Identity Protection with Cisco Duo

Oh, everyone. Good morning, good afternoon, good evening. You are here at the Cisco Duo Security Expert insight series and today we're.00:00Gonna be covering identity protection with Cisco Duo.00:20My name is Sheilavida and I'm a customer success specialist, one of your hosts for the series today. And for the 1st 15 min of the series, we are going to be having an introduction and just to see house rules and how the next 4 h with us are gonna go.00:25Before we get started, because we ran into a couple of these the last time we had the series, we'd like to do a very quick tech check. So if you folks could hear my voice and see my screen, if you could please give us a thumbs up.00:43To confirm that you are ready to receive what we're gonna share today. If you are running into any issues for any reason, utilize the chat window and our teammates in the backend.01:00Will be able to help you. The other thing that I wanted us to quickly confirm is on the right side of your screen in your Webex client, whether you're using it online or the client, you should have Slido launched there. So if you could, let's use a different emoji if you.01:20Could give me a heart to confirm that Slido is launched correctly on the right side of Webex.01:40Because that will be critical to a couple of our interaction items today. All right, I see a lot of likes and the hearts. We hope we keep those as we go through the sessions. Now let's let's get started with our content.01:47In this section, as I mentioned, I will be covering a quick overview of what the series is, what modules we're gonna be covering. I will introduce the fabulous team behind everything you're gonna be seeing today, and we will chat a little bit about the Slido dynamic that we're gonna be using, and then I'll give a quick intro.02:04Of why we chose the series of topics for today and then we'll go on from there.02:24The expert insight series is a series of webinars that is it's not just duo, it's actually among all the Cisco products as well. The key differentiator of an expert insight series from the other webinars that we do have.02:31Is it tends to be interactive sessions, so we highly encourage everyone to participate and the other presenters our experts on the the technology that we are presenting, and we're discussing content around foundational elements of different Cisco architectures and products. This is the Cisco do.02:47Duo presentations, so we are going to be focusing on Cisco duo content. During each of the modules, we go in depth on the feature showcases and then we highlight real world use cases.03:08And as I mentioned, that way Slido is very important because we are receiving all your questions and your feedback through Slido. This is our 3rd run of the Cisco dual Expert insights series. We've had two of them in the past linked here and all session recordings are in community.cisco.com.03:19I also added links on the other Cisco Duo upcoming and on demand webinar events outside of an expert insight series. And we also added a link on the future Cisco Expert insights series for the other Cisco products.03:41Today we are going to be covering three different modules, all around the concept of identity protection that Cisco dual provides, which arguably is most of the things that we do. But for this specific series, we are focusing on things around how to onboard.03:57Users in Cisco duo. They're, thereby expanding your protection with it.04:16Then 2nd module will cover how you could utilize features of the dual directory to secure, streamline, and make your authentication more seamless. And then lastly, we are going to be doing a deep dive on the Cisco identity intelligence solution.04:21We are going to be together for four long happy hopefully productive hours. I did mention that we have three modules and it's going to be a series of presentations and demos for each of the module. Slido, which I'll discuss a dynamic later in my presentation will be used to cap.04:38Capture both your questions and for some polls that we're gonna be running.04:56Again I I would like to highlight that for all your questions, please utilize Slido so we could analyze them later for for improvements of our processes. We are going to be together from eleven Eastern until three eastern. I'm doing.05:01Doing my intro right now for 15 min and then we have each module allocated 1 h each. During that hour, that's when we'll do our presentations, our interactions, and then we have a dedicated Q and A at the end. That being said, you could ask your question via Slido at any point during.05:21That hour and our panelists will be answering them via via chat. During the the Q and A, feel free to, you know, like ask a question quote unquote live. It's still gonna be around Slido, but we are going to be reading out your questions as they come during that Q and A.05:41And then highlight some of the questions which were raised during the rest of the presentation. We will have a quick 10 min break in between modules because 4 h of 4 h could be daunting, so we will introduce 10 min breaks.05:59In between. This is the fabulous team which are behind everything that you're going to be receiving today. I am one of your hosts and Derek will close this off later. We are hosting the entire series.06:16We have presenters that you'll meet through each of the modules Rich, Sam, and Erin on the back end, the people who created the content and will be answering your questions or panelists, Namita, Baha, Aaron Wolf, Wes, Adam, and Jay.06:32The project coordinators for this are listed below, so it's certainly myself, Amika Randy and Heather. All right, and now this is the short bit around the dynamic of the Slido. As I've mentioned, Slido will be what we will use to gather your questions. So.06:48Please type your questions on the Slido screen. If you put them on the chat, we're just gonna move it to Slido so let's, you know, save the clicks and just type it in Slido, please. And then we will run a couple of polls to help us understand your setup and to get to know you more.07:06And how about we put that to the chest? And let's get started with the 1st poll for us to get to know our audience. Right, we would like to know what is your role in your organization?07:22So let's see, who we are speaking to today right we have.07:40Couple of network engineers, system specialists, network administrators, right, it looks like it's a good distribution of different roles.07:56Both on the design, design aspect of it, the implementation aspect of it, the decision makers, we hope that, you know, we will be able to cater to what's required of your role in terms of the decisions that, you know, you're making or things you're thinking about with a Cisco dual product and your.08:16The Overall security decisions and architectures, close cyber security engineers, enterprise architects. All right, how about we move to the next question and we'd like to get to know.08:35What dual editions you currently have? A number whenever we describe a feature, we're gonna call out what specific version of Duo that applies to. And we'd like to know the distribution of folks who were here, like in terms of what dual edition you you do.08:53You have.09:13Alright, we have a number of Duo premier customers. Yes, that's the one which has the the most like well technically everything, all features that we do have, we have essentials, advantage.09:20We we put the duo free there. I know that the invite was sent to, you know, to, to all our customers. So that means the paid versions, but you know if you do have a dual free on your lab, that's why we added that option there. Alright, looks like we have a lot of dual premium essentials, so we'll.09:34They mentioned when we are presenting a feature as needed, we will highlight what dual feature it's available in.09:54Alright, let's move on to the 3rd question. Let us know what do you want to take away from the series. We will try to make sure that that is supported. Obviously we, you know, we we planned for the content that we're gonna be delivering, but we wanted to understand.10:01And.10:21Outside of this session, how we could further support your Cisco dual journey. Great, new features that you might have missed. Okay.10:22Oh. All right, learn more about Duo directory. We have a dedicated module for that, Knowledge to maximize use. Yes, every.10:42Every module we have a bring it home best practices summary that our presenters will be sharing, a lot of call outs around the the new features lets we we will cover a couple of them during the presentation. And again, if there are things that you want to get to know more.10:58Put them in the slido Q and A and we will address them for you. Let's give this maybe like 30 more seconds for folks to put their thoughts in. And again, outside of us stopping this poll, feel free to send those our way through Slido and we will.11:17See what we can do with the information. Alright, I think I will move to the other parts of our content so we could get started with the actual content. As I've mentioned today, the series is focusing on functional.11:37Qualities around identity protection with Cisco duo.11:57And I will start with this diagram here which summarizes what Duo is right now. So Duo is a security 1st identity and access management. We are known and loved for our multi factor authentication MFA, but throughout the years we have expand expanded.12:00Our feature sets to accommodate every aspect of protecting your identity and access management space.12:20I already mentioned that MFAs are bread and butter. We also have solution sets around device trust, true SSO experience, and what that means is both passw passwordless SSO or like desktop SSO and some verbiages. We do have a passwordless solution and we have a set of.12:28The features around identifying and ultimately proactively addressing risks and.12:48Giving you authentication options for that. In the past year, we also introduced Duo directory and we'll cover a lot of those items today and all of these things allows you to protect your user identities, user authentications and provide identity automation.12:57On today's series, we are going to be focusing on the aspects of Cisco around the identity protection space. So things like the the duo directory, how could you expand your protection? What are the onboarding methods that you could utilize? We will walk through the the enrollment policy.13:17Is how that experience is going to be for your end users. And there were a number of comments around the new features. We are going to be talking about the dual identity verification feature as well. At least as an overview of what that is and how it fits with the workflow. And that's going to be module one.13:36Module two is duo directory. We will be, we will be focusing on key aspects of it around provisioning and managing your users and then we will end it with giving you practical advice on how to go completely passwordless if that's the direction that your company is heading.13:55And then lastly, we will focus on Cisco identity intelligence to give you total visibility and we will talk a little bit around something we introduced in the past two weeks, which is Active Directory Defense as well to get that conversation started as you.14:14Consider it for your organization. As part of each of the module, we are going to be having demos, and this is what our presenters will be showing us today during that part of the presentation.14:34All right. And with that, I'm right on time, which is a miracle in itself. I will pass it to Rich to start with our 1st module around expanding your duo protection. Thank you so much. Thank you, Sheila.14:50You should be able to see my screen now. Yes, we can Rich. Awesome. All right, Hello everybody and welcome to module one. My name is Rich as Sheila mentioned, and I'm joined with Namita and Adam, and together we're gonna take you through.15:08Expanding your user protection with duo. So I'm gonna cover a lot today and I want you guys to take advantage of the Q and A cause I'm sure I'm gonna uncover a lot of questions that you're going to have. I'm gonna cover as much as possible in the amount of time I have.15:26But inevitably can't cover everything, so please use the Q and A alright and to get started, let's get a couple more poll questions up here. So the 1st question we wanna ask is, what percentage of your users are currently protected by Duo?15:44So this is something that we're gonna be talking in depth about strategies for bringing users into duo. Looks like a good amount of you have a lot of adoption already. That's great.16:03Oh, ok, so pretty high. Hopefully I can share with you some maybe strategies to change things up or do things differently with identity verification for those of you who have already got a lot of users inside of Duo, but