Getting Started with Cisco Duo Identity and Access Management

Welcome everyone, and thank you for joining us today for our next installment of this security expert insight series.00:10I'm thrilled to have you here as we dive into getting started oops, sorry. Thrilled to have you everyone here as we dive into getting started with Cisco Duo identity and access management.00:18We have a great session planned for today. Really quick. My name is Derek Season and I'm a part of our customer success specialist team and we'll be one of your hosts and guide for this webinar as we walk through.00:34The different foundational elements of the dual platform. Before we jump into the technical contents, let's do a quick tech check just to ensure everyone is set up for success here.00:49Please confirm that you can hear my audio clearly, that you can see my screen, also kind of make sure that you have the slider launched on the right side of your Webex window, kind of like what happened with with my screen earlier. If you're having trouble with any of the the upper.01:05Above, if you're using a browser, try switching to a different browser. Chrome by default works.01:25Well, but also Firefox has been working quite well for us as well. You can also ensure, you know, you have the latest Webex application installed. So a couple of things to, to check there if you're running into issues. So if you're still having issues, please drop a note.01:31In our Q and A in Slido and our team will be happy to assist you. Okay, so we have a packed agenda today. We'll, we'll start with an overview of the expert insights series, introduce you to the team behind the scenes and cover.01:48For how you can actively participate throughout the modules and then after the introductory.02:08Session here we're gonna pass over to the actual webinar modules that is slated for today. So what is the expert insights series?02:15These are interactive deep dive sessions led by industry experts. We focus on foundational Cisco architectures, feature showcases and focus on real world use cases.02:32Most importantly, the, this is a space for you to participate. We have live Q and A's, so please bring any questions that you may have. If you missed any of our previous sessions, don't do worry. We have a bunch here recorded, so you can find recordings for our previous sessions on the Cisco community.02:47Page. As you can see, we have a mix of topics and deep dives around Duo based off of our previous titles with Cisco duo overview, security 1st identity and access management and identity protection with Cisco duo, as you can see here listed.03:07We're constantly updating our webinar calendar, so keep an eye on the community portal for upcoming sessions in the Americas. Today we are breaking our content down into three.03:26Four modules. We're hoping to get you started with your onboarding journey with Cisco duo's identity and access management. So we'll be covering how to enable Duo identity and access management, which will cover a good amount of our robust core features along with a quick look.03:42Look into provisioning Duo with your security cloud control.04:02Next we will review how to navigate your environment from customizations for your duo tenant all the way to deployment best practices. And finally, we'll go over how to strengthen your overall security posture with a deep dive into our secure.04:09Cisco identity intelligence and the better together integration with Duo and our other Cisco security products like secure access as well. So for today's webinar, our module structure is the following.04:29We will have 1 h for each module, around 45 min of content. We'll be mixing presentations again with live demos to give you a practical look at these features and we're ending it with bring it home action items you can take with you after.04:50Are the sessions.05:07Then we're gonna be closing with a 10 min Q and A for each module and then at the end of the entire session as well. So any questions you may have, you can bring it up at any point of those Q and A.05:09Lastly we have a pretty cool interactive game available for everyone to utilize as well.05:30Capture the flag is a hands on learning experience that supplements the information we're sharing today. So the goal is to see the concepts and the demos we show you today in action, in a lab environment.05:35So you can see the QR code here scanning the QR code will get to the event link and it will also be in the post event survey that we send and also a follow up email that we will send. Feel free to do the challenges after the webinar. Excited to.05:52See how everyone progresses in our capture to flag event.06:13Apparently right now the event will be active until 19 June. Alright, so here's the meat of the webinar. Here's our roadmap for the next few hours. We'll start with module one enabling duo.06:16Low identity and access management.06:36Followed by a short break. Then we'll move into module two, which will cover navigating your Cisco duo environment. After another break, we'll wrap it up with module three around strengthening overall security and Cisco duo between CII and secure access.06:39We will leave again plenty of time at the end of the webinars for open discussions and wrap up for the overall webinar for a final Q and A We want to make sure that we have enough time to address your specific questions around Cisco Duo and all of the topics and features we discussed, so please.06:58I again utilize the Q and A whenever you have a question that pops up. So let's meet the team. I'm very honored to be joined by a fantastic team today.07:18We have Shruti Joysalah leading module one, John Ortman covering module two, and Sheila Vita and Atusa Robert guiding us through module three. Helping us with our Q and A sessions, we have our esteemed panelists, Philippe Gonzalez and Adam Carson.07:33And I'd like to do a quick shout out. We also have a dedicated project coordination team, not to shout out myself, but I have myself, Sheila, Aya, Amika, and Heather working behind the scenes to ensure everything runs smoothly.07:53So we want to.08:14Be a, a, this, we want this to be aa2 way conversation, right? So please use Slido to ask any questions and at any point during the presentation, you can utilize the the Q and A section. You'll find the Q and A section right there in the Slido box. We'll also be.08:16Running polls to better understand your current setup and deployment stage.08:36So please join us in in either that section or in Slido.com. If you go to Slido.com, you can use the code that you see here, hashtag duo IAM and the passcode shown on the screen. If you don't have that Slido pop up directly in your Webex client.08:40Okay, so to get us started, we'd love to know a bit more about you. Please take a moment to answer some of these questions here. 1st question is, what is your role in your organization?09:05Nice, we got a couple of, answers here coming in. We got an IM engineer perfect. We are gonna be covering a lot of IM stuff. We have architect, we have a solutions engineer.09:39Data center specialists, yeah IT network admins. Fantastic. Okay, so let's go to the next question.09:56And it is what duo edition do you currently have? Hopefully everyone already has a duo edition available to them. If you're stuck in provisioning.10:16Possibly we can see what that looks like from our presentation here. We have some dual essentials coming in Duo premier. Looks like we're neck and neck there right now. That's fantastic.10:33Duo advantage coming in. All right, so let's move on to the next question. That's a good, good group of, of additions there. So how far along are you in your dual onboarding?10:53We just want to make sure we know the the audience. We know where most of you are in your onboarding for duo. That way we can, we can check to see if there's anything we want to highlight during the Presentation.11:10Right, we gotta, we got a mix, which is which is good. A few not started yet, so hopefully those that are not started yet or just have a few users or a few applications. Hopefully this will help get you moving along with the journey on onboarding.11:29The rest of your users and the rest of your applications to duo. All right, thanks, thanks everyone for participating. That was amazing. Okay, so I will move on.11:49We'll close off the Slido poll, and I want to just thank everyone for listening to my intro here. Thank you all for your participation so far for Slido and the questions that we have and letting us get to know your environment just a little bit.12:13And we are ready to dive in. So up next is module one enabling duo identity and access management. Let's get started.12:29Hey, thanks Derek. Hello everyone. Good morning, and thank you for joining us for dual security expert inside series. My name is Shruti Heisella, and I'm joined today by Philippe and Derek Season.12:50Together we are customer success specialist on Duo team and this is module one. Getting started with Duo identity and access management. Over the next 40 min, our goal is simple.13:10We want you to walk away knowing exactly what a security 1st IAM looks like in Duo, where each capability fits and what you can turn on in your own tenant as soon as the session ends.13:26Before we dive in, a quick housekeeping slide so you know how to interact with us live. We want this to be interactive, so we will be using Slido throughout the session. If you go to slido.com and enter the event code, you will be able to participate in live poll.13:41And submit questions as we go. Alright, let's get a quick pulse check. Go ahead and vote. Our 1st question is, what is the top security concern, your environment.14:01Enforcement device posture, AI. I'll give you a few seconds. I can already see answers coming in. There is NO wrong answer here.14:19I'm seeing MFA enforcement. I see hacking. We are about half the room. Let's get few more in. Oh, that's interesting. HIPAA compliance.14:44CMC CMMC compliance, that's nice, interesting. Okay, we are getting a clear clear picture here.15:01Few more seconds and I think we can move on to the next one. What user groups will require access to your protected applications?15:18Employees, that's nice. Yes, that's our main focus of course. Contractors yes Duo does have a lot of feature where you can support them both. Employees and contractors are neck and neck and external.15:41Users, not bad. We have so many external users as well.15:58Okay, we see a good mix. Looks like employees are in the lead that tracks with what we are hearing from a lot of users as well.16:03Few more minutes and let's do another quick one. What authentication methods do you want to enable, do you want to be enabled for your environment?16:22Duo currently has all the options that you see on screen today.16:44I see some answers coming in. Let's give them few more seconds and we can see the poll.16:59Okay.17:19Great. Keep that in mind because what we are about to cover ties directly into this, whatever you answered today. We have structured this module as a guided tour through the Duo IAM stack. We will start with the, what secure.17:21Security 1st IAM even means and why we believe it's the right framing today. Then we will walk the stack dual directory, Duo SSO, phishing assistant MFA, device health and trust, risk based authentication, and finally security cloud control, which is the unified.17:40Pane of glass.18:00Trying tying it all together. We also have a demo towards the end, and then we close with Q and A So the 1st half is the map, 2nd half is the territory. Let's start with the philosophy because the order in which you put these pieces together.18:02Matters. 1st up, duo security 1st IAM. Most IAM platforms were built identity 1st. They started as directories or as SSO products and security got bolted on later as a feature.18:21Duo flips that. We were a security company 1st. That's our heritage.18:41And the identity and access management capabilities you see here were built with security as the foundation, not as an afterthought. Practically, that means three pillars on the slide working together.18:47Duo directory as the identity source, single sign on as the access layer and phishing the system MFA as the authentication layer. All designed from day one to assume the attacker is already trying to get in. Whether you're running Duo standalone or alongside on.19:03Contra Okta or ping.19:23This is the model. We'll spend next several minutes drilling into each of those pillars. Let's start at the bottom of the stack, the directory itself. Duo directory is intention.19:25Flexible. It's designed to meet you wherever you are today.19:45There are three deployment patterns we see in the field and they are all 1st class. You can deploy it as a standalone where Duo is your primary IDP, directory and SSO. Common for organizations that don't have a heavy active directory or Okta footprint or that.19:50Want a clean break.20:10Next is as identity broker, where you keep your existing IAM and Duo sits in front of the broker, applying consistent policy across multiple identity sources. And next is an alternate directory where you keep your employee directory exactly where it.20:13And you use Duo directory specifically for 3rd parties, contractors, vendors, partners, who you don't want in your corporate directory. The next three slides show what those look like architecturally. In the standalone pattern.20:32Everyone employees and 3rd parties are like lives in Duo directory and Duo brokers access to every application type has.20:52Cloud on prem and legacy. 01:31 place to look when something goes wrong. This is the pattern most enterprise customers land on. You have already. You're not.21:08Placing that out. Duo sits in front of the identity broker.21:28The directories on the right are your source of truth. Duo provides the consistent security policy MFA and device trust layer across all of them. The business value is uniform policy without directory migration.21:34The 3rd pattern, your corporate IDP keeps the employees and Duo Directory becomes the home for contractors, vendors, and partners. This keeps 3rd party accounts out of your primary IDP, which is the real audit and licensing win. While still giving those users a clean way to reach.21:50The apps they need.22:10So that's the what? Why would you choose dual directory over directory you already have or as an addition to it? This next slide is the short answer. Three themes. Flexible, secure, simple.22:13Under flexible, if you have multiple identity sources and most enterprises do, Duo can route a user to the right one based on routing rules. We will come back to this when we cover SSO. Under secure, you can go completely passwordless because Duo directory was built as a modern.22:31Directory.22:50I think identities here never need a password to begin with. There's NO legacy hashed leak. That's a very different starting posture than retrofitting passwordless onto your 20 year old directory. And under simple, we have out of the box AI assistant.22:51And automated provisioning. The AI assistant is real. Admins can ask natural language questions about their tenant and get answers and provisioning to common apps is automated rather than scripted. So that's dual directory. Flexible deployment, secure.23:11By default, simple to operate. Now, a directory only gets used so far. Users need a way to actually reach their applications. That's where SSO comes in.23:31Duo SSO serves as the access layer of the stack. A few things to call out. It integrates with all major IDPs, so it works alongside Entra or Okta, not instead of them. It supports SAML two.O OAuth and.23:52OIDC covering virtually any modern SaaS application and manages cloud and on prem applications under a single policy plane.24:10The key point is passwordless comes built in. You don't need separate SKU or additional products to deploy. It's native to SSO. Routing rules are how Duo earns the title.24:22Identity hub.24:41The problem we hear constantly is that in large organizations, they usually end up with multiple identity sources. An acquisition added Okta tenant, the cloud team uses ontra ID, Active Directory is still authoritative for legacy applications and contract.24:43Does live somewhere else entirely.25:03With routing rules, Duo SSO becomes the single front door and we route the user to the right backend directory based on attributes like email, domain, group membership or application context. The three outcomes on the right are what this delivers.25:06Less complexity in large environments, consistent authentication policy across all identity sources and the ability to set specific policy for 3rd parties without merging them with employees.25:25And on the user facing side, Duo Central is the SSO portal. It's a branded launchpad for your users. Tiles for the apps they have access to, get help link pointing your to your internal resources and end users self service.25:43For things like enrolling or re enrolling devices, which deflects a lot of help desk tickets.26:03You manage style visibility with permitted groups, so a contractor's do a central looks completely different from my engineers. It's a small thing, but it's the surface your users see every day. And getting that right materially changes adoption.26:11So that's the access layer. Now, the directory and SSO get users to the door. The next question is, how do we make sure the person at the door is actually who they claim to be?26:29That brings us to MFA. Two ideas on this slide. The 1st one, industry leading authentication is on by default. You don't have to assemble it.26:47The moment you are in duo, you have access to the full ladder of factors on the right. From SMS at the bottom up through verified push passwordless, and platform and roaming authenticators like FIDO two keys and touch ID at at the top.27:032nd idea is, this is the one that matters operationally, is that you can mix factors across populations. You don't have to pick one. Your engineers can be on five or two keys, your call center agents can use verified push on Duo mobile or your workers on shared kios can use dual desktop at the.27:22Indicator. Policy is by user group and by application based on the security need.27:42And for the legacy stuff like winlogon, RDP, NTML Turbos yes, you can put MFA in front of those two. That's a question that comes up in every session and the answer is yes. Passwords