to.27:02Run through this as well with customers, but once it is set up, just a quick example in this demo environment, we would click on users. We might try and actually what AD selected here and we might try and find, someone's a little bit questionable here, mr. Hayes, we'll select Brian, and as his details pop up.27:09We'll be able to get a bit of insight as to what actually it starts to pull through. So if we scroll down a bit you'll see all the attributes as well. You'll be a little expansion button in a second where you can see all the attributes it's pulling in from AD, you can scroll through and see those. Again, in the background, you see there's a lot of detail if you haven't had the pleasure of using CI.27:28Not yet.27:48Definitely something we're speaking to your account team or resource about. You can select groups as well and see what groups this particular user is a part of. There is a lot of information that gets contained within this platform. People on checks and selecting AD again, you'll see some predetermined checks and some custom checks can also be done as well. But gives you a really good rundown.27:49As to what exactly it's checking. We're gonna select the integration so we picked up one user here who hasn't logged in for seven months. We get a bit more info in there, we can kind of validate that they haven't logged in from I think it was June or last year. So obviously the time this video was taken a little bit further.28:09But what you can do after validating that is up the top here in actions to point is take action on it. So in this case we're raising a ServiceNow instance and we'll say, let's deprovision this user and that gets raised and sent off to the appropriate team to act upon you.28:27And that's just like a quick little insight if you've never seen the platform before. Thank you Shrey, We'll to the next slide, please. So another quote, another custom quote here sees that from a large healthcare organization, the things that bother me the most are having these AD domains that have just existed for such a long time and most people don't have a good graph.28:43Management doesn't even know where to start. Again, I'm kind of picking on my friend on whose comments here because it obviously feeds into this information. Having that history and obviously with change of personnel, change of teams and resources does make this difficult to manage. Hence these ideas of AD defense coming into the fold is giving our custom.29:04Especially if those things are changing so quick as well. So which thought was a really great quote to share. And we'll go on to the next slide again pleaser. So stepping back from maybe defense specifically, just for a quick second, we're gonna talk about where ideality security is headed and why this problem's getting harder, not easier.29:26So up on screen you can see some spector ops data. It shows how attack parts grow exponentially with identity count. So at 5000 identities, there's 5 million parts. 40720 5 million parts. You can see that jump up there just to give you an idea.29:43And remember, identities aren't just employees like we pointed out earlier. We're talking service accounts certificates, machine identities, everything accounts, and it's so hard to know how many are within your organization. Another great step here, according to Forrester, the ratio of machine to human identities in 2024 is 20 to one.29:59With some estimates now placing it as high as directly two to one. If more service accounts and machines and agents come exponentially more attack path risks. This isn't a future problem, definitely a current one and it's why attack path visibility is NO longer optional for any organization.30:18So on to my last slide before I pass on to my colleague, this is where our partnership with comes in. So CIO integrates with deeper identity attack path management and prioritized vulnerability remediation. Deeper attack path mapping shows you exactly how compromise account could escalate to the land admin.30:36Where to cut that chain. This brings the invested past point solutions in provide cohesive identity strategy and instead of forcing your team to switch tools and correlate data manually. With that, I'm gonna hand it to my colleague Yesa to run through the next section of our presentation. Thank you, Yesa.30:56Cool cool. Thanks a lot, Andrew and the rest of the team for walking through, you know, what you guys left on exactly on the framework, right? Visibility is to understand your risk. Production is to enforce against it. When you gain visibility, you know where to start batching.31:12That's where those IAM platform and leading MFA production comes into the picture. Do you now can integrate directly with your active directory to insert MFA in the front of hard to cover privilege access cases?31:28Applications that uses NTLM and protocols and MFA for CLI including PowerShell and power shell commands what we use in day to day life. In addition to popular duo protections for windows logon.31:45And RDP, we can avoid smart cards, reduce authentication apps, get dual traceable searchable logs for monitoring and compliance purposes. As we move on, I will walk you through the protection process by demonstrating them, but before that, you know, we, let's look into that, you know?32:00There are still 50 %.32:20Of users or 50 % of