some of you who maybe have a few less, you might learn a couple things about bringing those users in as well.16:22Let's let's take a look at the next poll question here. How do you currently enroll your users in duo? So again, we're gonna talk a lot about bringing users into Duo in this module. I'm interested to see how are you guys actively doing this right now?16:39Okay Sync with identity Source is the big winner here, which is great because that's the preferred method for me personally, inline enrollment, ok?16:59So a decent mix, NO API love today out there, but that's alright. Identity source is a great, is the great choice. Cool. All right, let's let's move on to the final poll question.17:21So we're gonna touch on identity verification. If you're not exactly sure what this means right now, that's ok. I'm gonna talk about it in a moment, but we are interested to see, you know, your interest level in identity verification in the org. Do you believe that there's more vetting that needs to be done?17:39And if you're not sure, don't worry, you'll get a better idea as I move through the slides today good deal. Awesome. Lot of interest. That's what we like to see.18:02I don't know if everybody's just trying to be nice to me and say they're interested or if we're all actually interested either way, I'm here for it. So glad to see there's a lot of interest.18:32Alright, so let's, let's switch back over to the slides. Like I mentioned, there's a ton that I want to cover today in this module, we're gonna 1st take a look at the user enrollment states, to give you an idea of, you know, where you start and where you're trying to go. And then we're gonna cover the methods for user sync. A lot of you.18:41This might be review in some situations, but you also might learn of some ways that you can bring users in that you didn't know about, so.19:01We'll go over all the different methods in that section. We'll talk about the dual enrollment policies and how they come into play, give you some pro tips and things to avoid when working through enrollment. And then we'll actually take a look at an end user enrollment. So if there's a few of you out there that haven't seen this just yet, you'll get an idea of what it.19:08Looks like and maybe some of you guys who are doing it with enrollment links, you can see the enrollment portal and get a fresh perspective. And then last, like I mentioned, we'll talk about.19:27Duo identity verification. Alright, so let's hop right into it and talk about user enrollment states, and this is important to understand because this is where, you know, we're trying to work towards. We're trying to work towards that fully enrolled user, which is.19:36A user who has a username in Duo and at least one two FA device. That's the goal. And, a lot of you will be starting from zero. So starting from a user who is not enrolled, Duo doesn't know about this person in working up to that fully enrolled user. We also have to be aware.19:54Of the partially enrolled user, which is a user who exists in Duo with a username only.20:14And this is where it will look at some policy and how things can get a little tricky navigating those partially enrolled users when they're trying to get into your apps and where your org will decide the path that you want those users to to take. So keep these states in mind. I'll keep revisiting these topics as I'm discussing the other topics as well.20:19But just remember, we're trying to go from not enrolled to fully enrolled, which means username and at least one to a fake device inside of duo. Okay, so let's take a look at some methods for user synchronization.20:39And when we say synchronization, of course, we mean getting users added into duo. We want users and two FA devices inside of duo. And we have a number of ways to get you there. I'm gonna spend a lot of time talking about directory sync.20:55A lot of you, that's the main, the method you're using at the moment. That's the preferred method for myself. But we'll also show you some other methods that obviously a lot of you aren't using like admin API and we'll talk about user self enrollment and when inline self enrollment might need to be something that you employ at your.21:11And then we'll also talk about.21:32Some of the manual enrollment methods, so ways that admins can add users individually or you could have admins do a CSV import. Alright, so kicking it off with the automated methods with directory sync and admin API methods.21:34So directory sync, as mentioned, this is my preferred deployment method or synchronization method. This is the one that keeps that user life cycle management in your source directory and just pulls that from source directory into duo.21:55I like to keep people out of user management inside of the admin panel wherever possible, and this tool lets us do that. So the idea here is we tie into one of your source directories, whether it be tra, Okta, Google or on prem AD, we let you manage the users, you know, in that directory, and then we're just gonna copy over.22:11The users that we need to into duo, and just keep it a nice clean connection between the two prevent you from having to do a lot of manual work outside of when you get it up and running.22:31I also mentioned the admin API route. So again, I'm gonna cover some scenarios that might be unique to, you know, you or other orgs, but the idea behind the admin API route is you can customize how you're going to get those users in there.22:45Programmatically, so if you don't have a source IDP where you can cleanly pull from, if you have some other system users exist, you can create a script using our our API connectors to upload user and phone information into duo. So you can get all that information in there.23:02Using the admin API if you have a use case that, you know, needs that type of functionality, but this is a great option for those that want a ton of flexibility and control over that user onboarding and enrollment experience.23:21Another option, as I mentioned at the beginning was user self enrollment. This is usually not the route I recommend customers go because like I mentioned, I want to keep your admin panel free from having to do any kind of life cycle management. I, it's usually not ideal to have administrative overhead in the admin panel and require you to do a.23:38A lot of manual cleanup of users, and when users are allowed to enroll themselves, sometimes that can happen. However, there are instances where you might have applications or accounts where you want users to enroll themselves while they're going through an app.23:58And user self enrollment is a great way to make sure that everybody does actually go through enrollment. On the right hand side, you can kind of get a quick idea of what that process will look like. We'll revisit this in later slides and I'll be able to show you.24:13Exactly what that looks like in the demo, and we'll also talk about this new user policy setting down here when we talk about policy, but just to give you a sneak peek of what's to come, these are things that you'll see when you're trying to deploy this method.24:30Alrighty, so let's talk about some of the more manual methods. So maybe you're in a situation where you can't sync from a source directory, you have user information, but it's not somewhere where we can easily pull via like programmatically via API or from a directory sync method. You might need to do CSV uploads.24:49In that case, we have a couple of options that will work for you.25:09One is the import users function. So, take, e.g., you have a bunch of usernames and you have phone numbers. With the import users function, you can take those, put them into a CSV file, and effectively take your users from unenrolled or unknown to duo to fully enrolled in one.25:13One CSV upload. So because you're taking the usernames and the phone numbers, you're skipping right over that partially enrolled and giving them a fully enrolled way to authenticate into your dual protected apps. Again, this is not usually the preferred route because of the manual requirement of that CSV upload, but it can be a great tool if you do need it.25:33And, we also want to talk about the manual enrollment method with bulk enrollment. So bulk enrollment is a similar idea to the import users function, but it varies slightly in the information that you do upload. So in this instance.25:55We would say, hey, we have username information and we have email address information, but we don't know the two of A device information. We don't have phones or hardware tokens for these users yet. So what we can do with bulk enroll is we'll take the user names that we have and the emails and upload them.26:11And then from that moment, they're technically partially enrolled in duo. However, they will receive an email that contains an enrollment link that they'll use to go through the rest of their enrollment, go through adding that to FA device onto their account to complete enrollment and become a fully enrolled user.26:27So we'll talk a lot about email enrollment links in this session because that's a very common method. I know a couple of you had mentioned that.26:47You use it in your environment, so we'll, we'll keep revisiting that topic, but yeah, just to give you some idea of the flexibility and the maybe the different information you might have about users, you know, you might use bulk enrollment or import users or, you know, one of the other methods as well.26:56Like manually adding users here. So, if you have the need in your environment to have an admin, add users manually inside of the admin panel, that is something you can do. Again, it's usually not the 1st choice if we can avoid it cause like I mentioned, we want to sync that information for.27:12From a source directory, keep people out of the admin panel from doing manual things if possible. However, this is something that you can do if you have the need.27:31Now, I want to talk briefly about Duo directory. We will be touching this much more in depth in a later module, but I didn't want to skip right over it. I just wanted to let you guys know that I've been talking about referencing source IDPs using directory sync.27:46You know, up until now.28:02Also wanted to let you know that we have Duo directory available to you and with Duo directory, you get some unique capabilities and including like you see in the screenshot here, requiring users to set a password. So maybe you have a subset of your users who you don't want to have in Entra or in your source direct.28:04Maybe they're contractors and they need to remain separate. You can have users that only exist inside of Duo with their own password, and you could also have them exist.28:24Completely passwordless inside of Duo directory. So just to give you an idea of, you know, how Duo can work with you wherever you are and meet you where you are, you have some flexibility and some capability with Duo directory that could really help out, you know, with different subsets of users, and.28:34Again, you're gonna see about a lot more about Duo directory in the later modules, I just wanted to get your feet wet a little bit with it here. Alright, so let's hop into the 1st demo, which is configuring directory sync. Now.28:52Let me switch over to the admin panel here. Here we have just an a demo admin panel. Like I mentioned, I want to show you a directory sync because obviously that's the most common method. It's a great choice. It's the one we prefer. So when you're trying to enable this or edit this, you would go into users external direct.29:11Directories, and here's where you'll see some connected directory syncs here. In our example, we've already got.29:31An entra tenant tied in and an AD on prem tenant tied in. If you're somebody who's starting from scratch, you'll have to come in here and add your source directory, and as you can see here, some of the options are available to you, including Google OpenLDAP, Okta, and a generic inbound scheme integration.29:39But let's talk a little bit more about on prem Active Directory and what's required if you're not familiar with it. So if you're just getting started, and this is all new to you, what you'll want to do when connecting up your on prem Active Directory to Duo is set up a proxy server that allows that communication to go between.30:00In your on prem AD and Duo's cloud. The proxy server can be installed on a windows or Linux machine with a lightweight installer.30:19Once you just run through that installer, basically doing a next, next, next finish type of deployment, you can download a pre configured file here, which is gonna contain the information that that server needs to call home to your duo instance.30:28In our environment, I'll just hop over and show you one that we've already got set up here when you go through the setup of a authentication proxy, it's going