are the single most attached.27:50That Credential in the industry. And most passwordless stories you hear are really password optional. The password is still sitting in the directory. You've just hidden the prompt. If that hash leaks, you are back to square one. What Duo offers is different.28:10There is NO password to leak in the 1st place because Duo directory was built from the ground up as a modern identity store. The users living in it are provisioned without a password at all. Enrollment doesn't create one and the fallback path can't fall back to one.28:29And you don't have to migrate users into Duo Directory to get there. You can extend passwordless to identities you already manage, whether they live in Duo directory, in an external cloud directory or a SAML IDP or in.28:49And on prem active directory. Meet your users where they are and remove the password from the workflow without touching the underlying directory. So at this point in the stack, we have covered the who, who the user is, how they sign in.29:07And how strong we trust the factor they presented. But identity is only half the picture. The other half is device sitting under user's hands because a fully verified user on a compromised laptop is still a breach. That's where device health.29:26Health and trust.29:46Comes in. Let's start with the device that's almost always in play during authentication. The phone. Through the dual mobile app on iOS and android, we check the basics that any reasonable security team cares about.29:47Operating system is up to date, app is up to date, screen lock is on biometrics enabled, device is in jailbroken or rooted, and on android, we check google, Google play integrity attestation and full disk encryption.30:08The key here is we do this with our MDM. You don't need to enroll the personal phone into MDM to get the signal. Duo mobile checks it at authentication time. And all of these security checks are available in our policy engine for you to continue securing.30:26During your protected applications by blocking out of date insecure operating systems, devices that don't have encryption on or even devices that don't have any screen lock set up.30:45Same idea, but on the laptop. Do a desktop for windows, Mac and Linux. We check OS password encryption firewall, and on premier editions, we check whether a security agent is actually running.31:01And we anchor the device identity in hardware. TPM two Dotto on Windows and Linux, secure enclave on Mac. That means we can also block devices that show up presenting and already registered hardware identifier, which is your defense against.31:18Or spoofed device IDs.31:38Here's the distinction I want to anchor for the rest of the section. Healthy and trustworthy are not the same, and most security programs mix them up. Healthy asks, is this device in good shape?31:44Is the operating system patched? Is the disk encrypted? Is the screen lock on? Is firewall up? That's a check on the condition of the device. Trustworthy asks a different question entirely. Do I recognize this device? Is it one I issue.31:59Should one have enrolled or the one user has explicitly registered with me?32:19It's a check on the identity of the device. And the reason this matters is you genuinely need both signals. A brand new fully patched, fully encrypted laptop that has never touched your environment before is healthy, but is it, but it is absolutely not.32:25It's working. Conversely, a device you know well but that has fallen out of compliance is trustworthy, but it's NO longer healthy. Either gap is an opening.32:45When you get both right, the outcome on the right of the slide follow naturally. You shrink unauthorized access. You do it without forcing MDM onto every endpoint just to answer the trust question. And you low lower your IT costs because the same framework lets users self remediate.32:57With the health failures instead of opening a ticket.33:16The important thing to notice on this slide is that trust is graded. It's not binary. We are not asking, is this device good or bad? We are asking how much do I trust it? And we are letting you set different policy at each level.33:22At the top of the spectrum, you have corporate managed devices, fully known, fully owned, fully under your control. In the middle, we have registered devices. Endpoints, the users have explicitly enrolled, so you know who they belong to even if you don't fully manage them.33:39And at the bottom you have unknown devices. Anything you've never seen before. Each tier gets its own treatment. Unknown devices are blocked, registered devices get stepped up to a stronger factor and corporate managed devices flow through frictionlessly because your.33:58Already established.34:18Trust through your management stack, and the trust signal itself doesn't have to come from one place. We meet you where you are, whether it's an MDM like Intune or Jamie, a managed browser or simply the presence of dual desktop on the endpoint.34:20Whatever telemetry you already have, Duo will consume it and translate it into the policy tier on this slide. This slide pulls everything we've discussed about device trust into a single end to end picture.34:38A user lands on a protected web application and enters their username and password or just their username if you have moved to passwordless. From there, Duo runs a quick triage on the device before deciding what to ask next.34:56That triage sorts the device into one of the four lanes, as dual desktop installed? Is it sitting on your MDM cache list? Does it have Duo mobile or none of the above? And each lane unlocks a different set of allowable authentication factors.35:14Stronger and more.35:33Frictionless for trusted links, more restricted for the unknown ones. The factors a user is offered are dynamically determined by the device they're authenticating from. And every bit of that logic is policy you control. Nothing here is hard.35:35Coding.35:54Let's take a step back. At this point in the stack, we have directory SSO MFA, and device all working together. One question we haven't answered yet is the runtime question. How does Duo decide in the moment of each login when to lean in and ask.35:57For more and when to get out of the user's way.36:17That's exactly what risk based authentication is built to do. For every single authentication that flows through Duo, we are evaluating a rich set of risk patterns behind the scenes.36:21User reported signals, the user themselves told us something was off. The classic example is marking a P previous push as fraud from inside the dual mobile application. Network signals, the request is coming from somewhere unusual, novel ASN A.36:40Is the headline one here?37:00Traffic originating from an autonomous system, your organization has never successfully authenticated from before. Geographic and physical science, like where the physics don't add up. Unrealistic travel between two logins, device distance between phone and the laptop.37:02Or a country code mismatch where the authentication device and the access device appear to be in different countries.37:22Attack pattern signals where the traffic looks like an attack. Push prey hitting many users at once or a push harassment hammering a single user. And the most important thing to know about all of this is you don't write any of.37:30These rules, they ship with the product. They are tuned by a research team and they are evaluated on every authentication automatically.37:49This is the decision side of RBFS. Once the risk engine scores and authentication, RBFS reaches into the factor catalog on the right and decides which factor the user is allowed to use.38:02Every factor has an level from phishable factors like standard push, SMS phone call at one end to phishing assistant factors like verified push, do a desktop authentication, Fido two, two, YubiKey.38:18At the other end. RDF is dynamically reshapes that menu in real time. When the risk is low, you will get the full menu, like business as usual. When the risk is elevated, pushable factors are removed, user is forced to verified push or stronger. For critical risk.38:34You could be blocked outright.38:54The key point is RBFS doesn't make week off harder. It makes week off unavailable, and you configure none of it per login. You set the catalog once and RBFS makes the call automatically every time.38:56Here's that story visually. Normal push patterns, you're at low risk, NO auth reauth required. Push patterns that look like a push is pre attack, verified push is required. The same patterns are sustained or if it's escalating.39:17Five or two factors are required and at extreme access denied. The headline is better security without punishing the user on every login. You only impose friction when the risk model says you should.39:37And the compliment to step up is remember devices. If a user is on a device Duo remembers on a network fingerprint that hasn't changed and risk hasn't increased, we don't re auth them for, let's say X number of days.39:58If anything in that picture changes, there's a new network, the risk signal changed, we dynamically reprompt. So risk based authentication is bidirectional. More friction when risk goes up, less friction when it doesn't. That's the whole game.40:15The final piece on our door is how all of this gets unified. Security, cloud control or SEC in short. A quick housekeeping before we go into SCC, if you already have a dual tenant.40:35Standalone or a la carte.40:54You log in@admin.duo security.com. If you are brand new and want to start fresh, sign up.duo.com. Both links are on the slide and we will share them in the chat. Security cloud control is Cisco's AI native.40:56Unified Security management platform. The four bullets on this slide each describe a different way it earns that label. Centralized management, every Cisco security product Duo included is administered from one place.41:16Simplified deployment, activation and onboarding are streamlined, so you're not stitching together six different set of flows. Intelligent security, AI driven best practices and proactive insights surface what to fix before you have to go looking.41:33And outcome centric. Rather than chasing dashboards across products, you see your overall security posture in a single unified view. For our purposes today, the headline is that Duo is the 1st class citizen in SEC.41:50If you are already invested in Cisco security portfolio, SCC is the pane of glass where dual lists alongside everything else you already own. When you 1st land in SCC, you will see a Duo info.42:08Banner at the top. It tells you exactly what type of duo entitlement you have based on which Cisco security product you bought.42:28If you need to activate Duo, there is an action required button right there to walk you through it. We made the onboarding very short. And once Duo is activated.42:37The Duo desktop lives under duo security in the left hand platform menu. From here you get a summary view and when you need full power user experience, there is a direct link to duo admin panel for.42:53Any kind of advanced configurations. So SEC is your home base. The admin panel is one click away when you need the depth. All right, that's the full architecture picture. Directory, SSO, MFA device risk, all unified in SEC.43:10Now, the fun part, let's stop talking about it and actually show it to you how they all work together.43:32This is the duo admin panel dashboard. You can land here even either by logging@admin.duo security.com or you could navigate to this by the quick link within your SCC dashboard. It quickly shows you.43:46What's happening in your environment. Let's move on to see trusted endpoints. It's necessary inside devices.44:06I have already created couple of integration and for this, for today's demo, we will be looking at Windows as the operating system. There are two options if you want to add for your Windows endpoint. The 1st one is Active Directory with Duo desktop. The integration.44:13Is pretty easy. You log into your.44:33Our Domain controller and you run the command in a PowerShell. Once you get your domain SID, you just put in here and hit save. The integration is as simple as that. And if you want to do something manual with do a desktop, you have two ways to do it. Either you can enter individual device IDs and make those endpoints.44:37As trusted or you could put them all in a CSV formatted file and import all your device IDs together. And at any point, you can always.44:57See all your managed devices under one place under view button. And we always recommend testing with the group. This is the group that in this demo we are testing it against. Let's take a peek at all the managed devices that we have.45:07Once you're in here, you'll see your device identifier and a quick description to figure out what machine or endpoint that is and the date it was added. Now let's go back. You have set up your Active Directory integration. Now the next.45:23In the process is.45:43Creating a policy, applying to a small group of user and seeing that in action. Let's go to applications dual central. This is our SSO portal within dual central. You go to configuration and policy. So this page tells you how a user would access or which you.45:45User can access your dual central.46:04This section is application group policies. In here you can apply a policy to a group of users. So for this example, I'm using trusted endpoint policy. In this I have applied this policy to a small group of users. And at any point if you wanna see.46:08How many users would this affect you? You can always click on your, the group link and it will quickly take you to.46:27The description of that group. What is that group? How many users are within that group? It gives you a quick rundown of, ok, these are the users that would be affected by this policy. Now, if we go back, let's see within the policy.46:35You could pretty much add whatever we discussed today so far. Let's go ahead and hit edit. Once you're inside the policy, you can see what all applications or groups it's applied against. A policy could be applied to multiple applications. So in this case you have, we are applying the same policy.46:52See to do a central as well as another SSO application.47:11Apart from applying to a small group of users. Now let's head head to trusted endpoints. Turning on is very simple. You just toggle the button, say block endpoints that are not trusted. Now Duo is going to do all the magic when the user locks in. Moving on to authentication methods.47:15Here you can see all the options that are available today. So admins can decide what factors to make available, and Duo makes it very easy by slapping a recommended tab. The one that you see in green are.47:34All fishing resistant MFA factors and do it makes it a point to highlight that to admins or helpdesk guys who are in a hurry so that they always select the right one. And we also have other options, but we do highlight saying if you have a group of users who want to use SMS.47:50Or hardware token still. There is still an option but we make it a point to say, hey, do it on.48:10Take take a second before you turn it on. And for passwordless, we do the same. Drill, there is recommended options where you can select whatever seems perfect for your environment. Now let's see.48:16How all of this look like for an end user? What we saw so far was administrative view. Now for an end user, let's say the user is trying to access the his 1st SSO application. In this case, it's the Duo central.48:33What user sees is the very 1st one is, a login screen, and in this demo, I'm demonstrating a passwordless login. All the user has to do is put in the username and hit on that login button.48:49Now, if you notice there was NO password prompt at all. There's NO option for him to do the password and MFA got combined into one step, and the user selected dual verified push. Now, you do have all the other app for flexibility, you can provide more factors so the users can.49:04Can select what they want to do. It also improves you know enrollment and adoption as well. Now, when there is a duo push, users go into do a mobile app and key in the verified.49:24Digits. Only if the digit matches the MFA passes through. So this is a fishing resistant factor. A 3rd party cannot or a hacker cannot be trying to log in where the user will not have the option to know the right digits to put in. Mixing it making it the most secure op.49:39Option of secure factors available. Now this is your application launcher. You can find all your tiles in here.49:59And also you have the quick links to adding or re enrolling your devices. This is now the end user is done. Now, if there is an issue, this is where your admin or helpdesk guy would land in. You look at your logs.50:07In this case, since the last authentication was a success, you can see that it was granted and the user logged in using verified passwordless push. You can also see the username and the application the user is trying to access.50:25Now, on the risk based policy assessment, you pretty much can see why that user was offered to do a verified push as opposed to remembering a session. So the risk policy says, hey, this was a new session, I didn't know about the session before, hence.50:44Let the user do an MFA and from that point onwards, a session would be noted unless nothing changes. For let's take a scenario for a denied user. Now, in this case, you can see that he was denied because there was NO response, and it is it was also a new session. There was.51:04There's NO previous session.51:23Recorded. So remembered session wouldn't be used in this case. So user was, and user could not complete his MFA, so he was denied. Now on the access device section, the device is a trusted endpoint as determined by Duo desktop. So duo desktop was running on this machine and.51:25It gave us all these information about firewall password.51:45If a security agent was running or not. Now this duo desktop, you can access from your taskbar. It's a really lightweight agent that's running on your machine and it only comes alive when there is an authentication and an MFA with Duo involved. Otherwise it just stays invisible and silent.51:49And it, it continuously collects data like your operating system, health password et cetera, and shares that with Duo on the admin panel. So at any point an admin or a help desk can always log into duo admin panel and see what was how was the health of the devices that you.52:09Users are accessing. That brings us to our, to the end of the demo. Moving ahead, if I want to highlight three things to walk out with today, that would be these.52:29The 1st one is security 1st is an architecture. It's not a feature. Duo was a security company 1st and the directory SSO and MFA were designed on a shared security foundation. It was not bolted on late.52:48Here.53:07One concrete action item to take away is that start with your users, decide how you want to bring them into your dual tenant, get them enrolled. Next, that's the foundation, everything else plans around. 