organizations still using NTLM. One of the most shocking stats what I have heard. And when we like to our customers is that about half of the organizations still are still using NTLM, not only that it was invented in 1993, but.32:22It's been widely used for protecting legacy applications where users are relying on MTLM as an authentication method to allow an access to their critical application though they are legacy. Let's move to next slide Fray.32:41So here is a long part, right? We do can directly integrate with your domain controller without going through or installing many agents there. It's a pretty simple installation process where you install a PowerShell script and.32:58A small little script which can be integrated with Duo, and once you install this, you're protecting all the underlying protected applications. That's where the simplicity is coming in with the Duo integration, which we have listed specifically for active directory or domain controller.33:13So I think it's time for us to jump into demo. Let's, go to the next slide, but from here I will take over the control and then I will share my screen so that you know you guys can see just a second. So, ok, going back, you know, in this demo, I'm going to talk.33:34About.33:54Two attack path and one policy engine. What happens is one of our insiders tools a domain admin password and he's trying to do an RDP to a domain controller, and not only that he also uses PowerShell commands to create dummy users so.33:55That you know he can completely take control of the domain controllers. That was he's trying to do. I would try to demonstrate that you know what a bad actor or a or even an employee who got hold of the domain credentials, what kind of challenges.34:15They can post to an organization especially there are NO MFA production mechanisms is there. In this case happens is our user gets the credentials, so what he does is he tries to log into.34:33A server, or from his machine he tries to do a PowerShell to a domain controller. From his PC, he just try, he knows the domain controller name and all those things Since he's got got the credentials of domain admin, he tries to log into a PowerShell command. He's prompted to authenticate since.34:49The credentials are there, so.35:09He entered, he tries to enter them. So when the user entered that, we can see that you know he gets access to basically I think the password was wrong, let me try again.35:12So the user is trying to authenticate. Here we go. He is there sitting at a shell where you know he has got access to the domain controller with a user domain admin. So they he could able to access because there is NO MFA involved and as of today.35:40This is how it works, right? When somebody wants to do an RDP, so he gave access of this and what he does to do is he tried to create a backdoor admin account for himself so that you know he can, he don't want people to notice or the from the logs, you know, the SOC team should not contact what's happening. So what he does is he.36:00He creates a backdoor admin account by using this PowerShell, you know? He just basically creates an account. The moment he creates an account, it's created. Let's validate whether that user is created or not. Let me get my text just to validate that user.36:21We can see that you know that he was successful in creating that user. Not only that he created a UPN, he is part of a domain admin and he got the full control of domain controller, right? Imagine just this user, now he tries to RDP.36:42To one of the servers or the main controller. The moment he tries to RDP, he logs in, he has his own password, which he configured this as password 2026, and he's trying to do an RDP to.36:59The domain controller. With the user ID what he just created. Bang on, he could able to access the server. No controls are involved, NO MFA is involved, he is free to do whatever he wants. As mentioned by Anku that you know 40 % 4 %.37:14Kind of attacks happen because of identity theft or or targeting attacks towards active directory.37:34Now that user has successfully logged into the domain controller with NO controls. He created his ID, he could create more restriction in this case, right? So, let me disconnect this user right now from here.37:39Sign out. So let's imagine that you know you have created or you have implemented MFA for these legacy controls. Now.37:57The user got the credentials, the primary credentials are in his hand, but can he do a PowerShell command. So what happens is he tried to do the same thing, but this time the scenario is different. The users are, you know, what they have done is.38:12They have implemented MFA. So right now he tries to do the same thing. He tried to access, but this time he got, I'm using a different account for sake of you know MFA has been deployed for this user, so he's trying to access.38:29He's trying to log in. He couldn't log in because I think again the password was entered wrongly. Let me see. He tries to log in. The moment he tries to log in, I think he should get a push notification on his phone.38:54Let's try again he will.39:15He tries to log in, but you know he's getting a push notification. If the bad actor is trying, then I know that, you know, I'm not trying to log in into the PowerShell, the bad actor is trying, I can deny straight away that. And I can mark this as a suspicious