to install what's called the dual Authentication Proxy manager, which is a great.30:45Debugging tool when you're trying to build out a proxy config. And in this config file, what you can see is those unique values that we got from the admin panel that tell it, you know, exactly where it's going to look and have its authentication here, so the.31:04That can actually pull and sync and also your duo tenant ID. So once we have all of these fields in here, and this service is up and running.31:24You will see that it's gonna come online on the duo side. Once it's connected, then you'll begin giving it the directory information for your specific AD. So you'll go ahead, you'll put in the host name of your domain controller or domain controllers. And in this instance where you.31:35Using standard LDAP, which is of course 389, and then we're gonna give it the base DNS, so we'll give it the, you know, domain and domain suffix of your environment.31:55If you do need to restrict this more, you can restrict it to a specific OU if you know that there's only one OU you're gonna be pulling users from, but normally we leave this as root and we just restrict via groups. So, lastly here, just touching quickly on the authentication and transport.32:07Types. In this instance we're using the defaults which is using the Windows system to authenticate to the domain controller.32:27To pull that user information and then the transport type is clear, which means the communication from the authentication proxy to your domain controller is unencrypted. However, if you would like to switch it to an encrypted channel, you can do that using LDAP S and changing the port to six.32:34Three six up here, just want to make sure you're aware though that any communication between your on prem off proxy and duo's cloud will always be encrypted over HTPS so you don't have to worry about, you know, the data being unencrypted when, when it leaves your environment.32:54Now, let's take a look at this specific setup here. So when we are configuring a directory sync, we have to choose the groups, the attributes. In this instance, we've got five groups that we're syncing in from our on prem Active directory. I usually.33:16Would say, you know, start small if you're new to this, start with a test pilot user group with just a few users who just want to get a feel for it, get comfortable with the user experience, and then begin building it out from there. As far as groups go, I usually like to bring in as many groups as we have policy controls we're going to need.33:35For them. So.33:55E.g., in a lot of my customer environments I see a different subset of rules for people who are traveling salesman versus administrators and then those like standard on prem users. For policy controls, you know, later on in your deployment, it might be helpful to have maybe more lacks location controls on the travel.33:56Following salesman, then you would on the on prem users. So.34:16As you're building out your deployment, keep that type of thing in mind with with group membership. And then as far as what we're syncing in, here we are syncing in a few you one username and a few username aliases. So the usernames are the things that Duo will associate when a login.34:20And is attempted to a user account. So in this case, we're saying your users can authenticate themselves with the values that are their same account names, user principal names, and email addresses.34:40We also can add in, you know, other username aliases or other attributes if you have the need for them. But what I want to take a second to talk about that is more important is, the import phones in the enrollment email sections. So.34:54With import phones, you have the ability to bring in the telephone number that's in their on prem AD attribute. And what is great about this is it lets you use this directory sync to go from a completely unenrolled unknown user to a fully enrolled user because we would be bringing in.35:10Their username and their two FA device. So this is a really powerful checkbox and capability here.35:30However, I more often than not do not recommend customers use this because in some examples that I've seen, the telephone number attribute is not always accurate, and if you begin syncing in users and you believe all the telephone numbers to be accurate, but it turns out a lot of them have maybe branch lo.35:37Patient phone numbers instead of their actual mobile devices, it will begin to turn into a bit of a headache for you. So unless you know that your environment is perfect, I usually refrain from using the import phones.35:57And would use the enrollment email method. And what this would let you do is sync in the user, user identity, you know, add in the username, email address, whatever values you need, and then it will send out an enrollment link.36:10To the email of those users it's bringing in so that when they get into their email, they click on that unique link, and then they'll go through the rest of the setup process to add in their two FA device. So thinking back to our original, you know, user state slide, if we use this enrollment email method, the moment we sync a user in, they're in Duo with the user.36:25Name.36:45Put NO two FA device, which means they're technically partially enrolled at that point. And then it's up to them to click on the enrollment link to go through and add the two FA device and become a fully enrolled user. Okay, so covered that and now I want to show you.36:46An example of how we would bring somebody in. So I have this test user Rich here, saying he's a new employee at the org. So we're gonna add him into one of the Duo sync groups.37:06We're gonna bring him into Duo users. Now he's in that group. When I switch back over to our directory sync, when I sync now, it's gonna query the domain controller that we have connected. Fortunately, we just have one so we don't need to worry about replication, and then it's gonna bring that user into the environment.37:21Let's take a look and see if he showed up. There he is. Okay, so again remember, we just synced in his username, we didn't pull in phone because we don't have that information. So he's technically a partially enrolled user at the moment. He still needs to go ahead and complete the rest of that enrollment. This is what I'm gonna show in the next demo.37:42After I cover a couple more slides about user enrollment.38:01And policy controls. Alrighty. Now let's take a look at policies that control enrollment. There are a few policies that I want to bring up. So you've got the new user policy as an example of one of those policies that will affect the user experience.38:05When somebody is going through enrollment. And with the new user policy, you've got three options. Require enrollment, allow access without MFA or just skip over entirely.38:25That person and then block access. What I usually will recommend unless you have a situation that, you know, dictates it, is to have this setting as block access. And what that is effectively doing is it's saying anybody that Duo does not know about, we do not want to let them in.38:35And this is ideal because, we want people to in most cases again register with like an enrollment link or an enrollment code. We want them to go through the enrollment workflow we've set up. Generally speaking, we don't want to allow required enrollment as they're logging in because if a bad actor has taken over their account, the bad actor could then.38:54And just enroll themselves. So we want to normally keep that out of band and unaccessible.39:14But yeah, just to let you know, there are those other options that might come into play depending on, you know, the user experience that you're going for in your org's requirements. The next policy that I wanted to talk about is the authentication policy because these two will come into play depending on how you wanna bring users into your environment. This policy.39:20It will have three different choices for you. Enforce MFA, skip MFA, and block access and.39:40Usually in, in most cases we would keep this at enforce MFA. Rarely do we change this? But, yeah, just to let you know this does also impact the way that the user might encounter onboarding or enrollment. So e.g., if you want a new user to be able to.39:48Enroll themselves in line coming back to the new user policy, you would of course have that as required enrollment so they can do the enrollment workflow. However, if you were saying, oh, actually we want to skip MFA for the authentication policy, that user wouldn't be able to enroll themselves. So.40:08We can't go through every single scenario of how these two might complement or work with each other. I just want you to be aware that these two policies do dictate the experience that the user will see when going through enrollment. And then finally, the enrollment policy. So this is a dedicated set of control.40:25Controls that will dictate the user experience when they're going through enrollment. The idea behind this one is that we set the policy in one location and then anybody going through an enrollment action will be subject to the same set of rules. And we're gonna show this again in the demo here, but.40:45As you can see, we've got different rule sets we can deploy for duo, directory password, the authentication methods they're allowed to use, and then that identity verification piece of it as well. Okay, now let's talk about the end user enrollment.41:03So for end user enrollment, you know, it's, they have a lot of different ways that we can cater to you and your org and the user to make sure that they go through enrollment appropriately. We've talked about enrollment links via email already.41:24We also have enrollment codes, which is something that you can see here on the right hand side. We're gonna go through that in the demo as well. I'm gonna show you how that all looks. But you also see in this other screenshot the login to enroll option. This is another, you know, control you can deploy to say, hey, before we let somebody do an enrollment, let's make them log in.41:38Into our entraf, e.g., and just verify themselves before going through enrollment.41:58So we'll take a look at this in the demo, but, you know, these are some of the options and this is what the experience will look like depending on what you choose. And just to summarize, you know, the options available to you, the directory sync email, we talked about this, you're gonna get an email link, the user clicks it, and then follows through.42:05With the enrollment experience.42:24You can do the import user function, which again would bring in user information and their phone information all at once so that a user goes from unenrolled to fully enrolled. We also have the bulk enrollment email links that we talked about, so you have usernames, email addresses.42:26Upload those into duo, get the users partially enrolled, and then let them click the links and finish enrollment on their own. We also mentioned user self enrollment where the user goes through, maybe in line and they add their two FA device as they're getting into a protected app.42:45And then we have enrollment codes that can be generated and distributed to the users to use as they're trying to go through an enrollment activity. And then we also have the user enrollment using an external IDP, so if you want somebody to sign in again to entrepre, e.g., before being able to enroll, you can have that available to them.43:01And I also want to touch on the difference between enrollment and activation. So this can get confusing sometimes, but when we're talking about enrollment, we were talking about getting the users up there and getting them in there with an authentication device. In some of the examples we've been going over, we talked about phone number and bringing that in. And while.43:24Yes, bring in a username and a phone number does technically make them a fully enrolled user. It limits them to only being able to use insecure methods like telephony or SMS. What we really want the users to do is go through dual mobile activation. And what this means is the user is downloading duo mobile app on their device and.43:44As they're going through, that enrollment piece, they're not just stopping after they put in their phone number.44:04They're actually going ahead and activating the dual mobile app. And what this gives them is well more control for you on the admin side to dictate, you know, how they're actually getting into the app and the information that gets passed on to us or the admin side, but also more security on the user side.44:10So we're gonna be able to use things like verified push proximity verification, more, you know, security rich features for that MFA that wouldn't be available with just a standard phone number. Okay, so let's hop over to the demo again and go through the.44:28Policies and