2nd one is you don't have to migrate to modernize the broker model routing rules and.53:08Passwordless, all point to the same idea. Your existing identity investment becomes the backend.53:28Not the blocker. Duo gives you one front door across many directories. You keep what you have built and you get the security layer on the top. And the action item under this is pick your deployment pattern. Standalone broker or alternate directory for your 3rd parties.53:34Inventory the IDPs, you need to sit in front of and configure routing rules, so users land in the right back end automatically. The 3rd one is trust is adaptive in both directions. Healthy and trustworthy device signals.53:55Combined with risk based authentication mean friction goes up only when risk actually goes up and down the rest of the time through remember devices. That's the part that lands with end users. Better security and a quieter login experience. Most.54:14Platforms make you pick one. The action item under this is roll out duo desktop and do a mobile 1st, so you're actually collecting device signals, then layer in trusted endpoint policy and turn on risk based authentication. Do those in that order.54:34Security 1st foundation, NO migration required. Adaptive trust in both directions. That's the session in three lines. Alright, let's open it up for Q and AI want to introduce Philippe, our CMS.54:55Access who's here to help tackle your questions. Go ahead and drop your questions in Slido and we will walk them through. Thank you Shruti. What an excellent presentation. Well, as Shruti mentioned, would love to see.55:15Any questions that you may have come through the Slido so we can get them answered. But to get us started, I think I'll highlight just the two questions that did pop up during the session. The 1st question coming to us from Bill, and he asked us to kind of contrast do a push versus do a verified post.55:34And I think everyone here is familiar with dual push, right? This is basically the the premise of having.55:55Something you know, right? And then having your enrolled device. So as you're completing MFA, you received your push notification from that enrolled device, you complete MFA. Well verify push takes this to the next level by also presenting you with a code that is of a customizable link.56:02That is presented on the access device and that is the important piece, right? Because.56:22A bad actor that's potentially trying to fish your users would need to have both the access device and the MFA device to complete the verified push. So that separation there adds the extra layer of security. And as Shruti mentioned earlier, this is an additional.56:27Factor that can be enabled within your policies, whether it be standalone for everything or just included into the selection that risk based factor authentication can reach to to present a higher form of authentication should there be any risk factors?56:46Then 2nd question that we did see come through from Catherine is specifically around the admin roles and the access into SEC, so she's asking, do you need specific dual admin roles to access SEC? Is dual support in charge of troubleshooting issues related to Cisco SEC?57:06So the 1st part of it is a bit nuanced. If you started off with your SEC tenant 1st and then you deployed your duo tenant from there, then yes, the roles would actually federate into your duo tenant from there and you would be able to access it that.57:25There's a bit of a different workflow if you started with Duo 1st and then you got SEC, right? Because in that scenario you would already have your admin roles within SEC and you would need to claim your tenant via SEC. So it's slightly different workflow there, but hopefully that answers that part of it. Now the.57:43The bit more interesting part here is, is duo support in charge of troubleshooting the SEC related items? And that one is, is a NO. Cisco TAC is in charge of supporting the SEC products.58:03However, if you do reach out to dual support for issues like things with your MFA being invalid or you need to update your device or signing into SEC and stuff, they would guide you through to submit a case to TAC, but if you also have something like signature support or enhanced support, the dedicated team that you get in that case from.58:17The customer success side would be able to guide you through the TAC engagement to get that resolved along with any other issues.58:37Okay, and it looks like we do have a couple more questions coming in. So the 1st one here is can we set different authentication policies for contractors versus full time employees? Excellent question. This touches on kind of what Shruti talked about originally with how.58:50Doing different controls for different personas, and the answer is yes, that's one of the key advantages with duo, right? You can create group based policies so 3rd parties and contractors have their own authentication requirements without mixing them up into your employee policy, so.59:10You might require stricter device stress or step up authentications via risk based factor authentication for external users while keeping things frictionless for internal staff. Let's see, we have a couple other ones.59:26Could you please share the requirements for passwordless authentication? Yes, of course. So we have quite a quite a few requirements there, but.59:46Obviously all of it is in relation to how you set up your duo SSO here. Give me just a second. I'm gonna pivot to this this other question that I have here.01:00:00Does Duo desktop impact end user performance or is it invisible to them? So duo desktop does not affect performance. It is a very lightweight application. It runs in the background and the users don't really interact with it day to day. The device health check happens silently.01:00:16During the authentication so.01:00:36There is NO pop up or delay that the end user would notice. It is designed to run in the background with very little CPU usage essentially so pretty seamless solution.01:00:38Let's see. Do we have any additional questions or anything that we want to add, Adam? I think for this one we might.01:00:56We get.01:01:16Okay. Well, we do have one additional question that I wanted to pop in there from our frequently asked kind of repository and and that is one that's super relevant as all features that Shruti touched on with kind of Duo being an IDP hub.01:01:23And that is we already have an established IDP we use. Do we need to replace it to use duo's advanced features? And the answer to that would simply be that while you can simplify your identity stack using Duo as your source of truth for identity and security.01:01:42Or for your SEC applications, you do not need to migrate to modernize this stack. Duo is designed to work as a standalone IDP, but we also integrate well with other external identity sources as an identity broker. So you can integrate Duo with your existing IDP to layer on the advanced security feature.01:02:00Like MFA resistant phishing resistant MFA, device health checks, RBA without kind of disrupting your current directory infrastructure, so pretty powerful thing to do there but with that.01:02:21Truthy I think I'll pass it back up to you as I don't see any additional questions coming in. Thanks Philippe. That was awesome. Vict, thanks to you for joining us our panelists and thanks to all of you for the engagement.01:02:41Next up, we have module two navigating your Cisco Duo environment.01:03:00Stick around and we are just getting started alright welcome back everybody to module two. I'm John Ortman, the peanut.01:03:06That butter half of your duo duo, that is a pun intended, and I'll be your presenter today. So the best part, AKA the jelly, is gonna be Adam who will be handling all the Q and A So drop your questions into the Slido as we go.01:03:26Today we move from concept to execution. I'm going to show you how to run Duo with confidence from admin navigation to policy design and real deployment decisions. By the end, you'll have a practical blueprint you can apply immediately. Let's start by making.01:03:42Making this interactive. Please use the Slido throughout the questions, ask the questions that they come up and don't hold them back. Participate in the polls as well. To set context here are three questions that frame everything we'll cover today.01:04:02What administrator roles do you want to have in your environment? This one's kind of near and dear to me cause I just had a customer yesterday who gave their entry level help desk a little.01:04:26Too much permission and they not only reset an end user's.01:04:42Mobile device, phone number and gave it to a bad actor. They also changed the password and gave that to the bad actor as well. So admin roles is top of mind for me right now. So yeah, let me know what administrator roles you want to have in your environment.01:04:47User manager. Yep. We got those any others and we have custom admin role if the ones that you're used to seeing in there, that's a newly released feature in the past few months. So we have all kinds. Yep, someone with mixed permissions, so maybe that might be the custom admin.01:05:13And roles, where you can kind of create your own.01:05:33All right, we've got one more a pseudotype admin. Yeah, again, we have a couple of different built in ones. Again, the custom admin roles is gonna be the go to for anything that doesn't meet our built in ones. Let's go take a look at the next question we got for you.01:05:42So what type of applications are you looking to protect in your environment? The pluses we should be able to handle them all. Alright, those are the ones, those are the ones that everybody seems to be.01:06:00To use them these days.01:06:20The radius and LDAP seem to be, it's a thing of the past still out there. We still support them, still our bread and butter that other people can't do. Yep OS login, that's a big one. ADFS OWA. Perfect. All right, let's.01:06:23Jump to that next question. And then what self service options do you want to enable for your end users? So this is one of those kind of key things to be able to relieve some of your help desk, and put it back on your end users to handle some easy things.01:06:43That don't need to come to your help desk and waste their time. Perfect. Excellent. Optimize to minimize login prompts. All right cool. So we have a couple things there. We got remember devices and passport for that one.01:07:04And then device self enrollment. Yep, we've got the self service portal you can do with that and self remediation for posture checks, and I think that should do it. So let me jump back over to the slide deck alright.01:07:23So, we have five sections today in the admin panel navigation. We've got the core building blocks, deployment best practices, I'll do two demos, and then we'll wrap it up with Q and A So I'll try and keep this practical and implementation focused. Less theory, more, here's what you do on Monday. We'll have a dedicated.01:07:44Created 10 min Q and A at the very end.01:08:03So let's begin where your operation team lives every day, the admin panel. This section is about operational fluency. The faster you navigate, the faster you can diagnose, act, and improve security outcomes. But 1st, we need to make sure that the licensing context is clear. Every.01:08:06Duo edition gives you a strong core. You get MFA, broad integrations, and Duo mobile.01:08:26Advantage adds deeper risk and identity protection, like risk based authentication, dual passport, and Cisco identity intelligence. Premiere adds the broadest zero trust package we have, including complete device trust text checks, and the.01:08:34VPN less remote access.01:08:53Now, let's look at the admin panel as the central control service. The admin panel centralizes users, devices, apps, policies, and reporting in one place. What you see is shaped by admin role and addition.01:08:56So access design matters from day one.01:09:15Role based access should mirror your team's responsibilities and accountability. So ask yourself, what slows your team down more right now? Finding the right duo setting or deciding the policy model. Your homepage is the 1st thing you'll see.01:09:20Here's how to get value from it. Treat the homepage as your daily health check. It quickly surfaces whether users, activity and authentication behavior are trending in the right direction. If something looks off here, you know exactly where to go next.01:09:36The menu structure is what makes deep navigation efficient. As you look at the left navigation, think of it as being organized by object type and task area. Home gives you the high level summary.01:09:57Users is where you manage users, administrators, and your directory syncs. Devices is where you work with phones, endpoints, hardware tokens, the web authent devices, and trusted endpoints. Policies is where you define enforcement by group and by.01:10:14Application, including duo passport. Application is where you add and manage protected applications plus SSO and passwordless configurations. Reports is your evidence layer for authentication, events, administrator actions, and operational troubleshooting.01:10:33The sub menu structure follows the same pattern. User related actions live under users, device related actions live under devices and policy logic lives under policy. Integrations live under application and logs and dashboards live under the reports.01:10:54One important point here is that the menu can look different depending on both the role and addition you have. E.g., monitoring is only available with Advantage and premiere. Some advanced SSO and passwordless capabilities depend on addition. And admin role.01:11:11Can limit which sections appear at all. So if two admins see different navigation, that is often expected, behavior and not a problem. You never have to leave the platform to get help. Built in help resources, connect products, community guidance, support, and service status.01:11:31All in context. This shortens troubleshooting cycles and keeps your team self sufficient. That matters at 02:00 A.M. during an incident. Information about your duo tenant is also on this page. You get your account ID.01:11:50Deployment ID and your current duo version. For speed at scale, search is one of the most valuable features in the admin panel. Search lets you jump directly to users, groups, apps, devices, and pages.01:12:07In a larger environment, this removes a normal enormous operational friction.01:12:27So don't overlook it. Duo now also gives you AI assistant guidance built right in. The AI assistant lets you troubleshoot troubleshoot user access issues and find configuration answers using natural language.01:12:32A real time saver for new admins in particular. A quick note, it's currently available in the US, Australia Japan, India, Singapore, and Europe, and it uses, and it uses as an acceleration layer. Always verify the results before acting and give feedback on responses to kind of help improve the model.01:12:50So now let's quickly cover the settings area. Then we'll move into a live demo. Settings is where you fully customize both the admin and end user experiences. Critically, changes here apply to the whole tenant, not just a single app.01:13:09Treat this as a controlled configuration and document every intentional change. So now let me show you some of this in action. I'll show how the admin panel basics, some of the home navigation, search, the AI assistance and settings work together in real operation.01:13:27So we're starting with an owner account, which gives you unrestricted visibility across the entire Duo environment. Then we get to the homepage. This is your at a glance dashboard. Users, devices, and recent authentication activity all visible in one place.01:13:52Notice the navigation is organized by operational function. We have users, devices, policies, applications, and reports. That grouping keeps workflows logical and fast. Expand each menu to show sub related sections. E.g., users.01:14:14Includes both users and administrators.01:14:32Again, help is always a click away. You get access to helpful links, status pages, the ability to open support tickets and your tenant information in one helpful screen. The AI assistant.01:14:35Lets you ask questions in plain language. The assistant uses natural language processing to interpret your question and query your tenant data in real time. Always validate what it returns before acting on it.01:14:55Now let's jump to settings. Settings is where you customize the Duo experience. Here you can review account information like the account ID and account name. You can set the country and time zone and update branding options like the logo and custom branding for the universal prompt Duo SSO and duo mobile.01:15:11Be sure to save the changes after making any updates here. That's something that's usually forgotten cause it's all the way down at the very bottom.01:15:311st, now let me jump to the search bar and I'll show you how the search works. So I'm gonna go to admin roles, and then I'm gonna find the billing role. We have a new option where you can now assume the role 1st so we can verify the scope before assigning it to any administrator.01:15:44The billing role can view and modify only billing information. So the scope is very specific and easy for us to confirm on screen. Now that we've confirmed the scope, we can end the session and assign it right and assign the right users to the role.01:16:04So that wraps up the 1st demo. Let's jump back into the presentation. So this is our pivot point from the interface to the design strategy behind it. Successful deployments balance five elements.01:16:23Admin and user governance, app integrations, the policy stack, monitoring and user