login and it will be reported in your.39:34Duo and you know if I want, you know, I can do this, you know, I can pause for 20 min for next. I can do that. So this is one thing which you can stop by just by deploying duo MFA, you have stopped an access.39:54To the user. So, if the user is trying to log in to RDP, ok, and they are connecting with the user ID.40:11Where it's MFA is deployed and they try to do an RDP, they cannot access that. Their access will be blocked, you know? So I should get a new push here.40:27I accepted dual push. Okay, now it's connecting to the server. Let me go back to my machine here, ok, got a pushed, I accepted the push. Now.40:43I'm connected to the server here. Just to show that you know the bad actor was able to create the service account. It's still here there, right? This an admin account. If you see, this is a domain admin user which has been created. If MFA was there, this user couldn't able to access.40:59That's how simple is simple what we are making for our users. So far I demonstrated RDP access and PowerShell. A similar analogy can also be deployed for, what do you call this?41:17For a Kervas based application, you know, if the user is trying to authenticate to one of your application which is connected with, you can have an MFA. Since the token is maintained, I could be able to authenticate, but let me try to open it.41:35Edge in my private window because tokens are.41:53Needs, you know, they rely on one authentication and they work. Okay it's not an HTTPS website. It is HTTP. It's asking for username and password. If the bad actor still try to access your protected application, he cannot access.41:59But if a user is accessing with correct credentials with protected MFA, they will get an access. Now what you can see is that, you know, I'm getting an MFA, you can see that it's legacy AD authentication. It's showing the host name, the time, all those things.42:15I accepted my push and let me go back to see, I could be able to access the application. This is not a live application. This was just created for the demo purpose, but that's how simple.42:32To deploy MFA with Active directory. And you can not only deploy MF MFA for your rdps, right? It protects NTLM, it protects protocol. That is the pretty much about the demo, and I would hand over back to Shreya.42:48Thank you, yasir. And thank you to all the other presenters for sharing all the valuable details today. So this brings us towards the end of today's session, which is Q and A and takeaways. We are opening up this time for your questions. If you have any questions, please feel free to post those right away.43:07In the meantime, you might have seen a message in the chat which includes some of the links that we definitely feel you can go back and refer to after today's session.43:27So please feel free to review that information. We've attached a report, a document, so if you are going to possibly make some changes in your environment after today's session, those links could be valuable. In the meantime, we also encourage you to get started with Cisco identity intelligence if not done already, and also go ahead.43:36And add AD as your source to see your full posture in a single view. And the reason I say that is because when we started this session, visibility came up as your top challenge based on all the boots we saw as well. So that's where we could start fixing that challenge for you right away.43:56Well, while you ask us your questions, I'm gonna start asking our panel one question that comes up in a session like this, which is around licensing. So the question we often get is, is this already bundled with what we have with our dual subscription or is this going to be.44:13Chased as a different SKU, but if any one of you has that doubt I just want to clarify that typically for Cisco identity intelligence and some of these features, if you are a dual advantage or dual Premier customer, you should be able to access Cisco identity intelligence dashboard. So that's.44:32Out of the way, just pausing for a few more minutes to see if we have any other questions coming up. Okay, so if there are NO further questions, I'm just going to give you a few takeaways before we wrap up today's session. After this session, you.44:52Would be receiving a survey. Your feedback is very, very valuable for us. We do these sessions every few weeks and we want to hear from you how we can make this better. What is it that you'd want to see additionally? Also you would have the opportunity to attend another webinar that we have planned in October. That one's pretty interesting as well.45:12We're gonna be talking about the different security products bundled together as part of user protection suite. So do watch out for those marketing mailers and we would love to host you on that upcoming session as well.45:32And finally, we really appreciate that you've taken out your time today to attend this session and we really hope this was worth your while. We will definitely stay connected if you have any further questions, so please feel free to reach out to your customer success team contacts for any follow up questions that you might have. If not, we don't.45:44Definitely look forward to seeing you in our next session in October. Thank you again for joining today's webinar and I hope you have a great rest of your day.46:04