enrollment piece of it. So as I mentioned, I, I just want you guys to be aware that there are a couple of policies that do apply to the log on experience and those were the new user and the authentication policies. So just taking a look at the global policy here, which is again the default policy would.44:48Apply if there's NO superseding policy.45:08Generally we want this as blocking access at the global level. If you have an environment where you need people to register themselves, you can set require enrollment. But usually what I recommend customers do is not set at the global level instead.45:10Choose the application or the location you want people to be able to enroll themselves on and set the required enrollment policy there. Block access is generally best practice here. For the reason I mentioned before, we don't want somebody to be able to enroll themselves while getting into our apps if we don't need to.45:29And then, like I mentioned, authentication policy, this will almost always be enforced MFA, but I just want you to be aware that, you know, it does exist and it does affect that user experience, for users going through inline enrollment. But yeah, we usually keep this as enforced MFA. You also have skip and block.45:50Available to you as well though.46:10And then I want to show you the user enrollment policy, so I talked about this one briefly, in the slide and this is the policy that controls that user enrollment experience. We can tie this to groups if we would like or just have one policy that.46:14Applies to everybody.46:32But the idea behind this one is we define what's required when somebody is going through a new user enrollment. So in this global policy, what we're saying is, hey, everybody who goes through enrollment, we're gonna need to have a password set up for them. We're also saying, you know, these are the authentication methods that we want to make available.46:34To them when they're going through enrollment. We want them to use duo mobile. We want them to use secure methods like pass keys or security keys. And then at the bottom you have the identity verification piece, which we're gonna cover in just a few moments in some slides, but if you want users to go through.46:54Identity verification before enrolling. This is where you would enable that feature. Now, let's take a look at what the actual enrollment experience would look like. Let's find our test user again here.47:12Alright, so in this example, you know, I mentioned a bunch of different ways you can get users enrolled. In this example, let's take a look at the enrollment portal. So we have this URL here where this user can go to do an enrollment activity.47:31We'll pretend that, you know, this scenario dictates they reach out to the help desk and they get a code that they'll need to use at the enrollment portal, to do their enrollment. So let's hop over to the enrollment portal here. As you can see, here's that login to enroll option that I mentioned in the slides.47:46If we wanted to 1st authenticate that user, with a source directory before getting them in, that's where they would click. In this case, we'll use an enrollment code here. So we'll put in the enrollment code, we'll grab the email address of the user.48:05And then we're off to the races. So 1st it's gonna ask us to set up a password, 1st it's gonna ask us to set up a password, come on, ask us, let's try it one more time.48:27I might have a cached.48:57Issue here. So let's try and just reopen this page. Wrong button here.49:00Let me grab the enrollment code again, and grab the email address and paste it in.49:17There we go, ok, so we'll just add a password for this user because that's what the enrollment policy dictated, ok. So now we got the password created. It's gonna take us through that next piece, which is.49:37Adding that to a bay device and it's obviously presenting the things that we have said it's allowed to present in the enrollment policy that just shows you the control that you have there with that policy. In this case, let's use duo mobile.49:57So we'll say, put our phone number in here is correct. I've already got the app on my phone and what I'll do on my phone is.50:11So I'll just open up the app.50:31Click on the add button here and just use my camera to grab that QR code. Once I do that, I have a new tile in my phone in my duo mobile app that corresponds to that specific account, and now I'm I'm effectively done. I'm a fully enrolled user and I have duo mobile app active.50:33Updated on my device, which is, you know, where we wanna go. Duo is gonna ask us if we want to add another device for the time being, we're gonna skip that.50:53And this person is done. So if we switch back over, this person will now become a fully enrolled user here. Okay, so let's switch back to the slides and wrap it up with identity verification.51:02So as I mentioned, identity verification is a relatively new feature with Duo. Duo has partnered with a company called persona, to make this happen. So if you are interested in taking advantage of this, you'll have to make an account with Persona to tie it all together. But here's some of the use cases that you can use identity verification for. Think.51:20And remote user enrollment like that workflow I just went through, we can tie it in there, which we'll see in a se in a couple of slides here.51:40You can use it for help desk verification, so if somebody calls into the help desk, you can have this workflow intervene, verify that user, to eliminate any kind of social engineering attacks on that help desk technician. And then we also are working on getting it working with self service account recovery as well. So if you want somebody to be able to do some self service, you can.51:46Require them to identify themselves or verify their identity before moving into that workflow.52:06And so how does it work? What it's gonna do is it's gonna take a look at your official government issued ID. It's gonna use the camera on your device to verify you are the person who, you know, is listed on that ID and it all matches up, and then it's gonna take that information and verify it on the back end to make sure that 1st name, last name, date of birth, all of that.52:14Lines with the user that belongs to the organization. So it's you know holistically look at the that person trying to do, you know, whichever function it might be and make sure that they are truly that person they should be, you know, that they're pretending to be. We're not getting impersonated here.52:34And taking a look at the remote user enrollment experience, think of, you know, the email link, workflow that I know a lot of you guys are currently using. So imagine a world where a back actor takes over an email account, they can sign in and they can read all the email through.52:50For a particular user. If we're using a directory sync method where we send an enrollment link to that user, if a bad actor is sitting there, they can click that link and they can enroll their own device impersonating, you know, that user who they've compromised and you wouldn't know it without user identity verification in the mix.53:10So what the value of any verification is, if that bad actor was to try and click on that link, now they're gonna be asked to present the government issued ID, do the selfie process, you know, all things that they would not be able to complete because they're not that individual, so.53:29Hope that gives you a good idea of how this all would strengthen that workflow by identify or verifying that person. And then, just want to show a quick video example here of how this would work. In this example, somebody is doing that exact scenario, clicking on an enrollment link that.53:46Has been emailed to them.54:06And we'll see how, identity verification will intervene and step this up. So here's the enrollment portal that they hit. They're gonna be going through that, you know, piece where they add their two of A device. They're gonna get asked to verify themselves 1st with persona. Again, persona is the partner. We've linked up.54:09With to make this happen, we're getting the country information, the which government issued ID are we going to use? They chose in this case a driver's license, and now here's the part where they use the camera on the device, show the driver's license front, flip it over.54:29We'll get the back of the driver's license. Once that's done, we're gonna say, let's get some video of your face once this processing is done here.54:47So if you're familiar with face ID on, Apple devices, it's a kind of similar idea. We're just trying to make sure that this person matches up.55:07Now that that portion is done, we can move on. So now the identity has been verified and now they begin to work on that workflow that you just saw me do via the enrollment portal where they're just gonna add that to a FA device.55:20Oops. Sorry about that. My screen is frozen here. I apologize.55:39Oh PowerPoint decides to freeze on me when it knows I'm up against the time crunch, of course.55:56Okay, I apologize. Give me one moment. I'm sorry, I'm gonna have to force quit PowerPoint and reopen it.56:12Okay, alright, we are back. Sorry for that delay. Hope that didn't kick us too far off, but we're at the end. So, just wanted to leave you with, you know, the next steps, the things you need to do. Obviously what we talked about, the most important piece.57:01Choose the sync method that works for your organization, you know, the method you choose is gonna be determined by.57:21The user inventory you have, where they're located in the workflows you might want users to follow when they're going through enrollment and onboarding, and then start small with the pilot group and then expand out once you're comfortable with that user experience. Keep in mind the user states you're working through and the.57:28Experience for the different users in your environment. So think about how an unknown user is going to get impacted when they try and hit one of your protected apps versus a partially.57:48Enrolled user and then remember we're trying to work up to that fully enrolled user there. And then lastly, we saw, you know, how do identity verification can be added into the mix to increase the security of, you know, that whole workflow there and verify the identity of the individuals.57:57Okay, now I want to kick it over to Nimita to talk about the Q and A and go over some of the questions you guys had. Thank you, Rich. Hello everyone, my name is Namita and I am customer success specialist on the Cisco toolkit.58:16Team and I will take it from here for our live Q and A questions. So feel free to add questions in the Slido.58:35Meanwhile, I'll go through some questions that have been already asked in the Q and A the 1st question is what case would someone allow access without MFA for an unknown user? So we have seen some cases where during the onboarding where admin.58:45Is generally configure a policy where they do not want the users to complete MFA because those are unknown to the tool admin panel. And this typically happens when your new user policy is set to allow access without two FA.59:04But we highly recommend that we apply policy on application level, group level at more granular level as possible. But yeah, this is one of the use cases that we have seen. The other use case that we have seen is that customers want to make proper utilization of licenses and they.59:21Don't want a certain group of users to authenticate with Duo MFA At that time also we have seen this policy getting applied. The next question, what are the requirements of.59:40For identity verification today. So the requirements are, you need a persona essential growth or enterprise plan, someone with admin role to persona dashboard. Along with that, you also need.59:58The duo admin panel and access to duo admin panel to configure settings between persona and duo. And next question is.01:00:16Just to clarify, it is best practice to block access in new user policy for global policy and require enrollment for somewhere else. Yes, that is what we generally recommend our customers that have new user policies that to block access at global level and then wherever which application you require you.01:00:36Users to perform inline enrollment, you can set your new user policy to require enrollment.01:00:56Okay. Sorry.01:01:21Next question, how can we prevent man and middle attacks or unauthorized enrollment if a remote employee's enrollment link or temporary credentials are intercepted by an attacker? We highly recommend using Duo identity verification, which is integrated with persona and this will add.01:01:38High assurance verification during the onboarding process. So like e.g., when a user is going through a self enrollment, they will be asked to perform a document verification where they have to scan their driver's license