experience. Weakness in any one area creates risk or adoption friction.01:16:40And both outcomes hurt your program. These blocks are interdependent. So what slows your team down more right now? Finding the right duo setting or deciding the policy model will start with governance.01:16:56The control plane for everything else. So managing your administrators and users is key to a successful duo deployment. Applying least privilege to admins and keeping user life cycle management in order are both.01:17:12Critical to identity security.01:17:33Here are the controls that make Duo real. Assign least privileged admin access, use administrative units to scope control and enforce constraints. Custom roles are especially valuable for separating duties across security teams.01:17:36Helpdesk and application owners. Don't use owner or administrator roles as defaults. They're exceptions, not baselines.01:17:56These are the built in role patterns you can start from today. Built in roles map to common operational functions, owner, administrator, help desk, security analysts, and so on. Most mature teams refine these with custom roles over time.01:18:09The goal is precision access with clear audibility. So you always know who changed what and why. Next, how do we onboard users without creating a help desk backlog?01:18:30To compliment the enrollment policy, you have a range of options to enroll users and for users to enroll themselves. You can still enroll users manually and you can sync users from Active Directory, entry ID, Google Workspace, Okta or open ldap.01:18:47If needed, you can also use the admin API to build your own sync process. From there, send individualized enrollment links to the Duo's cloud portal so users can enroll duo passwords, traditional MFA factors, and passwordless capable authenticators.01:19:05Two newer options here are enrollment codes and enrollment via an AD or SAML authentication source. For help desk assistant enrollment, verify identity 1st, then issue a one time code. For migrations or 1st time rollouts, direct users to your portal URL and let them.01:19:24Enroll after credential verification. If you want to strengthen the enrollment process, you can lock an account out if it has not enrolled within seven days.01:19:44Enrollment policy is where this becomes truly scalable. The new enrollment policy cleanly separates enrollment from authentication, so you can require new users to enroll passwordless capable factors while still letting existing users authentic.01:19:55With password based MFA.01:20:14During transition. A concrete example, you have a call center who the users where the users don't carry a phone, create a group enrollment policy requiring them to set a duo password and enroll with Duo desktop as an authenticator. Or you can go true passwordless from day one with pass keys like touch ID.01:20:17The windows hello.01:20:37That level of group control is what makes this a high value, quick win if you haven't deployed it yet. With users and admins covered, let's shift to applications and integrations. Applications and integration is.01:20:39Design is where security architecture meets business workflow.01:20:59Here's some of the integrations that Duo covers. Duo coverage spans both on prem and cloud based application. That includes Windows login, Mac OS.01:21:03Unix and protected access for radius or LDAP login flows. It also includes newer support for on prem applications that authenticate against Active Directory using Kerberos or NTLM. Duo also supports API and SDK based integration types. The key takeaway.01:21:19Here is consistency.01:21:39One identity security model across a mixed environment which reduces both risk and operational complexity. The application catalog accelerates this work significantly. The application catalog gives you options across.01:21:42Across the different application.01:22:02Service and device types Duo can protect. You get named integrations with pre configured vendor specific templates for fast setup plus generic templates you can tune to your environment. Duo Central then lets you curate a branded access hub.01:22:04Where users see exactly the application they need. Search tiles quickly and access self service device management when enabled.01:22:24You can publish app and bookmark tiles, you can control visibility by group and provide a built in help link for faster user support. Before configuration, it always pays the classify by application type.01:22:33Application type drives what controls you can enforce in what user journey you'll deliver. Classify early to avoid rework. This is one of the decisions that's cheapest to get it right up front.01:22:50So now let's define what a Duo application actually is in practice. A Duo application is what binds Duo authentication to a specific service or platform like a cloud app, VPN CMS email system or.01:23:06A hardware device. You can protect as many applications as you need and manage each one independently. So policy and settings match that app's risk and business requirements. Looking at your environment, which application needs its own custom policy?01:23:25Alright, 1st step in every app configuration is defining access. You can decide which groups can access the app and keep defaults conservative. If you choose enable for all users, all existing active duo users can.01:23:47Can authenticate to that application. Explicit access modeling prevents accidental broad exposure. The default is access disabled.01:24:07That is the right starting point. Then let's tailor that authentication behavior to the business risk of each app. You can segment your policy per app. So high risk systems get stronger controls.01:24:19Will low risk workflows stay efficient. With application group policy, you can apply a policy to the application for just a specific group of users only giving you fine grained control without broad enforcement. This is where security.01:24:37And usability are balanced intentionally, not by accident. Finally, tune the operational settings for ownership and long term support. So the self service portal lets you add, update.01:24:54And remove lets users add update and remove their own devices in line. This dramatically reduces your help desk workflow. Username normalization ensures users can authenticate regardless of how they enter their username. Has plain names, domain backslash format or an email format?01:25:11That.01:25:31And they all resolve to the same Duo user. Without it, those formats become three separate accounts in duo. Finally, if you're delegating app management to specific teams, use the administrative units to restrict admin visibility and control to j.01:25:32Just the apps and users assigned to that unit.01:25:52With your app strategy locked in, we're ready for the enforcement core, the policy stack. The policy stack is the enforcement core of duo. You get this right and everything else reinforces it.01:25:57Let's break down what the stack actually evaluates. So there are four major categories in the duo policy stack. User login behavior, new user policy controls, enrolled users, authentication policy enforces MFA or bypass rules.01:26:14And user location enforces geo blocking. Device compliance. Every verify endpoint trust with duo desktop, you can enforce health checks, they can either firewall encryption, screen lock, you can manage OS and browser versions and block campered devices.01:26:33Then we have network access. You have authorized networks to skip or require MFA per IP. You have anonymous networks that detect VPN and proxy traffic. Then you have your authenticator controls. So this is where you get to choose which factors are allowed and apply risk based selection as well.01:26:53A well built policy tightens security without making life harder for the people it protects. The policy header is built to make managing all of this maintainable at scale.01:27:14The strength of dual policy is that it is modular and reusable. Create a policy once and then apply it in different places. Global policy lets you set a baseline for all users and apps. A user group policy targets selected groups across apps.01:27:31An application policy targets all users of one app. An application group policy targets selected groups on one app. This means one high security policy can be reused for different contexts, like executives across many apps.01:27:51And admin groups on sensitive applications without creating a pile of one off policies. Compact view gives you a high value single pane governance. Compact view gives you visibility into all of your policies in one place with minimal clicking.01:28:09You can see where each policy is applied and what changed recently. The actions menu links directly to bulk apply, and that's a powerful combination, which brings us to the next slide. Bulk operations let you deploy safely and quickly at scale.01:28:29So bulk apply lets you assigned and unassigned policies in a single action. Need the same policy on 40 apps? Done. No more clicking into each individual app. This is where reusability of the policy stack pays off in full.01:28:49Always review the impact before deployment though. Consistent is great. Consistently wrong is not. To avoid surprises, teams must understand how policy precedence works.01:29:06Policy stack in a specific order. Global policy applies to everyone by default. A user group policy overrides the global for selected groups across all applications. An application policy overrides global and.01:29:24That user group for one application.01:29:44An application group policy is the most specific of all. When a user is in multiple groups with different application group or user group policies, the 1st policy listed has the highest precedence.01:29:47That ordering matters. It determines real world behavior. Document it clearly because misalignment here is one of the most common sources of unexpected behavior in duo deployments. And when in doubt.01:30:04Verify with the policy calculator. The policy calculator is your verification tool. Select a user and application, and it shows you the exact effective policy that applies at runtime with a clear rule by rule breakdown.01:30:20Showing you which policy each rule originates from.01:30:40Use it to verify policy changes before rollout, understand why a user was denied access or troubleshoot unexpected access behavior. It eliminates guessing about what really happens when global application and group policies stack together.01:30:46Next, we'll close the loop with monitoring and reporting. Visibility turns into policy into measurable security performance. Duo reports are built around actionable signal. Let me show you what that means.01:31:06Duo reports are designed for real operational conditions. Maybe a user can't access an app. Maybe you're tracking a push phishing attack in progress. You need to trace exactly what happened and act fast. That's what these logs are built for. A hundred and 80 days of logs directly in the duo admin panel, you should.01:31:29You don't have to pay more to see your own data.01:31:49Real time updates within seconds. If you're losing a sim, like Splunk, Duo integrates directly for long term aggregation. But the built in logs are designed to be immediately useful without a sim. There are three key logs to anchor your operations.01:31:51The authentication log is your go to. Who, what, where, when, why, how. Plus you get risk based authentication sequence details. When in doubt, always start here.01:32:10The SSO log gives you federated identity activity. Successful and failed logins for your SSO integration. In the activity log, our newest report covers everything that's not a login. Users managing their own devices via the self service portal. Admins provisioning accounts, ap.01:32:28APIs and directory syncs creating and deleting users.01:32:48Together, these three give you complete investigative context across the full identity life cycle. So think back to your last off issue. Which log got you the answer 1st? Dashboards then translate this data into opera.01:32:51Operational decisions. Three dashboards that are worth naming. Device insights. This gives you a summary view of device health across the environment. Think operating systems, browsers, and plugins so you can quickly spot what is out of date.01:33:11Deployment progress tells you the adoption story in your environment. How many users are in duo? How many applications are protected, the average number of devices per user, and the top authentication method from the last seven days.01:33:33Lastly, the policy impact shows who was affected by policy, including what was blocked and what was expedited by trusted networks or remembered devices. Use these dashboards to prioritize remediation, improve program value to your leadership with data.01:33:50Not anecdotes.01:34:10Security only works if users can participate successfully. So let's focus on experience. User experience is not separate from security effectiveness. It is part of it.01:34:14Self service is one of the highest leveraged tools here. With the rise of phishing and social engineering, users need a secure way to manage their own authenticators. Replacing a phone, enrolling phishing resistant factors without calling that.01:34:32Helpdesk.01:34:51That's the self service portal. The standalone SSP policy means you can require stronger authentication to access the portal itself. For Bidding phone calls or SMS passcodes requiring a trusted endpoint maybe, and completely separate from your other app.01:34:52Policies.01:35:13Instant restore uses encrypted backups in Google Drive or iCloud keychain. And it also now works for 3rd party OTP accounts. Like Facebook, Instagram, the ones that probably mean the most to your users in the duo mobile app. Users won't lose those when they switch phones either.01:35:16The fastest help desk load reductions available right now.01:35:35Remediation guidance goes even further by helping users fix issues themselves. Think of duo's OS and browser policies as a compliment to your MDM, not a replacement.01:35:41Mdmiss can lag before device check in. Duo checks device posture at every authentication and blocks non compliant devices immediately. The key is that users aren't just blocked.01:35:58They get a grace period to clear and clear step by step instructions to remediate. Duo desktop guides them through OS updates, password requirements, disk encryption and firewall settings.01:36:13Users resolve their own issues. Your team doesn't have to be in the loop for every device fix. Now let me bring these building blocks together in a second demo. I'll connect users.01:36:30Application policies and reporting into one practical workflow. So here's the list of all admins in this system. Each one has a role that defines what they can see.01:36:46And do. This admin has a custom role called Okta admin. It's limited to Okta related work, not system wide management. When you create a new admin.01:37:02You get to choose their role. This role determines scope and permissions. You have owner, manager, help desk or even custom roles available to you.01:37:22Owner has full access, manager can create and view certain things and help desk is support focused, and then again custom roles let you define exact scope and you can see the Okta already.01:37:41Created Okta custom admin one that I have here too. So as I move into the administrative units.01:38:01This is where you get to segment admin access even further. So this Okta access unit that you see here, it only sees Okta groups.01:38:07And the Okta app that we, the Okta app or integration that we have in this system. And then you can notice it's linked to my Okta administrator. So that's how scope is enforced. Role plus unit equals what this admin sees.01:38:23So while I navigate to the login settings, these controls define how admins authenticate. You can enforce MFA and set session timeouts here.01:38:43So this is where governance of the admin plane happens, including who can log in and how they authenticate. So next I'll move to admin SSO.01:38:59You can also use SAML, SSO for your admin admin authentication similar to how you'd enforce it for your end users. Requiring SSO means admins authenticate through your identity provider, not local duo credentials. Note, though, that owners are exempt from this.01:39:14This requirement. Now we're shifting into user management. This is your user directory.01:39:34With a summary metrics at the top, such as your total users, your enrolled users and statuses, which users are in bypass, locked out, inactive, and in the trash. So your users come in via multiple channels. You have synced from active directories, import as a CSV.01:39:41You have the bulk enroll option or you can add them one at a time. So let's jump into the external directory real quick and then I'll show you this is where your configuration sync sources are. So in this case we have AD sync and then two AD syncs and then an intra ID sync in here and users are pulled in automatically from these sources.01:40:01So let's jump back to the user list and let's open up a profile. So this view shows everything on a user. You have the devices, authentication history, policy impact, and applied attributes. You can see what devices the user has enrolled and which apps they've authenticated.01:40:18The two and any anomalies.01:40:38And then if we go back up, you'll see we have an option to require two FA on the next off. So this is something handy to remember when you're doing the remember devices because this will end a user's remember device session and require full authentication on their next access.01:40:41And then now that we're a directory service, you can also enrich your users data here so you can add extra attributes such as a job title, location, cost center, whatever attributes you might need, you're able to add.01:41:01So now let's move over to applications. So Duo has integrations for hundreds of named apps like Okta, Salesforce, Microsoft, and Slack. All searchable.01:41:17And filterable. You're not finding your app in the catalog, you can use a generic SAML integration for any standards compliance app. So next I'll switch from the catalog to my already configured apps.01:41:35So this list is going to show the applications that are actually in use in my environment. Let's go ahead and open the Atlassian application. This FYI is a generic SAML app, meaning it authenticates via SAML and is