passport or followed by a selfie verification. This will assure that the user.01:01:59User that is enrolling his device biometrically matches what is there on the file. Therefore, if someone has intercepted.01:02:18The enrollment links it becomes useless to the attackers. And also I just wanted to go through the requirements for dual identity verification. As I mentioned, we would need persona essential growth and enterprise plan with admin rule. Persona will load all the duo ID.01:02:26Identity verification templates from the recommended configurations that your account will be requesting for. And for duo, you would be requiring a duo owner role administrator administrator role to configure the identity verification duo admin panel.01:02:46And for the end users who will perform the identity must have access to a computer or a mobile device that has a camera.01:03:02There was one other question that was asked in the chat before about can we use multiple enrollment methods together? So yes, you can use multiple enrollment methods. Like e.g., you can use directory sync, manual enrollment, CSV and APIs.01:03:42So this will give more flexibility to bring in your users into two admin panel.01:04:02Okay, there's another question regarding IDV, is the user experience custom customizable by the organization? So the user sees organization branding instead of duo opera.01:04:19Persona branding. Yes, both dual security and persona supports white labeled customization. This will allow organizations to.01:04:30Apply their own branding, like they can have their own logos, colors, domains, and messaging. So when an end user is going through authentication or identity verification workflow, they will see your organization brands and logos instead of persona or dual logos.01:04:41So I have covered almost all the questions. If anyone has any other questions, please post it in the slido Q and A If not, then we can.01:05:26Okay.01:05:46Yeah, you can keep asking questions. We still have some time.01:05:46Okay, so it sounds like we're ready to take our 1st break, so we'll come back at 25 where we'll have module two.01:06:17So we'll take a 10 min break here, guys, and then see you soon to talk about module two.01:06:36Hey hi, hello.01:15:02Good morning. Here we are with module two. Hopefully everyone's filtered back in. Thank you for attending. Welcome. My name is Samuel Collinsworth and I'm a customer success specialist here at Cisco duo. I'll be leading this module today.01:15:04This content was designed with the help of my colleagues, Aaron Wolf and for this module, we'll be doing a deep dive into duo directory and some related functions. I'm sure some of the content I'll be presenting today will generate questions. Please use the Q and A so our moderator.01:15:21Can deliver targeted answers towards your asks. I know you guys have probably all heard that many times. To get to know everyone a bit better, let's go ahead and start off with a few questions.01:15:41Awesome, so our 1st question for module two, what identity and authentication sources are you using in your environment? Let's give a couple minutes for answers to fill out there.01:16:02Yeah directory, that's good.01:16:22Decent feature parity. I'm a big fan of using Active directory. Hopefully some of those cloud based solutions are already including Duo directory. That would be exciting Yeah, looks like most of our.01:16:28Users are using Active directory, which makes sense. There's a very simple setup.01:16:47Looking the authentication proxy and get your connector going. In house solution, that's always exciting. I see a lot of a lot of people consider some custom resources like CAS or some of the older versions to ship with as, as in house as well.01:16:52Awesome. I think we're getting a good vibe there Move on to 2nd question. Which of the following directory capabilities is important for your organization?01:17:13Now this is an interesting question cause this maybe things that you haven't even thought of.01:17:33Custom attributes and password management, two very exciting things about directory you guys will learn here pretty soon. Yeah, all of, all of the.01:17:56These options are you guys will hear about in in this these upcoming slides as well, so.01:18:16Stay tuned. Do we want to go to question three? Where is your organization's passwordless journey? Have you tested it? Have you guys attempted it? Have you piloted it? It's completely deployed?01:18:21Let's, let's give some time to fill out these.01:18:36Excellent, excellent.01:18:56No, there's a lot of curious and especially coming from on high, right? Let's sea levels are really excited by buzzwords like like passwordless and what's nice about Duo directory is it's almost as easy as just saying it, so, couple more seconds for that.01:19:04Oh, those who are curious, you'll hear a bit about it today. Awesome.01:19:24Go and pop back to the slides and and begin the content. So here's a brief overview of our module. 1st, obviously, we're gonna start with our exciting new IDP offering duo directory.01:19:42And then after that, we're gonna have a brief overview on the skin protocol and here at Duo how we're implementing it specifically into our software, and that will link strongly back to Duo directory as a as a portion of your user control and hygiene.01:19:59After that, we'll cover routing rules, and routing rules are very exciting and they will link back to those desires y'all were answering the poll about, and that allows for our multi IDP functionality. And after that we'll have an overview of duo's passwordless offering and how we start that journey.01:20:14And we might even see a little bit of it in our demo today, if you watch closely, right? Duo, as name implies, originated as a company providing an innovative solution to provide multi factor authentication for author.01:20:33Authentication workflows that were not originally designed with security in mind.01:20:53Now we did this utilizing the Duo authentication proxy, allowing for companies to inject MFA into radius and LDAP authentication for primarily on premises applications as well as purpose built integrations for ADFS, Windows Logon, and many popular use cases. And if you've been with Duo for a long time, you really.01:20:58Know how innovative and creative those, those proxy based radius and LDAP solutions were a big fan.01:21:18As applications started to shift to the cloud and towards more mo modern authentication protocols, we've added sing single sign on capabilities. 1st using the dual access gateway, and then Duo SSO, which was the natural evolution into a cloud identity provider. Dual SSO has allowed us to fully own the authentication.01:21:26Experience for users and unlock additional capabilities including passwordless authentication. But it was still reliant on users being created and managed in an external directory.01:21:46When the external IDP as an off source to duo SSO, we would encounter a roadblock when trying to protect logins to that external IDP. We would encounter a loop as we're trying to source from the same place we're trying to log into.01:21:58Traditionally, that hurdle has been crossed by utilizing an on premise AD off source for SSO, though this can cause friction of its own if you do not want to rely on a constant connection with you within your perimeter or if hygiene at the domain is not is not tight.01:22:16Now, with the launch of Duo directory, Duo can manage the full life cycle of your users end to end as a security 1st IAM solution. We still manage the flexibility in interoperability of your existing systems that Duo is known for while also being.01:22:37Able to be the standalone source of truth for your users. This is a, this is a big shift for duo.01:22:54Let's dive into those specific features that we've added to enable this end to end vision and how they connect with an amplify duo's existing capabilities. When people think of directories like AD or intra, they think of passwords, the barrier to logging in.01:23:02If your organization isn't yet ready for passwordless, either I operationally or psychologically, we now allow users to create a password directly with Duo for use with our phishing resistant MFA. Duo can now be your source of truth.01:23:19Enabling you to cut ties with your legacy directories, such as Active directory, and minimize your on premise footprint. You can NO longer need to have an on prem infrastructure in the loop for authentication if all you want to do is check a password with a cloud service provider.01:23:36This also sets the stage later for shifting to true passwordless. Users enroll a dual password and a passwordless capable authentication device for use with MFA, and then when you're ready, modify your dual policies to only allow passwordless authentication.01:23:55Where else might you have dependencies on legacy directories? And I know you all are thinking about this. How about for retrieving user attributes to be used for single sign on? No more. You can now define custom user attributes in Duo and create them directly in Duo or sync them from your existing directories.01:24:12You're probably tired of hearing the word flexibility, but here it is again. Our implementation of user attributes gives you the flexibility to manage user attributes in accordance with your varied authentication flows, think per application. In days of old, Duo only really cared about your username.01:24:36If we became an SSO provider, other attributes were either retrieved from Active Directory in real time or set from your SAML authentication source at the time of authentication. That's still a great option for organizations who are still committed to either AD or existing SAML.01:24:55Little IDPs, but what about your duo directory only users? Or what if you want to eliminate your on prem tether to AD?01:25:15Duo directory enables you to define custom user attributes and populate them via external directory sync manually or using our admin API. This allows you to have access to the attributes you need for your users when and how you need them.01:25:23And it goes beyond single sign on. Even if you're still authenticating and against AD, you can use Duo directory user attributes manually. And as I mentioned earlier in our synopsis.01:25:42Duo has recently added the support for the Skim protocol. Let's have a brief overview on that protocol and how Duo implemented it. So SCIM or system for cross domain identity management, like the mouthful, it's an open standard protocol that automates user provisioning, updates.01:25:58AMD provisioning across software as a service applications and IT systems ensuring consistent, secure identity management.01:26:18That's as best based on RESTful APIs and Jason. Skim, specifically SKIM two point oh eliminates manual onboarding, off boarding, reduces human error and secures zombie accounts. That what does that mean for us as duo admins specifically? We can use Skim provisioning.01:26:27Being in tandem with our service provider integrations to robustly keep your user stocked with all of their custom attributes they need to log into various applications in various contexts.01:26:47This gives Duo directory a flexibility to support nearly all skin providers and our schema discovery tool makes the process extremely simple and intuitive. With Duo, we can utilize group specific provisioning or inline provisioning at.01:26:57As the application is accessed by the users.01:27:17With the new SKIM support, we also can sync users to Duo directory from various IDPs that have historically only offered SCIM. This allows near universal compatibility with IDP vendors.01:27:24It's just some key aspects of skim. Why are we doing this? Well SCIM automatically synchronizes user data from IDPs like Duo or Intra to target applications creating or removing, and that's a big point, removing the accounts in real time.01:27:40It uses a common extensible JSON schema for user and group attributes ensuring compatibility across all different schemas, all, all different systems, excuse me. Him enables standard create, read, update, and delete options, otherwise known as crud.01:27:56Allowing IT to manage a user's identity full life cycle. By automating deprovisioning, go back to delete deletion being a big deal, it ensures employees who leave an organization lose access immediately closing significant security gaps.01:28:14And this is widely used already to sync user directories with software as a service platforms like Slack or Salesforce, and this is great to manage licensing costs and access control. Let's have a brief demo just to go over where sc where these skim settings are within the dual admin panel.01:28:32And how easily they work.01:28:52And I did lose my login, so bear with me one moment. Oh I'll put my password manager on screen just for a moment.01:28:57So you'll, you'll see here this is probably the homepage that many of you are familiar with. Let's go to our pre configured application where we have the syncing configured. But here's what the service provider some of you maybe familiar with called Atlassian. We have this completely configured for authentication. Y'all maybe familiar with these with these configurations.01:29:28But what we're focusing on today is this new provisioning tab.01:29:47Now you can see here there's already a bit thrown at you, but this is this is somewhat intuitive if you take time to digest. Down here is our configuration that for the purpose of the demo we've pre configured, and this information is very easy to retrieve either from documentation with the service provider or from their support if they're struggling to find it.01:29:51Down here you'll see the attribute mapping that we've actually configured. And so within Duo, these are the labels for our duo attributes, and then these are the labels for our service provider attributes to make sure they match up. So all of these are configured within each user that would be synced Atlassia.01:30:10And down here finally, and this is the really important part, this is where you select what users are getting provisioned to the application. But we have two different methods for this both during SSO access, so in line or pre provisioned groups, and that's what we're gonna use today.01:30:27And then here we'll also see options. This relates back to the CRUD functionality of skin. When, when sending the signal to service providers to remove users, do we want it to be deactivating them or deleting them? There are multiple use cases for either.01:30:49From there, we'll go ahead and click save, and we will give this just a moment to update our group setting has held.01:31:02Over here, you'll see that we only have these pre configured administrators for provisioning succeeded, it is that quick. Let's see if we have our users over here. Fantastic. So you can see here that we have three new users.01:31:23All mythologically named. And then if we go over to managed accounts and view a user, we can see the job title which came across with the skin provisioning. Fantastic.01:31:40It is really that quick. It is that simple to provision users for an application. This is the logging. This updates live, so you can see all the, all the related logs to what we just did.01:31:55That will go back to our content slides.01:32:18Alright, now this is a really exciting part for me. With the ability to have multiple IDPs associated with SSO applications, you might be asking yourself, how does the authentication workflow know which IDP to use?01:32:32This is where SSO routing rules come in. SSO routing rules are a powerful feature that allows Duo to direct users to distinct IDPs based on specific criteria. These rules can be dependent on network, domain, group.01:32:52Or application and offer an incredible amount of flexibility when authenticating users. Routing rules also allow Duo to run as an identity broker in front of your existing systems to help provide a consistent layer of security and consistent user experience and complex environment.01:33:12With multiple IDPs.01:33:32Here's a real world example on how routing rules can be used. If you've ever acquired a company or been acquired more likely, you know how messy initial onboarding can be. E.g., an acquired company you may have already have had their own complex IDP environment, and merging IDPs is.01:33:39A long and daunting task. The acquired company likely has critical applications that employees require access to for their day to day tasks. Duo can help by acting as an identity broker to get these users up and running quickly. Once federating the application and onboarding the users to duo.01:33:58Routing rules allow the new user to authenticate against their old IDPs for their existing applications, allow admins to deploy MFA to those existing applications very quickly and allow the new user access to the parent company's new applications via the new IDPs.01:34:18All this while also maintaining an easy and consistent experience for end users. Once the application is eventually migrated to the new domain, disabling the rule is as simple as flipping a switch. But that animation play, very smooth.01:34:38Another example is, if you don't want to put in Duo as your primary IDP.01:34:58We can run side by side with your existing IDP for a subset of your user population. This is really where the magic of routing rules comes in. Whether that's contractors, vendors, partners or other 3rd parties who might not belong in your main directory, either you don't want to pay for licensing or you don't want to establish IAM for on premise for a unique.01:35:04Use case.01:35:24These users can exist solely in Duo and authenticate to those same applications as the users who exist in the main directory. This can save on licensing costs or the time required just for creating accounts. Routing rules have robust flexibility and they are a.01:35:26Absolutely crucial.01:35:45Part of Duo directory. SSO routing rules also play an extremely valuable part in implementing passwordless. Duo passwordless SSO is a series of features.01:35:47Excuse me, that remove user password from the authentication workflow. This makes our passwordless offering very flexible, allowing passwordless to arrange from a single application to complete passwordless, including where a password never exists.01:36:06So let's do some real world data to back this up. In recent incident response data from Cisco Talos this past July, we have had a critical insight. Threat actors largely leverage compromised internal or trusted business partner email accounts to send.01:36:25In Malicious emails, which appeared in 75 % of engagements where phishing was used.01:36:45That's nearly 75 % of the time where phishing was successful. Those initial compromised credentials were then used to send more phishing attacks and now with authentic email to get more privileged access, which could include MFA credentials, session tokens, or spearheaded targets.01:37:00Not good. With only one layer of security like passwords or even just two layers when you include MFA, attackers can find ways to continue to send targeted attacks through one or two walls they encounter. Now, as a part of zero trust architecture, you can also layer an additional security posture check.01:37:17Verification of trusted devices and have that added visibility on all types of devices accessing your network and applications. Making the added security layers we will be discussing today an absolutely crucial part of an impentual defense.01:37:38Alright, so we all can agree the critical need for strong user friendly authentication and device trust methods. This is where our agenda for today really comes into play, providing a seamless and secure way for users to identify.01:37:52Their identity and protect access to those corporate resources. I'm sure that.01:38:08A lot of people, even maybe some in this meeting, ask themselves frequently, why go passwordless? What what's the problem with passwords? And some people probably already have a few ideas, but implementing passwordless authentication into the environment isn't just removing typing. It it's not just adding a little bit of convenience.01:38:17It's for end users. It's removing friction for those users, removing headaches for your admins and help desk, and removing the most vulnerable part of the authentication workflow.01:38:371st, managing a list of passwords is a major pain point for end users with complexity requirements and resets. Authentication problems equal loss of productivity and frustration for all involved. Password management, and if anyone's had a POC with a vendor, you know, they add signifi.01:38:48Significant operational costs by eating up the help desk time and resources as well as financials.01:39:07Lastly, the biggest threats to the password plus MFA authentication workflow currently are social engineering and phishing attacks. Bad actors are able to target the user directly, tricking them into giving up their password and accepting a two FA attempt.01:39:13Social engineering attacks are only getting better and better and educating the end user to spot them is NO longer enough. We need verification in place. Implementing dual password lists not only provides an improved user experience.01:39:29And reduce administrative burden, but also greatly lowers the risk surface that simultaneously closes the largest security apps. Excuse me.01:39:48Multifactor authentication involves two out of the three following, something you know, something you are, and something you have. That's a very traditional legacy way to phrase MFA. I'm sure many of you admins have heard that before. Standard legacy MFA combines the something you know, with either the something you are or something you.01:40:05You have.01:40:25Passwordless shifts the paradigm to instead being something you are plus something you have and then additional remaining MFA. Duo solves the problem with passwords by replacing the password with more phishing resistant methods that are FIDO two compliant.01:40:26These are known as web often pass keys. Pass keys can be local to the endpoint and use built in platform authenticators like fingerprint and facial scans or roaming authenticators like YubiKey tokens. Passkeys work by taking advantage of public key cryptography cryptography, excuse me, when a pass key is registered.01:40:46Public private key pairs created.01:41:06Very, very simple encryption stuff. But then the private key stays on the registered device in the secure location while the public key is sent up to duo for verification. Additionally, the FIDO two protocol also demands proof of user presence at the endpoint. This is usually in the form of a biometric, like a fingerprint of like a fingerprint.01:41:08Scan or face ID.01:41:28Instead, the user sending a pass, instead of the user sending a password while signing in, Duo sends a challenge. The private key is used to sign that challenge and send it back to the Duo service, but not before the user verifies their identity locally with a biometric to unlock that private key.01:41:32Dual then uses the public key to verify the signatures and if it matches access is if it matches, access is granted.01:41:50While all this may seem very complex, the process is mostly transparent to the end user. For a pass key stored on the endpoint, the only part of the experience requiring user input is a biometric scan.01:41:59Pass Keys are a very strong phishing resistant authentication factor.01:42:23But they have their own set of challenges with pass key management and the workflow being notably different from what users are are used to. If any of you have tried to deploy fleets of yubikeys, you've you've probably experienced this. To address this, Duo has introduced verified Duo desktop authentication and proximity verification.01:42:28Verification, very exciting. I believe that is unique to our offering.01:42:48With the duo desktop client installed, the user can be prompted directly from their endpoint rather than the mobile device. This still uses a biometrically protected private key stored in TPM, just like web off and past key, but provides a look and intuitive experience the user's already familiar with. This also.01:42:54To removes the administrative worry of managing pass keys.01:43:14In the case of roaming authenticators, we also have Duo proximity verification. This is a more secure version of the Duo mobile push your users are absolutely familiar with, and the private key lives on the mobile phone protected by the face slash.01:43:21Touch ID. Again, just like with passkey, but there is an additional check. FIDO two requires the close proximity so the dual mobile client also does bluetooth low energy proximity check to make sure the mobile device is near the endpoint trying to access the application.01:43:37This doesn't mean your end users are pairing their phones or anything complex like that. Bluetooth just needs to be enabled on both the endpoint and the phone. The dual desktop agent and the dual mobile app take care of all of the background information beyond that. From the user's end perspective, the Bluetooth check happens automati.01:43:54Automatically once the push attempt has started. If the check is successful, the user accepts the dual push as normal. The phone's biometric check is also automatically triggered as normal for an extremely secure low friction user experience everyone already knows without sacrificing the security of FIDO two or web often.01:44:14As an additional benefit, if users are currently using Duo mobile, upgrading the password list does not require them to enroll an additional authentication method. A simple admin panel policy change is all it takes to enable Duo proximity verification.01:44:37Now that we've talked about Duo routing rules and passwordless authentication, how do you implement these into your environment? Enabling dual passwordless is a very straightforward process, but like everything else requires some careful planning.01:45:03The impact from deploying passwordless impacts everyone in your environment, so a deployment strategy is important. No two environments are the same, but there are some guidelines for achieving a successful deployment. 