protected by Duo.01:41:51You can scope this app to specific groups 1st, and then as you continue down, you can use the ownership and risk to assign accountable application owners and classify sensitivity for better access visibility and review. Then you can attach policies to control who can access and what device or authentic.01:42:13Application rules apply.01:42:33Now let's transition into policy. So policies define the security rules, and this page shows each policy with its assignment, scope, applications, groups or both. These icons tell you at a glance where a policy is applied that helps you understand policy coverage.01:42:40Here are the key management actions for this policy. You can edit it, duplicate it, speed up new policy creation, apply it, unassign it or delete it when it's NO longer needed. And then each policy is made up of configurable control sections.01:43:00You can enable only the controls you need and tune settings like authentication methods, device posture, operating system, and network rules. Let's take a look at the new user policy control as an example. These sections right here.01:43:18Show you, what does, what does the app or what does the control protect against and what does duo recommend? So you have duo guidance built directly into the UI. So as I open up the policy calculator, this is going to be your.01:43:37Your quick test tool. You pick a user and an app to see the effective policy they get. It's great for troubleshooting. The calculator shows you the effective policy in plain language, so you know exactly what that user will be prompted to do at login.01:43:56Next, we'll move to reporting. Reports give you visibility into authentication events, Deployments, device health, and admin action. This log shows every authentication attempt, who, when, which.01:44:18Map which device pass or failed. You can filter and export this log.01:44:36The graphs at the top show your successful versus failed authentications over the filtered time frame. So then as I switch over, let's take a look at the single sign on logs. So this shows the full one F.01:44:42FA and two FA flow when Duo SSO is configured.01:45:02It's your detailed record of SSO sessions. Now i'll move over to activity logs. This records every change including user modification, admin actions, and API calls giving you a strong compliance audit trail. You get full contact.01:45:08List what changed, who changed it, when, and from which IP? Perfect for internal investigations.01:45:27Before we wrap up, I'll jump to Device insights. Duo Device Insight gives admins a centralized dashboard to see which devices, platforms, and browsers are accessing your Duo protected application. And it flags which ones are outdated or post.01:45:34What's a security risk. So I'll navigate us back to home and let's close the loop. So the dashboard reflects everything we just walked through. Administrators, users, applications, policies, and your device posture.01:45:54So that wraps up the final demo. Let's jump back into the presentation and close it out. So again, best practices are about sequencing and control, not just feature adoption. So matro mature rollouts are deliberate and measurable. Here's a field proven implementation flow.01:46:13Start with organizational needs. Configure and test your apps, run a pilot, and then scale to a full rollout. The stage model catches issues early, and it also helps build stakeholder confidence, which is just as important.01:46:34As the technical validation.01:46:53Now, let's map this framework to your own environment. Duo journeys turn the rollout into a guided path in the admin panel. They organize the work into steps for things like onboarding, device trust.01:46:56Logins and admin setup, so you can see what is required, what is optional, and what is recommended. That makes it easier to decide what is already mature, what is cons inconsistent, and where the highest risk is so you can start in the right place.01:47:13What is your next best best step? Which duo journey is gonna match your team's top priority? Here's the three point summary to take back to your team. Prioritize three outcomes, a smoother enrollment and user experience.01:47:32Stronger policy enforcement and comprehensive visibility. These aren't competing goals. Duo is designed so you can achieve all three. And one more tool worth knowing the duo journeys, which is accessible directly from the admin panel, it gives you best practice.01:47:49Guidance and optimizations take steps tailored to where your deployment is today.01:48:09Let's open for questions and apply this to your specific s environment. Let's use Slido for some Q and A Think about questions on rollout, sequencing, policy design, and troubleshooting. Those typically unlock the most value fastest.01:48:16With that said, let me pass it over to Adam. Thanks John. Great presentation. After that presentation I don't know if I'm gonna be the better side of the PVNG combo that you had that you.01:48:32Came in with at the beginning there, but I will try my best. So while you are thinking about your questions like John said, you're putting them in the Slido I want to lead off with one of the biggest common questions that we do get from the field around user management, and that is.01:48:47We sync users from Active directory. So how often does Duo pull these changes from users and can we trigger a manual or an on demand sync when users are added or removed or changed group memberships from within Active directory? So with that, what Duo does is Duo runs a full scheduled sync.01:49:03Twice a day, every 12 h at an interval that is chosen at random from the time that that sync is created. If you do need more updates more often, you can enable what's called a high frequency syncing on the directory details page, the configuration there, and within that option, when that option is on.01:49:21It will start another user sync about 30 min after the previous sync has completed. If you need to turn that off, if you find it's too frequent you're able to just turn that right back off and it defaults back to the default configuration there. For admin specific directory syncs, if you're using the admin sync from Active directory, that runs automatically about every 30.01:49:408 min.01:49:59But if you're wanting to to trigger syncs on demand, there are a few different ways. One is a full directory sync. On that directory sync configuration page in the admin panel, you can click sync now in the sync control section and this will do an immediate import of all, any updates that you may have made on the active directory side and pull those into do.01:50:00Hello.01:50:20If you have individual user sync in the sync controls, you can enter up to 50 usernames commas separated to sync specific users immediately. You can also open the user's property page and click sync this user under that specific user. And you can also do this via the admin API, you can do both full, a full and an individual sync.01:50:21Week.01:50:41And those can be run within the API. If a sync fails for whatever reason, this maybe due to a proxy connection failure, Duo will retry that sync in 15 min after it, it is originally run.01:50:42All right, another common question that we do get from the field is, is the user experience customizable by the organization so that the user sees the organization branding instead of the duo or persona branding, and the answer to this is yes. You can both Duo and persona can support white labeled custom.01:51:07Allowing you to apply your own branding, logos, colors, domain or any messaging so that your end users see, your organization, your organizationals.01:51:27Information instead of the default duo ones. Alright, we had a question come in, so can administrators send bulk enrollment emails to users created locally in the duo directory and the.01:51:36Answer to that is yes, when the user does get created, you can send the enrollment email out and that is a setting that is enabled globally there within your admin panel to do that once the user is added to Duo, and is it.01:51:55Possible to use SSO if user has different passwords for different applications?01:52:15So with this one, if, if the user account, e.g., if you're, if you're doing an active directory sync from Duo over in your in duo, that user is existing in both the application and in duo.01:52:22Directly. So my question is, I'm assuming the user's in both. Hold on, let's see here, Apologize about that. If it has the same, so the answer to that would be is if it has the same auth source for both applications, then it would.01:52:40Will have the same password, but if it's separate on both, then NO, they will not.01:53:00Apologize for that, so let's see.01:53:04If there's any other questions coming in here.01:53:26So AD sync users have a login password for their computer and a different login for.01:53:46M 3605 outlook. So Michael, what do you mean? So, so if you if you have a login password for your computer, so if you're doing.01:53:52A, like a, so for if you, if you have the application that you're logging in for like the RDP application that's local to that machine, you're logging in there, but then you have your 3605 outlook. If they're not synced, it will be separate passwords. But if you have, so if you're in.01:54:09If you're in the middle like most people are where they're having a hybrid deployment where you have.01:54:28Both the user in Active Directory and the user in in entra. And if they're not, if you're not doing the password sync, then they would be a little separate. Let me see. Is there anyone else, Felipe or Sheila? Have you seen this from the field? I haven't quite seen this one yet.01:54:34Sure, sure. Yeah, I think Michael, if you if what you mean is that you are in a hybrid environment as Adam mentioned, and you don't have AD Connect going to synchronize the passwords or the account in general.01:54:55From your on prem AD or domain controllers to Entra, then yes, they would be different passwords, right? That being said, the point at which Duo integrates is what would matter in this case, right? So if you had.01:55:09Duo Windows log on protection then of course they would continue using their password that is from the domain controller, and essentially that's what matters is whatever application your user is authenticating to, what is the authentication source for that? So if it's something like a firewall that's using radius.01:55:25To your domain controllers then of course they would need to use that on prem password. Duo can still function there, right, in several modalities. And then finally, if you have different kind of like cloud applications like Office 3605, SharePoint or or any other web application that maybe out there.01:55:44That is plugged into your entra, then Duo can also step into that. The difference there is they would need to use the password for.01:56:04That portion of it. But it is another great highlight as to which, which, how many different authentication sources we can support and also an opportunity to interlaces do a passport.01:56:13And kind of leverage the different integrations that you have and kind of smooth out that different engagement they have across environments. I hope that answers your question. If not, you know, please give us a little bit more context.01:56:29Alright, give a minute.01:56:58Let's see if there's any update to that or if that was enough.01:57:01Alright, and with that John I think I will pass it back to you.01:57:22Awesome. Thank you, Adam. Appreciate it. Thanks for taking over and being the great jelly. Felipe, thanks for stepping in and being the strawberry jelly to this peanut butter sandwich today. So let's close it out. Thanks for the engagement and the questions today. That's exactly what makes these sessions valuable. So next up we'll be module.01:57:26Three strengthening overall security with Cisco solutions and we should be back in 10 min.01:57:46Alright, let's get back to it. We are on the last module of this series, thank you so much for hanging in there and hanging out with us for the past couple of hours. My name is Sheila Vida and today I will start us off.01:57:57On the final module that we have around how we strengthen overall security with Cisco solutions. I will be starting the presentation but my teammate Atusa will cover 2nd half of it and the content that you will be seeing today is prepared by our EMEA teammate, Alzir.01:58:15By now you know the jail, we do have a couple of questions to ask in the beginning to understand your environment a little bit better and see how we could incorporate some of those insights as we go through the presentation. And we will use Slido for that.01:58:37And let's get the 1st question started. In Cisco identity intelligence, we'll cover a lot of topics around identity insights that you have throughout your environment. So we would like to know.01:58:541st, what identity sources you do have in your environment? Not surprisingly, the local active directory is something which still is prevalent in every organization there.01:59:11And, sorry Michael I'm gonna like name drop you. We we're having this conversation around the authentication experience with different authentication sources. We'll make sure during the Q and A to address this particular question live. Right, ok, cool. So local Active Directory is again not.01:59:27The, the top choice here looks like a small percentage is also using SAML based solutions. This is actually interesting to see that there are a number of manual list of users and local users defined in the application. And all this information will.01:59:48We'll cover how these different identity sources would all be visible in the Cisco identity intelligence interface. All right, let's move to the next question, please. And this question is a free form one on how do you detect and manage identity threats.02:00:05In your environment. And this, you could take this question.02:00:25Multiple different, different ways. You could either share if there is a tool or a software application that you are using currently or it could also be a process that you are actively using in your environment right now to help us understand how you are currently.02:00:29Identifying and managing threats in your environment.02:00:49Clearly with the intention of us showing how Cisco identity intelligence would be able to support you in this very important security function. All right, thank you for sharing about your endpoint protection, your NAC and a Seam application.02:00:56Oh, actually, do we mind if we go back to the other question, please? I feel like a couple of people were still were still typing. Okay, splash top AM, that's actually, I had not seen that solution before, so let me.02:01:16Take note of that one Sounds good. Yep. A couple of integrations there. When John was covering the duo admin panel integrations, there is a way as well to export your duo logs into a SEAM that you're using.02:01:34For your organization and likewise we'll cover insights from there as well during Cisco during the CII module.02:01:54Right, amp, ICE, and managed threat monitoring. All right, let us now move to the final Slido poll, I believe that we have for the day on top of the feedback. But lastly, which of the following Cisco identity security solutions do you have and utilize in your entry.02:02:03Environment, and we are asking this question specifically because on the latter half of the session that we have in this hour, we will see how insights from Cisco identity intelligence drives the workflows that you have with other Cisco identity security solutions.02:02:23Due to time considerations, we're gonna be focusing on the secure access integration at this time. But on a future webinar or as you talk to your customer success specialists or your account managers, we are also extending the same insights from CII to drive other Cisco identity needs.02:02:42Workflows. And this aligns with what we're expecting. All right, let's close the poll out. Thank you so much. And now let me go back to my presentation.02:03:02In this module, we will cover an introduction of Cisco identity intelligence. We lovely call CII, we will share the dashboards and the interfaces that we have on this application. And we'll get the process started by walking you through how to light it up in your environment if it's something that you haven't in.02:03:20Enabled yet because we recognize that the.02:03:40The audience, the invite that we sent out was for folks who would be in like onboarding stages in their duo adoption. We'll also share some best practices on how you could utilize your Cisco identity intelligence tenant and to get the most out of it as we go along.02:03:43And then lastly, I'll pass it to my teammate to do Sa to share about how Cisco security, how about how Cisco Duo works on closing the identity trust gap with other solutions that we have. And then likewise, we'll end with a Q and A.02:04:01And because this is the last module, if there were questions that you have from the previous modules, we'll all tackle it in this last bigger Q and A before we wrap the series up. Alright, so we did see this image 1st when Shruti kicked us off on module one.02:04:19But Duo IAM is part of it is composed of this three main pillars all fitting on top of the world class user experience that we are proud, proud of in duo. In the 1st couple of modules you've seen the security 1st identity components that we have along with the end to end phishing resistance features.02:04:38That we are providing.02:04:58In this module, we are focusing on the unified identity intelligence solutions, and this is driven by a tool called Cisco Identity intelligence. In a nutshell, the problem, the challenge that we are trying to solve here is limited visibility.02:05:00In the 1st question that we do have around what identity sources we have, we recognize that identity could, could be staged in either an on prem solution like Active directory. If you do have SAML IDPs, you might even just have a, a local list of users as that whole.02:05:18Shared, and then you might have local user accounts attached to your applications.02:05:39And this identity elements are siloed and fragmented on each of these authentication sources, and for you to be able to understand your organization's identity footprint, it is essential to bring all these contexts together into one tool.02:05:44A representation of such different sources and what insights could be stored in each one of them. So user information is definitely one thing, but there might be information there as well on what machines they're logging in from and what machines you do have in your invent.02:06:03Tory, what services there are they are accessing some insights on what HR information system you are using and some critical attributes that you do have there.02:06:21And any other data or applications that you have in your environment. And this all is collated into this layer of identity intelligence where we process all this information together and highlight important insights for you to act on.02:06:34In a nutshell, Cisco identity intelligence is summarized by this diagram, which is my favorite to represent what CAI does. On the left side of it, it highlights how it's possible for you to enter data from multiple sources, whether that's information about where your identified.02:06:55CT and authentication sources are like an on prem or a SAML IDP, information around your HRIS systems, like who are your real employees who have been validated and what attributes are linked to them. You could also add information around your device management systems.02:07:15And the list of the applications that you do have along with the local users which you might have in those applications.02:07:35We also accept input from particular threat fields, and that will help us into that middle section here where all these data and all these event information is then sent into the.02:07:42The analysis engine of Cisco identity intelligence, where we do a posture management check and we guide you through the check and response mechanisms. We will see it more during during the demo, but during the posture management and the threat analysis sections of it, we highly.02:07:58By certain elements such as let's say a particular group of users does not have MFA configured or them, you might have accounts which are overprivileged or accounts which have not been logged into in a while.02:08:17And once when those are detected, we would recommend some cleanup or actual next steps that you can do to help rid of those posture inconsistencies, which could lead to threat surfaces for your environment.02:08:30Ultimately, these recommendations is something that you could feed into a system that you already have in your environment, whether it's directly influencing your, your workflows, and we'll, we'll see that later when Atusa does her presentation.02:08:48Influencing the the user workflows and secure access or your XDRs and firewalls and affecting the authentication sequences that you have there. If you also have ticketing ticketing tools or messaging platforms so your admins will be informed of it in the moment, then we could do those integrations as well.02:09:02Oh Fiscal identity intelligence allows you to do the six things which are captured on these icons that we have here around having visibility on your user inventories, having the ability to monitor both your human.02:09:22And non, your, your human, your non human accounts, your employee accounts, your contractor accounts, external users, all this, you will be able to see in one interface. We would be amissed to not highlight MFA because that's what Duo was initially known for so we have a special dashboard focusing specific.02:09:41On MFA.02:10:02And we do have a robust set of reporting and analytics that you could even export or send over to your scene system. During the demo, we'll also see from within CII how you could do a deep dive of a user or a session investigation and from there.02:10:03Send it to your, your team was doing the investigation or remediating it from the CIA interface itself depending on the integration type. This allows you to have a continuous posture and threat detection that you set up once, and then once the system is, is there.02:10:23You will be notified and it will help you maintain your identity security posture.02:10:42The checks that we have listed here are some of the more common ones that we have around posture and threat detection and during the demo later, we will highlight what the the bigger ticket item checks that we do have here to identify your security, security score.02:10:49Sure.02:11:08The Cisco identity intelligence engine runs on what's called an identity graph. And this image is meant to be quote unquote noisy because we want to point out here that data tends to be noisy. But with Cisco identity intelligence, once the user information.02:11:11Machine information, session information, inputs from your HR systems, your applications, and your platforms are all brought into the engine. We will see the connection on these elements and through a series of checks, highlight what things need cleaning up or what things.02:11:31Need to be sorted out based on criticality and we will link that to your notification systems.02:11:51And the identity graph is what makes these correlations possible and does a machine learning process in the back end to make all this determination. And to illustrate this, we actually will highlight two use cases.02:11:59And the 1st one is how CII aids in a continuous behavior assessment. So in this example here, we do have a persona Greg, and Greg typically is Greg is based in San Jose California and these are some identifiers which are attached to this particular.02:12:19Particular user.02:12:39And Greg is part of the executive team and accessing using his Mac Mac OS with this particular version, logging in to workday. Then one day, Greg was added to the DB admin group, something that he has never done before.02:12:40And then he started accessing an Oracle customer dB in the environment. So this is something which is different from Greg's usual day to day, and this is something that CII will surface for you to, to check if this is something that is.02:13:00Expected to have happened on this particular time for Greg or something that needs correction. If it is, then NO action needs to be done, maybe a couple of notes just to indicate that this was expected to happen at this particular time frame.02:13:20Or if you need to move Greg out of that DB admin group to revoke his access from the customer DB, that is something that you can do as well. In this particular integration from the Cisco identity Intelligence interface, there is a way to revoke the the user access, and that is something that you can do from that page.02:13:36Another example is still with Greg, who we find still has his old thinkpad attached to his account, where the last known location was in Mexico City and it was running a Windows seven machine.02:13:58Having this old information attached to Greg's account with a particular frame time frame of not having logged in for a while is something that CAI will surface as well for you to do a cleanup as necessary.02:14:14Likewise, it might also expose things like, let's say a year ago Greg has a send us trial account for a testing that he needed to do, which is really cool for being part of the exact team to do a trial version of an application.02:14:31But CIA will surface that up and then you could review if it's a trial account that still needs to be given access to things or you could revoke it much like what our animation did. Alright, so I will do a quick video demo of how we.02:14:48Would light up CIA in your environment.02:15:08For if you are just like starting with your duo CI journey, you're, you can light up your Cisco identity intelligence from within the duo admin panel, and I will click through the demo and fast forward it on the applicable sections, but the Cisco identity intelligence provisioning is under the more.02:15:12Feature section of your admin panel in Cisco identity intelligence, and then provision.02:15:32When you do this process, it will actually auto light up an integration for you for Cisco identity intelligence and this screen will be displayed. If you've worked with duo SSO application before or if not, John covered it earlier during his session too, there's a way for you to customize the application settings for it.02:15:38And you will do that by click clicking the edit SSO.02:15:58Configuration and you will see here as with any application you have an ability to rename it to a name which makes more sense for you. And every duo integration starts with you intentionally assigning the users which have access to the application.02:16:02And in this case, these are our permitted groups for Cisco identity intelligence. And, in 2 s it's gonna scroll down to go to how we could assign specific roles for your CII access.02:16:21Into and mapping it with a user group. And in this case, we would want users from the duo AD sync, users group and a group that we do have here to have admin rights. And then we want to provide help desk functionality also to a specific group.02:16:40Let me take a quick pause here. This is a typical application configuration with Duo, but when CIA is led up for your environment, it is practically treated as another duo application and the.02:17:01The rules, the policies that John discussed earlier, and if I kept the video playing, it will actually mention that now that it's a cisco a duo application, all the policy rules apply, and you could protect your access to your CII interface.02:17:16Using typical dual policy. I actually don't know how this video ends. Oh, it just ends with us saving it and that's what we'll do to complete lighting up CIA in your admin panel. Alright, let me.02:17:35Cool. Actually, before I go to best practices, the bulk of what I'm covering here would be showing you a semi live demo of an an environment which we call genie, which for the record and we'll update it on the.02:17:53The post webinar email as well, you as our customers and the public actually has access to. So I'll walk you through what the CIA interface looks like on a system which has all the integrations slid up, has a ton of customer data on it. If you wanted to learn.02:18:12More about how to navigate your own Cisco identity intelligence interface itself.02:18:32Alright, so once we light up the CIA integration in the admin panel, there will be a launch Cisco identity intelligence button that will appear, I believe in atus demo she will demonstrate that as well. And then once you are logged in with SSO or a configured source, you will be presented with this dash.02:18:38Forward of Cisco identity intelligence. Before I go through some of the widgets that we do have here and because of time considerations, I'm gonna highlight only a handful. One thing I want to call out in the dashboard is it starts with insights that we have around the posturing here, like this dropdown here.02:18:57And you will have I in the beginning when we were asking for folks roles and what their, what is top of mind for them, I saw that there were compliance considerations that people were interested, interested to learn more. And in CII, we do have those dashboards to highlight checks around posture.02:19:17Sure compliance and other related information.02:19:37Once you do have your CAI lit up, there's also this section which for our essentials customers, which actually I think were most people when we were doing the the initial Slido, there is a way for us to give you an ISA stands for identity security assessment. There.02:19:42There is a series subjects that we could run to assess your overall identity security health based on the information which you feed in.02:20:01CII. And once you light up your own CII tenant, this is something that you could surface for your organization regularly as well through this ISA reports dashboard. And let me go to the, the posture dashboard once more. And I want to, I mean the the users.02:20:10It's just, you know, it's like a.02:20:30A snapshot of your user population and their overall standing. But one thing that I wanted to highlight because this is key to how you get the most out of CIA is to review this widget called the identity posture score. So the identity posture.02:20:32The score is a fixed number that CIA computes in the background having run checks that we deem as critical to evaluate an organization's overall posture. And with this check, there are, as I mentioned, like there are a couple of checks that we run on the background, and I keep on.02:20:52I'm saying checks I I'll check articulate that better in a bit, but there are a series of checks that we do, much like I I was reviewing our documentation before this presentation, much like if we're talking securing something, we know that locking a door or locking a window are.02:21:12Critical things that you could do to make your your home more secure. I mean obviously the fancy cameras and the motion detectors are.02:21:32Things which would also help with that, but having the baseline of what makes your home and your organization secure are the things that we track in this identity posture score widget. We also consider if you have lit up critical checks that we recommend, how much information you.02:21:43Inputted to CII.02:22:03And overall just how those pieces come together and we give you we subtly nudge you to review them as you can see in this section here and we'll, we'll see the dynamic of the checks and investigations in a bit, but this will give you that like just that that one view on.02:22:05Where we would nudge you to improve your identity posture.02:22:25A couple of named widgets that we do have here. I also wanna highlight the user trust level and this will be covered on 2nd half of the, of the presentation. But based on the insights and the competition and the analysis that we do, a user component is assigned a.02:22:31Trust level and we do have a very descriptive information in how we determine the trust level for a particular user.02:22:51And this trust level is actually what drives that Cisco security workflows that we hinted at before, and you'll see that in action during a toosis presentation. You can see here we have this widgets. The question is in case NO one asked it, I'm gonna like say it. What if I want.02:23:00A new widget or a new dashboard which I don't.02:23:20I don't see here. There is there there there is an ability and because I have read only rights for this environment, there's an ability for you to create, create or request a widget by creating a specific save filter on your environment. So once you're in your.02:23:23Actual CAI setup with admin rights, feel free to, you know, to, to click around and and see what that looks like.02:23:43I know it will surface somewhere later. I can't remember what page it is, but there is also an ability for us, for, for you folks to tell us if there's a specific report or specific check. So maybe it's in the report and check dashboards. If there's a specific thing that you want to be included in CII, there's a way for you to make.02:23:51That request and the CAA dashboard and our product and engineering teams will review them.02:24:11And hopefully they'll, they'll make it to the CII moving CI interface moving forward. All right. Much like the dual admin panel as John presented, Cisco interfaces have this unified look and feel and on the left left panel here are the different components that you can use to deep dive on.02:24:18All the elements of Cisco identity intelligence. I will specifically highlight two the checks that I keep on keep on talking about and then the users page. So let me do that next. Similarly John presented some of the reports we do have in duo. Likewise, we do have can't reports so.02:24:38We have here in Cisco identity intelligence. Oh, and there's that request report button that I was mentioning if there if there is something that you need that you want us to review and to add to CII.02:24:58And similarly, there's a way for you to customize your setting access access settings for your CII tenant. Now let me, let me go to the checks, which is practically the the backbone of CII. These are the intelligence that.02:25:11Allows allows us to surface both posturing, compliance, and threat type objects. You will see it on all the CII interfaces, but there is a way for you to filter the information on something which to zoom in on your investigation or your analysis. There is all.02:25:29Also a way for you to, oh, it's it's it's somewhere else I'm gonna cover it later there, but I was just gonna say that there's also a way for you to write certain queries to filter the information further.02:25:49So for for the checks, these are the the kind of like the main categories of them as I mentioned, and let me just to show how the filters work. Let me highlight one around the the posture, the posture insights here, and these are the checks which analyze the data and surface certain posture.02:26:01Sure improvements that you can do for your environment.02:26:21And let me click on one specific check so I could show you what's in a check, what does it, what does it surface, how can I modify it? And a check would have obviously the introduction of what the check specifically is doing. Depending on the check, we might have those tiny snippets.02:26:24Videos to help you understand more how, you know, you could utilize this particular item. I I chose like a pretty.02:26:44Pretty common, pretty popular one around NO MFA configured. You will see the criticality of this check and we also do have a section on the recommended actions for that particular content. On this section of the screen, you also will see the frameworks that we are.02:26:53Meeting the standards for by doing the check in your environment and for those who where compliance is top of mind, this will be helpful in your analysis hopefully as well. Now, a check's job is to surface the user components which are failing.02:27:11In that particular check. And this big block here is the core of what those of what that looks like. We will cover it more during the the user's page, but for now, let me just open that in a new tab. But from that view, you will be able to go directly to the user.02:27:31The the user element, the user persona that was called out by that specific check. And then once you have that information for that user, you could start digging and this is actually prompt you to go to the to the user's page, which is what this is how it looks like for you to do the analysis on the.02:27:51Why that user failed that particular check.02:28:11I'll go back to the checks real quick to