1st of all, it's very important.01:45:18To set realistic goals and form an adoption plan.01:45:38You'll you'll want this written out almost as SOP. Adopting passwordless is a journey and will likely impact every user in your enterprise. Take things slow at 1st to minimize any potentials mistakes. And these can be scoped at this, at all the same factors that our policy scan. So that means application, group.01:45:42Application group or group globally. Every successful passwordless implementation starts with that great plan we referenced before. Audit your current environment to gauge the impact it will have on end users and if user hardware is sufficient.01:46:00It that leads back to the biometric protected duo desktop, that does require TFPM module on the machine or if you plan on using built in biometrics like touch ID, you'll obviously need to make sure that you use this are using a Mac.01:46:16Keep your pilot group relatively small and start with only a few strategically picked applications. That, that will help limit the scope if other users start seeing the passwordless flow when you begin testing. Prepare your IT help desk ahead of time to minimize user issues and monitor user adoption closely. Wait to disable.01:46:35Legacy authentication methods until after you're completely comfortable with the rollout. And that is the 1st people you should be training on response and use of these passwordless methods is your help desk so they can adequately respond to your end user's requests and questions as if they've done it themselves because at that point they have.01:46:55And then you always want to leave your fallback methods in place until this is tested to success. So if someone doesn't counter a passwordless prompt, they can always fall back to password and do a push as long as you leave it enabled. Now let's look at what some of these changes look like live.01:47:12So we're gonna shift back to our demo now, and you'll see here we're still on our skin page and hopefully my login has held through here, but let's go and take a look at those routing rules we've been talking so much about and what they actually look like.01:47:32So from applications, you'll go to SSO settings, and then on here, you'll notice that the routing rules tab right up top. So when we click in here, this does not look too complex, but we have one rule configured here, and then up here is our default rule. So if nothing encounters your.01:47:52Your custom rule, it goes to default and the authentication source you have designated the default is configured up here. And right here you can see my configured authentication sources for Duo SSL. So what do one of these routing rules look like? You know, what kind of criteria criteria are we actually hinging these authentications on? Let's take a look.01:48:11And you can, another, a quick aside is that you can look at the blade. If you have many of these, you can bring this up in a blade view, delete and edit them directly from here. Otherwise you can use our traditional workflow. So within here, you can see that I named it EIS demo.01:48:31Adequate naming in my opinion. But he down here are condi our conditions, and this is what really matters. This is the meat of routing rules. So our most recently delivered condition, and this has been extremely helpful for deploying this in a myriad of use cases, but we can hinge those authentication, that authentication workflow.01:48:47On group membership. And remember, that's because they'll interact with Duo 1st and we already know what group they are, even if it comes from an external identity source.01:49:07In addition to this extremely robust and flexible condition, we can set it per application, and you'll see here when we switch that radio button over to specific SSO applications, we can see the configured applications on my testbed here. For now we'll leave this blank because for our tests, we're gonna use groups.01:49:16In addition, and I don't see this, this is one of the, one of the conditions I see used the least, but this is extremely useful if you're using this in tandem with a contractor or 3rd party user use case. You can specify login domain to set the routing. So if you have.01:49:36User, if you have multiple sites with multiple different domains, you can make sure that the users with those domains are being routed to the correct sites for credential verification.01:49:54And then finally, we also have network location as a conditional factor. And here you can see that we have multiple different formats of IP address you can include here, including cidr blocks and ranges or just specific public IP addresses. And down here, easy to.01:50:05Missed but possibly the most important part. This is where you select the off source that these users get routed to. So for the purpose of this test, we're keeping intra, and just to make sure I don't, I don't screw anything up, let's go ahead and click cancel. And so from the logic that we viewed here.01:50:25When logging in with it, when logging into a duo protected application, in this case we're gonna use Duo central. If the user is in this group, enter off, they should be redirected to enter ID for a credential verification as a part of the Duo SSL login. Now if they don't match the criteria for this rule.01:50:45They should be routed through our default rule, which is going to go through Duo directory.01:51:06Which if you look closely, you may see how easy it is to use passwordless. Let's go ahead and, and do these two logins. Just bear with me while the application loads off screen and I will drag it on.01:51:09Second one too for our. So here we will 1st try with our introback login. So this user.01:51:36Is a member of that group and we can verify that and demonstrate that here. If we go to groups and then look at our, look at our inter off group, you can see our user Aries is in there. So we'll come back here and we log in against Duo Central with Aries at popular app.com.01:51:51You'll see that we are routed through intra. And this is without any specific configuration beyond those routing rules. We we're still using a password over here at intra.01:52:12So go ahead and enter that password, and then we'll see our MFA from Duo SSO, and if you're unfamiliar, this is our fish resistant push, what we call internally.01:52:28Verified push. The only difference between this and a standard push is that when I accepted that push on my phone, I had to enter in that three digit code that you saw there on the screen. And boom, we're logged into the application. Excuse me. Let's go ahead.01:52:48Now let's try with a different user. Now this user is not in that group, just gotta clear my cache so I can make sure I can get in with the correct user. Apologies.01:53:05That intact needle window was holding on tight. Fantastic. All right, it did pre populate the user, but I'm gonna go ahead and type it in just for demo's sake.01:53:24So our other user, and we did look at the group membership here, Aries is our only member of that group. So what should happen here is we should go through Duo directory. Let's find out what happens now this is gonna be very.01:53:41Very quick. So you see I did not get a password prompt there and I did not get directed away from duo. Instead.01:54:01I got a touch ID prompt, and this is for remembered devices, so you can ignore that screen there. But you see after the touch ID, I was allowed in. That's because the biometric allowed the the private key to go to dual for verification. And because of that I was able to log in and without any additional configuration with external.01:54:07Internal IDPs, I was enabled, I was able to enable passwordless with only a simple click and policy.01:54:27And that that may have seemed very quick, but that very eloquently demonstrates how easy it is to log in passwordless with Duo and how easy it is to enable it. I believe we saw in the previous module how easy it is to enroll it and with all those things together.01:54:42We can really see how Duo directory is a huge step in the right direction for ease of deployment with these advanced authentication features.01:55:00Alright, and now we'll have a quick recap slide just to bring some of this home. And after that, you know, we'll definitely go to Q and A cause I'm sure there's some questions. So recapping, Duo has added some extremely robust features to complement your existing identity stack and painlessly roll out the latest.01:55:11This passwordless methods to your end users.01:55:30Review your current identity stack for use case and I I should have said as a preface, this is an excellent guide on the ways that you can take this information back to your organization and start to implement some of these features. But you'll want to review your current identity stack for use cases where dual directory can supplement your primary IP.01:55:36IDP or where Duo can act as the primary. So those applications that are frequently being accessed by 3rd parties or there are issues with redirects, possible policy inflation going between different external providers, that's where Duo directory is gonna be really powerful. And you can reduce the risk and overhead by allow.01:55:56Allowing contractor and vendor identities to exist solely in dual directory at that point.01:56:16Not only is the security of the central management point, very attractive, but also if you're storing them in a cloud identity provider, you very likely are paying licenses on them, and then by enacting MFA, you're doubling licenses on these 3rd party users. By storing them in duo directory, you, you will be saving your company money.01:56:22Turn Duo into an identity broker for your environment by using SSO routing rules to direct users to the proper IDP based on that existing criteria. Routing rules can make phasing and passwordless extremely easy by setting an authentication methods policy enforcing passwordless, and then directing those users to you.01:56:43Is dual IDP.01:57:02When enabling passwordless, 1st perform an audit of your environment. This should give great insight into your into your user, into your use case and help perform a deployment plan. If pass keys are seen as cumbersome or if managing pass keys are a problem, consider using the dual proximity verification.01:57:05And verify duo desktop authentication as an easy and familiar alternative.01:57:25Those those methods are already deployed in your environment likely in some shape or form. So using, I I cannot really stress enough how impressed I was the 1st time I saw Duo proximity. It it is extremely easy to use and as long as Bluetooth is enabled on the computer, there is NO pairing or precon.01:57:31Config necessary. It simply needs to be enabled through policy and duo desktop installed onto the computer.01:57:51And of course you wanna start small with your deployment, create an initial pilot group to roll out passwordless with only a few applications. You want to monitor this adoption closely and be sure to prepare the help desk ahead of time so they are ready to handle any support request that may arise.01:57:58I hope you found this session very informative and I'm excited to answer any questions that we have. But for now, let's kick it over to Aaron. I'm gonna and we're gonna go back to Slido and answer some of these questions.01:58:18Yeah, my name is Aaron. Well, thanks Sam for that great, all the great information. I really appreciate that. We do have a few questions that came in.01:58:38We'll go over those. Feel free to go ahead and chime in with any questions on the line, we'll get those answered live if we can. A couple to start off, when Duo uses routing rules to direct to different identity sources, does that user need to exist in Duo?01:58:46So the short answer to that is technically NO, but there are some caveats to this. Like the routing rules they're, they're mainly used for, in at least in this onboarding instance, if your user, if they're not ready to be loaded into duo or if you have NO plans of unifying.01:59:03In the application with your, with like that's in this instance the purchasing company's directory.01:59:23So then the user would exist in the other directory and then Duo would still be able to apply to FA. While the user doesn't necessarily have to exist in Duo, if the external IDP is performing its own MFA for instance, but we do highly recommend that that second factor is centralized in