highlight that on each of the checks depending and it's depending on the check, you have ways to customize detection how you want it to surface certain things for your environment. So in this new MFA configured check, e.g., if let's say.02:28:14You are aware that there are your your new employees are onboarded from a one week timeframe and you anticipate that in that seven days they might not have MFA yet. You could add them in an ignore list here so they will not be.02:28:34Surface and highlighted and you prompted about it every time and so there's some customization that can be done on this particular check. You could also configure how you will be notified when a failure report for a particular user is sent, whether that's getting.02:28:50A flat message or an information on your S3 buckets or linking it to your to your workflows for the other tools that you're using. Some insights that we do have here, just like summarizing the.02:29:08The information on that check that you do have, and that's what checks are. I noted it in the report real quick. We do have, and I wanted to highlight this, we do have a predetermined set of checks that we do to surface the insights that.02:29:24Based from our research and experience and customer interactions, we deem would.02:29:44Paint the picture of your identity health. But if you strongly feel that there is a check that you want specifically for your organization, there is the request check button and we will allow, we will give you the opportunity to.02:29:50Describe what that check looks like and we'll, we'll review it for you. I will then move to the the user view, which we caught a caught a glimpse of earlier, same, same setup, you do have the the user's information here. You have a ability to filter it.02:30:08And let me pick this one user here, which has a ton of information from the multiple sources that we, we got it. We got it from some attributes here pull directly from the identity source.02:30:28This is the trust level that I was mentioning this user was deemed as a trusted trusted user and this green status would drive improved authentication workflows on applications like secure access which we'll see later. It also will give you insights on the activity for this particular.02:30:45Their user, and this is the detection and investigation user session investigation component of CIA because from that user view, you will have access to the things that they've been doing in your environment, the networks that were logging in from, devices, applications that we're logging in with. And if they are.02:31:05Failing any other check, you could see that from this view as well.02:31:25I don't know if you caught it, but when I was in the user's page, there are like four alto.helming hooks, and that might be the case if, you know, like this, this person exists on multiple identity sources. If you want to collate all the information for this particular.02:31:30Their real life person into one user identity.02:31:50From within CII there is a setting to link a user role in the database into other users to centralize analysis. Let me see. The other things I kind of like wanted to highlight here is the, the logs that that that we do have here with.02:31:53Which are very, very, very detailed and something that you could export to your scenes as well for for further analysis and the reports that you do have here are downloadable, integratable to your, to the systems that you do have.02:32:13Alright, that is the end of my demo. As I mentioned, the Genie environment and we'll, we'll I'll I'll do that on our on our closing closing slides here, but you have access to genie. You could poke around, and we also.02:32:31Eric introduced it earlier, we also have like a capture the flag exercise that.02:32:49You could use to get a guided approach on how to navigate the CII interface. All right, now let me wrap up my section which I know went longer than my time with the best practices that we do have as you start your CII journey, as we've highlighted.02:32:54CII is a posture management and threat detection utility which allows you to correlate identity and to highlight certain certain information about your user entities. We highly recommend starting with a clean slate.02:33:13When you are doing your analysis with your identity sources, and that's why we zoomed in on the identity posture score, because based from our experience and the wisdom we've acquired across talking to different customers, these preset checks allows you to baseline your identity posture.02:33:32And this gives you an opportunity to prioritize the cleanup that you need to do for your environment. Where to start, we have listed like these four key checks that we do have mainly around identifying if you have users which still, which still has identity information on your.02:33:51Courses but are never logged into, and those which don't have MFA configured. So these are some of the checks that we recommend you take a look at 1st.02:34:11The filter mechanism is something we highlighted because as you start your investigation, it is it is really useful if you want, if you zoom in in a particular either instance, user group or application group, and with that start building how you could do your cleanup.02:34:23Lastly, oh, this this was the other page that I missed. Once you do have the the feelings reported by the check, there is a way for you to download the list and feed it into other analysis mechanisms that you do have as you do your cleanup.02:34:43And now that we have lit up the initial configurations for your CIA, now we recommend going the the extra doing the extra steps of now looking at your proactive notifications and refining your internal policies to make sure it's integrated in your processes and continuous im.02:35:00Improvement. All right. Now I will intro 2nd part of the presentation, which is how insights from Cisco identity intelligence, our closest identity trust security gap working with other Cisco security solutions.02:35:20I I'll skip the but we already do a webinar and Duo is in the center and foundational among with other Cisco security solutions to deliver a best in class identity security which is enabled by default. That's why we covered the SCC lighting up.02:35:39Section earlier because we wanted to showcase that lighting, like when you light up this different components, you are secure out of the box.02:35:59And Cisco identity intelligence with that identity intelligence graph that we took a look at earlier allows bi directional API streaming, accepting information and sending it back to different Cisco security solutions.02:36:08I did mention that today we're gonna focus on secure access, but what you see in this diagram here is something that CII is able to drive for your ecosystem. In the next session, which I will pass to Atusa in maybe 30 s, we will see how the.02:36:27User trust level actually drives this workflow.02:36:47And allows you to design your Cisco secure access workflows in a way which is beneficial for your organization. And with that, I will pass the screen share to my teammate Atusa to walk us through how CIA can work.02:36:51With Cisco secure access. Thank you so much, Sheila. Hi everyone, before we get started, I'm gonna do a quick introduction. My name is Atusa and I'm based in Vancouver, Canada. I've been with Cisco for about four years now and I was previously.02:37:08Part of the umbrella escalation team and now.02:37:28I'm part of the customer success supporting the umbrella and secure access teams. All right, let's get started. With hybrid work, users are connecting from everywhere, whether they are in the office, at home or under road using both managed and unmanaged devices. And at the same time, the app.02:37:31Applications and resources they need are spread across SaaS, the internet, the public cloud, and private data centers.02:37:51This is where Duo and secure access work better together. Duo verifies the user's identity and device trust before access is granted, and secure access then applies the appropriate security controls based on the user's identity, device posture, and the resources they're trying.02:37:59To access, whether that's the internet, SaaS applications or private applications. The goal here is to provide a simple secure access experience for users while giving IT and security teams consistent visibility and control across the environment.02:38:19Many organizations today are juggling a fragmented identity landscape managing legacy on premises directories like Active Directory or open LDAP alongside modern cloud based providers like Okta, Google or Microsoft Intra ID.02:38:43Trying to connect each of these sources directly into your security stack creates unnecessary complexity and it leads to inconsistent policy enforcement. So this is where Cisco Duo acts as a centralized identity layer. By bringing together authentic.02:39:03MFA and device trust, it provides a unified identity context.02:39:23And secure access then uses that identity and trust intelligence to enforce consistent granular policy across your users, devices, applications regardless of where they are working.02:39:28Alright, now let's look under the hood at how Cisco Duo and Secure Access deliver flexible secure connectivity for every user and access type. On the left side of the architecture, you can see how we support.02:39:47Different access needs from cloud delivered VPN as a service for remote access to a modern zero trust model that evaluates identity, device posture and context before granting application access.02:40:04By integrating with existing identity providers like Google, Okta Microsoft intra ID, Duo adds a critical layer of identity assurance to every session. For contractors or even 3rd party users, secure.02:40:20Access also offers a clientless zero trust experience. It gives you secure direct access to private applications through a browser without needing a full VPN client.02:40:39So whether you are maintaining remote access or transitioning to toward a full zero trust architecture, this unified platform gives you the flexibility to secure your users, applications and internet access from single cloud delivered service.02:40:53Risk.02:41:12Now that we've covered this strategy, let's see it in action. In this demo, we will show how secure access and Duo identity intelligence work together to make access decisions based on user trust. So when a user connects, secure access establishes the session one.02:41:17While continuously receiving identity and trust information from providers such as Duo, Okta or Microsoft.02:41:37And as you will see, trust inspection continues in the background. So e.g., if a user's trust level changes, secure access can respond accordingly. Now let's look at what happens when a user's trust level changes after the connection has already.02:41:45Already been established. E.g., the user may sign in from an unusual location, trigger a risky authentication event or exhibit behavior that changes their trust level. CII can detect that change and it can also notify secure access and secure.02:42:05Your access can then reevaluate the user's access based on the updated trust information.02:42:25And this will help you maintain a strong security posture throughout the session. And once secure access receives that signal from CII, it doesn't wait for an admin to intervene. It automatically takes action based on your predefined policy.02:42:32So in this example, the existing connection is revoked to protect your environment from the potential risk. And this is where the integration becomes very powerful because we are NO longer making access decisions only at the time of logging. We are continuously evaluating trust throughout.02:42:52Decision and dynamically adjusting access in your environment.02:43:12All right. Now I'll walk you through provisioning and integrating CII with Cisco Secure Access. When our customers claim a new secure access subscription, they are entitled to a restricted license of Cisco Duo, which includes CII, and this guide is.02:43:18Is specifically for setting up a new dual and CII tenant using this license.02:43:38I'm gonna start the demo now so we can take a closer look. So 1st we begin in security cloud control dashboard.02:43:44To claim our subscription, we, we click on platform management on the left, and then we click on subscriptions. We click claim subscription. Here we need to add our subscription claim code.02:44:02And then we hit next. Then you will be prompt to create a new instance of Cisco Secure Access or if you would like to use an existing one. In this demo, we would like to create a new instance of Cisco Secure Access. So we just select create new instance.02:44:22And then we click next. Here you can review your subscription. You can see your subscription ID, the organization region, and you can see Cisco secure access listed under your product list. So we click on claim.02:44:42And then once you claim the subscription, this will associate the subscription details, including the subscription ID and the product licenses with your security cloud control dashboard. So we click on claim again.02:44:59So this will take a moment for secure access to be activated in your environment. The page will refresh itself or you can manually refresh the page. And once the page refreshes, you can see secure access listed under products in the left navigation bar.02:45:15And now we would like to activate Cisco Duo and identity intelligence. And to do that, we need to click on action required on the right side of the screen. And here you'll be prompt to either create a new account or connect your.02:45:37For Cisco Duo and identity intelligence to an existing account. And in this demo we would like to create a new account. So we select create new account.02:45:56And then we click on activate. On the right side of the page, we can see a message that it says the activation is in progress, and the administrator who initiated the activation process will also be getting an email. So.02:46:09So on this email they need to click on complete registration.02:46:29And once they click on it, they will be redirected to this dual webpage. So on this dual webpage, we need to create our 1st dual admin account because we want to use this admin account to log into our dual tenant. So we just follow the admin setup wizard.02:46:36Just to create a password, add a pass key and set up our two FA, and once these are completed, we will be using the account to sign into our.02:46:57Admin portal. All right. Now let's go to monitoring and we can see Cisco identity intelligence. Now we would like to connect our Cisco identity intelligence to our dual portal. So we need to click on connect to cisco.02:47:15Identity intelligence.02:47:34And this process like takes around 20 to 30 s to get completed. All right. Before we go to the user section, on the top right of the screen we can see an option to launch Cisco identity intelligence. So after we connect.02:47:39Said Cisco dual with CII, we can now spin up the CII dashboard. So before going doing that, we go to the users and user page and now we would like to add a new user.02:47:59So we click on add user, we just add a username, display name, email address followed by 1st name and last name. In this demo we are using Keith Clark as an example. So.02:48:13Do we just add the user?02:48:33And so we basically wanna use this user to log into our CII dashboard. We need to make sure that the device enrollment is completed. Now it shows that the device is enrolled. And if we scroll down.02:48:35Let's check the user groups. So here we need to make sure the user keith Clark is added to one of the CII groups. And here we are assigning the user to CII admins group, and then let's save changes.02:48:54Let's go back to the users page. So right now we have Kit Clark and then we added this user to CII admins group. We would like to add a second user, so I'm just gonna give it some time for 2nd user to show up here. What we need to do pretty much the same steps for adding the new user.02:49:12And assigning them to one of the CII groups. Perfect. So we have both users listed here. Now let's go back to monitoring Cisco identity intelligence.02:49:32And now we would like to launch our Cisco identity intelligence and here we would be using the user that we just created to log into the CII portal. In this case.02:49:55As we are using kit's email address.02:50:15Perfect. So the CIA dashboard is now visible and it will also provide steps about like for learning about the product and getting started.02:50:27Now let's go back to our security cloud control dashboard. Now we can see identity intelligence has been added to the left navigation bar. So let's click on identity intelligence. And then let's click on integrations.02:50:43And here we can see the integration between Duo and CII is visible here. Now let's click on add integration on top right of the screen. And here.02:51:10On this page we can see the list of supported providers. So it's very important to note that any integrations you add to CII along with your identity provider directly benefit the user score.02:51:25This is because CII pulls together all these disparate identity and data points to generate a comprehensive score. And to get the most out of CII, we strongly recommend that you add as many integrations as possible as they are critical for creating accurate and meaningful user score.02:51:41All right, let's go back to secure access and then let's go to connect users groups and endpoint devices. So right now we don't have any users listed under the user list.02:52:19Previously we confirmed that the IT admin user key was created and had access to the CII dashboard. We also confirmed that CII was integrated with duo, meaning that the identity related activity of users added to Duo will automatically be reviewed by CII.02:52:36And corresponding user trust levels will be assigned to those users based on those actions.02:52:56Now we would like to integrate our identity provider in our case dual directory with Cisco Secure Access. To do that, we need to click on configuration management on top right of the screen.02:53:02And then we click on integrate directories. We select IDPs because we would like to provision our users through one of our supported IDP services. And we just give it a name and we choose the identity provider as duo.02:53:20And then we hit next. We generate a token and now we have our token generated under provisioning URL. The instructions for the dual directory integration with secure access is included in our documentation, but once this integrate.02:53:37Patient is completed.02:53:57If we go back to the users page, we can see that both users are now synced from our dual portal to secure access. And we can also see the user trust levels. So let's click on one of the users.02:53:59If we expand the trust level, we can see this message. It says unable to retrieve trust level information. Please refresh the page to try again. So this is completely normal and expected because it can take up to 24 h after the initial configuration and integration.02:54:17For these trust levels to be calculated and updated.02:54:37Alright, now let's go to the next one. So before we move on, the steps in this demo are very similar to what we just covered, so.02:54:48So in the previous demo we created new Duo and CII tenants. Now we are using existing Duo and CII tenants instead. So I'll just skip through the repeated steps and just highlight the differences here.02:55:03Now we start in security cloud control dashboard and then we click on platform management and let's take a look into the administrator access page. Here we can see the user Shannon Willington is listed as part of the administrators.02:55:23Now let's go to admin groups, all product administrator, and we can see this user is part of their all product administrator, and let's take a note of the email address. Now let's go back to our dual portal.02:55:47Let's go to users and administrators page. And here we can see the same email address and the same user is also added to our admin portal and the user is having an owner role. Now let's go back to our security cloud control.02:56:06If you click on add users, we can see the user is all already added to all product administrator. Now to claim the subscription.02:56:26We click on platform management and subscriptions claim subscription. We add the subscription claim code and hit next. So here again in this demo we would like to create a new instance of Cisco Secure Access, so we just create a new instance and hit next.02:56:41And then we claim the subscription. So here's the difference. Now we would like to activate Cisco Duo and identity intelligence, but we would like to use an existing one. So to activate the account.02:57:05We click on action required on the right side of the screen. And here instead of creating a new account, we click on connect an existing account, and we can see the initial administrator. In this case we have Shannon Willington.02:57:25So we just select the user and activate it and going back to the dual portal, we can see the user is matched, and then we activate. All right, so we can see a message on the right showing that the activation is in.02:57:43Progress and the administrator will also be getting an email for connecting their existing duo account to their security cloud control dashboard.02:58:03So they need to click on connect accounts and then they will be redirected to their dual portal. They add the credentials, and once they log in, they can see a message on top right of the screen to connect.02:58:15Next Duo to security cloud control.02:58:35And once you click on it, you need to authorize linking these two accounts. So we just authorize this, and then the administrator will be getting an email, email confirmation that these two.02:58:38The accounts are now linked and connected.02:58:58Alright, so the remaining steps are pretty much the same as what we just covered, so I'll just skip ahead to the next topic and we will be sharing the deck and the recording after the session, so you will be able to review it later if you would like.02:59:03Okay, so CIOI has already been provisioned and integrated with Cisco Secure Access. Now we will take a look at what it can do in the product. I'm gonna start the video so we can take a closer look.02:59:24So we are back in our secure access dashboard. Let's go to connect users, groups, and endpoint devices. Here you can see three users and then you can see the user's trust levels.02:59:44Let's click on Kit Clark, and if we expand the trust level, we can see the trust level of users, and then let's go to our policy page by navigating to secure access policy.03:00:06So we have a private access rule, under the name rule name eyes access, basically with this private access rule, we wanna allow all users getting access to our ICE server.03:00:24Now let's go to rule defaults and global settings. Under the rule defaults, we can see user Charles profile.03:00:49This feature is globally enabled. So what is this feature? This feature allows you to give, like to control users access to their private resources by checking their user trust levels. So let's check the system provided rule default configurations. So if we click on.03:00:56System provided rule default.03:01:16Here we can see different trust levels and their corresponding authentication settings. So e.g., if a user's trust level is trusted, we allow their access to the private resource. Or if their trust level is changed to untrusted, we will block their access to the.03:01:24Private resource or e.g. if it's changed to neutral, we, we will have the user reauthenticate every three days.03:01:43And you can see the default settings here. Alright, now let's go back to monitor activity search. Let's check the latest logs for Keith Clarge.03:01:54While the user was having ZTNA client base. And here we can see the access to the ice server was allowed because the user trust level was trusted. Now let's go back to the user page and here we can see the user's trust level has been dropped from trust.03:02:10Said to untrusted.03:02:30Now let's go back to the activity search, and let's check the latest logs. So here we can see the access to the iserver was blocked, and the block reason is saying private access, user transprofile evaluate.03:02:33Patient resulted in blood risk level untrusted.03:02:53Now let's go back to the users page. If we click on kit Clark user, let's expand their trust level. So here, once you expand the trust level, you can see the failing checks, and it's gonna give you a very high level overview.03:03:02You about why the user trust level has been dropped. In this case, it was due to MFA flawed, a bypasscode was being used or accessed from denied countries. You can see the whole list here.03:03:22And there are scenarios where you want to bypass on trusted level, e.g., for executives. So you can do, do that by clicking on bypass on trusted level and you can bypass the duration for a maximum of seven days. So in this demo we want to bypass duration for one day.03:03:38So we just check, I understand and wish to proceed and then we click on bypass.03:03:58Now let's try getting access to the iserver from Kit Clark's device. So as soon as the user want to get access to the iserver, they will be getting a prompt to verify themselves. So they will be redirected to their IDP and they need to add their credential.03:04:08Calls.03:04:28And here we can see their ZTNA is enrolled now. Now let's go back to reporting just to confirm what happened. All right.03:04:33Checking the latest logs, we can confirm that after we bypassed untrusted level for this user, the user could get access to the ice server. And let's check a log before that. We can see the access was blocked.03:04:50And the block reason is showing user authentication required. Now let's go back to the user list and then if we click on kit Clark and expand trust level, we can cancel bypass anytime.03:05:08Alright, so today secure access uses a global trust profile that applies the same controls to every user, which which we just reviewed in the previous demo. As part of our future enhancement.03:05:34As we are introducing the ability to create multiple granular user trust profiles and these allows administrators to tailor authentication and security controls to the specific risk level of the user. E.g., you can offer a seamless streamlined experience for your.03:05:49Tested users while automatically enforcing stricter requirements such as reauthentication, advanced IPS profiles or geolocation fencing for those flagged as higher risk. It's all about giving your organization the flexibility to align security friction.03:06:10Directly with user trust.03:06:30And to bring this home, let's focus on three key takeaways. 1st leverage CII for visibility. You can secure what you can see and CII provides the ITDR and ISPM insights needed to better understand your identity landscape, and.03:06:34Second baseline and segment your environment. Intelligence is only as valuable as the context behind it. So by baselining your environment, you can turn raw data into a more meaningful and actionable security strategy. And 3rd extend.03:06:54The Duo across your Cisco apps. This is where it all comes together by combining Duo's authentication capabilities with insights from CII, you can drive a more consistent unified security workflow across your Cisco ecosystem.03:07:14Alright, now I'm gonna hand it over to Sheila to wrap up the module. Awesome. Thank you Atusa and thank you for walking us through as well with literally clicking from secure access and creating a user and lighting up the tenant.03:07:33Very useful to wrap up the series overall. So we started with folks who might have just received their subscriptions for Cisco duo, for secure access and other Cisco security products and Atusa gave that demonstration and how you could get it to the last demo she did with.03:07:52Your insights from CAI drive secure access workflows.03:08:11Alright, so let's spend a couple of minutes here to highlight a couple of questions which our team actually inputted and let me just read it out loud and then we're gonna move it to the active section. The 1st thing is what, can I link integrations create.03:08:16Reports, create dashboards which are not part of the defaults in CIAI as I have shared. There is an opportunity for our customers to give recommendations on reports.03:08:36Or checks that is useful for this specific use case, click that either request report or request check on the upper right side of your CII dashboard and give as much context as you can and we will review it and see how it could be integrated officially with CII.03:08:50And, let me take another one around let me see here. Oh, this is a, this is actually a good a good thing to highlight. What is the frequency that Cisco secure access obtains user trust level information?03:09:10From CIA, and I'll actually expand this this question too, because I want to answer it holistically in terms of how, how long CIA processes data. So when you 1st light up your CIA integration and then when you connect your.03:09:291st identity source, e.g., and any other identity source context sources that you do have, it actually takes like a full 24 to four to 8 h for us to completely collect that information, analyze that data.03:09:49Have that identity graph kick in and make the the relationships work. In that time frame of 24 h actually rings through as well with once the, let's say the the trust level that CAI was able to highlight based on an analysis.03:10:09How like what is the frequency of that information to be fed, to be fed into your secure access workflows and driving it. And for for that, yeah, sse pulls data from CIA every 24 h again just like in in general that's a.03:10:25Save time frame to, to consider whenever we see changes on your identity identity ecosystem feeding into CIA for analysis. So 24 h is, you know, like a, a timeframe that is good to to take note of and it's mainly driven.03:10:42By all the correlation that needs to be done with the data. While the user trust level updates occur at a minimum interval of 1 h, the the computation cycles take time and.03:11:02So, knowing, knowing that it would be recommended or beneficial to, to know how to integrate that time frame with your, with your processes as you do your analysis and review. Alright, that's that. And then.03:11:14The Cisco identity intelligence CIA require a dual license? Has has has shown us how to light that up, but the short answer is your CIA license comes with your, with your dual license. And if, if you only need CAI.03:11:34To generate the the trust scores and use those trust scores within secure access then it's.03:11:54It's linked with your secure access entitlement and in terms of like lighting up the the CAI interface, it's tied to the dual license which you currently have. And at least the the way we initially were looking at this question was from the the secure access side of things.03:11:59Admittedly as far as far as I am aware, the, the customers that we do have would have received CII as tied to their dual integration, which means it's already included in the dual licensing.03:12:21That you do have. Alright, I believe that's the FAQs that we wanted to highlight for, for this module. I will give maybe like two or three more minutes if there is any other question that.03:12:33Anyone else has for the rest from for the sections that we've covered today and again appreciate y'all hanging out with us in this very long period. If there is more question that you do have, feel free to type them in in Slido. It will not have time to answer it today, we'll follow up.03:12:52For you.03:13:12And I will actually actually let let let me do this now. And again, if you have more questions, just like keep them coming but to give us more time back, I'll start with a series wrap up that I conveniently am leading and let me get the screen share from Atusa. Thank you so much atosa.03:13:13For wrapping us up with that full workflow from SCC to duo, just the AI to secure access. Alright, I'll take five more minutes just to wrap up everything that was covered today. You hang out with us for.03:13:33Three and a half hours covering three modules at least an hour long each around how to get started with your duo, Cisco Duo IAM journey. So we started with sharing what the duo core features are and how you could get started with.03:13:53With provisioning it through security cloud control and then led by Shruti and Derek and then we we navigated how to walk through your dual admin panel care of John and Adam handling Q and A and then Atusa and myself.03:14:09With highest content shared how overall security is possible with Cisco Duo working with our other security solutions. All of the people that you've met today from our content creators to our presenters, to our panelists.03:14:27Are part, are all Cisco secu customer success specialists either providing an enhanced support or a signature support and we will take some time with highlighting what the signature services that we provide are and at least in the dual world, we call it.03:14:45Dual care.03:15:05And this gives you access to prioritize technical support, a VIP support line that is someone asked this in fact different from what you do have in your dual admin panel. If you do have a dual care team which which you will, if you have dual care, where you have a technical and strategic security advisors, there.03:15:06There's a special phone number that gets you to the top of the queue.03:15:26If you want to use phone for reaching out for support issues that you do have. But with the dual care team, we are actually on top of your environment, with engagement from start to end and you do have a personal email, so you could just directly ask us too.03:15:30So something that we introduced in the past quarter is for users, sorry, for customers to self initiate a free trial to a higher duo edition. So if you do have essentials now and wanted to see what's up with advantage or premier from within your billing.03:15:48Page, there is a way to light up a free trial and.03:16:08Once the the trial version is over, it's going to be a 30 day trial and once the trial period is over, it will just revert to your previous previous paid edition and you do have two free trials for a fiscal year.03:16:14And just a couple of call outs here if you do have parent accounts. Derek shared this in the beginning of the session as well. It's something that we are trying out for the 1st time with the dual webinars that we're leading, but capture the flag is hands on interactive exercise, which you'll, you'll.03:16:29Will answer a couple of challenges, get flags, get scored, there's a leaderboard and everything, and this QR code, if you scan it will lead you to that event.03:16:49Once we all exit out of this webinar, there's also going to be a link on the survey that we request you to fill out, linking you to capture the flag. If you have not done one and and the possibility that you would have done one is high if you are working with other Cisco products, capture the.03:16:59Flag is a tool that we do have mainly on our solutions engineering organization, but it's something that we're planning to adopt on the CSS space as well. But it will ask you to create a new a new Cisco login and you could use your personal email for it and this is what that page would look like.03:17:19Lastly, I will quote John. Help is at your fingertips in the dual admin panel, if you click the the help icon there, it will lead you to these hyperlinks on our resources page, community page, and information on our recorded webinar.03:17:40There's many different forms that we do every year.03:17:58And then lastly, and this is what we would actually end with, we would really appreciate if you could give us any and every feedback for, for the series today. Slido is one way to do it. When you exit out of the webinar, there's going to be a.03:18:03A survey there as well and once we send the follow up emails to send the recordings and other resources, you will also get the similar survey. You only need to fill up one, but you would deeply appreciate any feedback that you could give us to help make the sessions better.03:18:23I will leave this screen up for maybe like five more minutes and we're gonna hang out here. But again from myself to our entire team, thank you so much for staying with us today and hopefully this introductory course.03:18:40On how to get started with your dual journey was helpful. If there's anything else that we could help clarify for you, please reach out and thank you for spending your Tuesday morning and afternoon with us. Have a good week ahead.03:19:00