duo, so all the monitoring can take place.01:59:30This way also the full dual policy stack that you have set up, the centralized policy stack can be applied to those users as well. So while writing rules, they can be applied to users who aren't duo. We do recommend that be limited to very specific onboarding scenarios to keep the vulnerability limited.01:59:50Next question was asked, what do we need to use passwordness and can it only be used for a single group of users? So the answer to that is yes, it can be used for really to whatever skill you'd like as Sam touched on in the presentation sum.02:00:12Basically with duo policy, it can be be applied at the group level. Our policy stack applies in a few different tiers being global policy at the bottom, then application policy, and then group policies. Group policy's taking highest priority. So if you were to apply a policy that.02:00:30Full policy stack to a specific group of users and set in there the authentication methods allowed to be only passwordless, then that would take precedence over the authentication method policy for an application or for the global. So yeah, you can scale this out for as small or as big as you like. We do recommend obviously if you're starting out with passwordless.02:00:50Just keep it small to implement the start so you can gauge how your users respond to it and what what works, what doesn't. Just, yeah, the same tips same touched on in the presentation. Another question that came in.02:01:10We have lots of SaaS applications and onboard new ones frequently. We'll be able to set up provisioning for all of our SaaS applications in duo. So while we do support SCIM in most scenarios between outbound and inbound directly through the SaaS application, we, we.02:01:27Are dependent on that application support for skin. So most importantly for skin downstream of 3rd party IDP like like duo. So we have listed out a few known applications that we have confirmed skin support with that definitely does work with duo. Everything else all can be customized through our automated provision.02:01:44Settings as long as that application supports skin. So yes, but it's gonna depend on the 3rd party SaaS applications skin level support.02:02:05Then we have, if password is configured, sorry passwordless is configured and you don't have that authenticator close to you, what will happen? So, if a user's registered password authenticator is not available.02:02:19Dual falls back to username and password plus two FA authentication flow. If you opt to disable password fallback, the administrator can issue a bypass code to help them regain access. So essentially it's, it's up to it's up to you.02:02:35Originally Duo used to have it so it automatically failed back to password. That's now an option where it does not have to be that way. You can require passwordless to basically remove the password altogether from the workflow. We do recommend a backup authentication method, so for passwordless it needs to be.02:02:52You know fish resistant in some way, so either Fido two web often like a paskey or we have the dual proprietary options, so we have.02:03:12Passwordless push, which is with the proximity check and then the duo desktop with with the biometric check built in, those could be used as your primary or backup option and then have a pass key like across device pass keys saved on your phone, something along those lines.02:03:23Otherwise yeah, they would have to contact your help desk or use whatever your internal workflow is to get a bypasscode. Same as if they forgot their password, you know, just from a passwordless workflow standpoint.02:03:43Let's see.02:04:03So one that just came in when deploying on Duo servers can, I can encrypt the integration key and secret key by running the encryption command after the auth proxy is configured. Is there a way to deploy Duo across a large environment with Duo windows, and.02:04:08The do auth processing figured along with handling the encryption. We'll tackle that one here in a little bit. That's gonna take a little bit of explaining to do live. We'll definitely get you an answer though.02:04:25Right. And then we had another one come in asking about more fish resistant methods. So company uses SMS and duo push, but need more fish resistant methods for to combat phishing attacks. They're looking at passwordless, but would like to know how does duo passwordless specifically.02:04:54They address the issue of legacy MFA and the vulnerabilities there.02:05:14So, do a passwordless, it utilizes you basically it utilizes the web offense standard. So it needs to be the something you have and something you are metrics rather than something you know. So.02:05:19There's also the private key cryptography part built into that. So there's a private key either stored on the TPM module locally or secure enclave if your Mac. And then there's the public key which we have, and then that handshake takes place as one primary form of authentication and.02:05:39And of course that private key is protected by a biometric. So.02:05:59Unlike legacy MFA, which relies on that password, there's already a few levels of authent of security involved with web authent. Then because passkey inherently has kind of a built in management problem, essentially you can store pass keys kind of wherever you want and passkeys have.02:06:04That are designed to be shared, some administrators don't like that option. They don't, they want the pass keys restricted to a single device. Duo has released their, our proprietary options as we talked about before, which is the password, the passwordless proximity push and then Duo desktop of the biometric. Both those are the same level of security as web offend.02:06:23And they're familiar already to your end user and has that look that they're already used to with duo. So we recommend you go those options.02:06:43Then another one come in, does dual passwordless authentication about Bluetooth work when I'm logged into a local workstation connected to Bluetooth and accessing servers through RDP from local workstation? A little clarification there. So you're accessing servers through RDP. Are you there's two different sides to this. There's.02:07:00Accessing the RDP session itself, which that has a different sort of workflow. So right now they're working that that's a feature that's kind of in development with passwordless for RDP, getting through to the other side of RDP.02:07:20Let's say authenticating, applications inside of the RDP session. There's a feature being developed there as well, that utilizes a feature we call passport. Essentially what that does is that stores trust in the.02:07:40Duo desktop client when you 1st authenticate and then that trust can then be passed to the duo desktop client that's installed inside of the RDP so it's say inside the server. So if you need to verify an application that.02:07:55You're loading from inside the RDP session or VDI session. This way you can take that like fish resistant trust you've already established and use that inside and it kind of works kind of like a member, a remembered device session. So it'll automatically sign you in once you're inside the RDP session, as long as you know the duo desktop clients install them.02:08:11Both, that feature is still early access right now, it's in preview, but you know it'll.02:08:31Yeah, we'll, you'll be seeing more from that, more of that here in the future. And that looks like all the questions we've had for right now.02:08:35So I'll pass it back to you Sam, to close this out. Thanks so much, Aaron, that was great. Awesome. Well, let's go to the thank you slide and thank you for everyone for attending this module. We're gonna go in a short break, and I believe we're gonna come back at.02:08:52Oh, at 01:25 eastern. Is that correct, Sheila? Or I'm sorry, 01:20 eastern. I'm looking at PST. Yeah. Cool. Fantastic. Fantastic. Well, then I will go ahead and end my video.02:09:12Oh and my voice and thank you everyone for being such great attendees.02:09:32Alright, how's it going everybody? Thank you for joining for module three, if you've been here since the beginning, I appreciate it. This was put together with my colleagues, Wes Miller and Jay Pearson. I'm Aaron Hart, customer success specialist with duo. And we're gonna talk about Cisco identity intelligence today and the visibility and insight that you.02:09:50Working game with that.02:10:10If you've been here since the beginning, you've probably are very aware that we're using Slido today to do the question and answer answer portion. So if you can, you know, continue to use that if you're just joining in, that should be on the right hand side within your Webex directly. And also if, you know, we're gonna have some polls here that pop up, so if you.02:10:14You'd help participate in those and give me something to read back rather than, you know, staring to the void. I would greatly appreciate that. So, let's go ahead and kind of ask some of those questions really quick here. Let me.02:10:34So the 1st one is what security concerns are top of mind for you and your organization?02:10:54And this is a very broad question I realized, so.02:11:19Okay, still in creds. Social engineering. Yeah, we we talked a bit about that today a little bit earlier as well with the the persona piece and the identity verification man in the middle, AI agents, that one's becoming a big, big issue as, as that progresses.02:11:30And, and yeah, fishing probably still one of the number one ways folks are being compromised today. Fish phishing looks like it's winning out there one more person typing, we'll let that go through.02:11:50Okay, all kinds of stuff there from on prem to, yeah. So, good info. We'll, we'll take that as well and can you go ahead and let's go ahead and grab the next question. So what tools are you guys using to detect and manage identity threats in your environment today?02:12:20Ice, we like to see the Cisco plug there in a sock.02:12:52CrowdStrike, got some defender in there as well.02:13:07Alright, and if you wanna go to the next one for me.02:13:31What would be part of your wish list if you were, you know, your protection with wish list if you would, like example here, like the ability to MFA legacy applications, like what are you trying to protect, and that's that's a struggle for you today.02:13:36PDI based workflows, we might have some upcoming stuff for you on that as well. Not so much in this demo or in this conversation.02:14:11But it's good to know.02:14:31All right. If we got one more coming in command line offs, so we're gonna talk about that today. So that'll be something that we're gonna touch on.02:14:42Briefly today, but we'll definitely kind of point that out and kind of what's in the works there or what's available from Duo on that today. So I'm gonna go ahead and jump back into my slide deck here. Wait 1 s.02:15:03So the on the agenda today, we're gonna talk about some of the the challenges around identity security, how Cisco identity intelligence can help deal with some of those challenges and the newest tool in the toolkit from from Cisco and duo, Active directory defense. So that's kind of the three.02:15:27The core pillars that we're gonna we're gonna speak to today. So when we talk about the challenges around identity security, the 1st one that comes to mind, at least for me is the limited visibility, right? We often have multiple different providers, multiple different pieces of infrastructure there, and oftentimes they're good at getting visibility.02:15:47Into themselves, but not really much else. They're not really centralized, you know, Microsoft knows a lot about Entra.02:16:07Google knows about Google, but it's not necessarily, you know, they're not really working in collaboration together to kind of give us any kind of insight. And that can also make the alerts and the other things that we get from those kind of noisy because there, you know, you could be either getting them from both or some from one and not the other. So it really tries to when we're trying to pick.02:16:13Make that picture of kind of full visibility, it can make that very difficult. One of the other kind of pieces is gonna be gaps in protection, right? So are, do we have a full MFA rollout across all of these different IDPs or different applications that we have? You know, do we have visibility into the fact that we do have coverage? Are we.02:16:33Using weak forms of MFA still, right? Have we been trying to get rid of SMS, e.g.? And do we know if we, you know, is, were we still using SMS and Okta or are we still using it in duo? And do we have a good picture of that landscape within our organization? And then also device trust. Do we know if, you know, the devices that are coming in are.02:16:53Trusted are they BYOD? Are they, you know, organizationally managed? Do we have a good grasp and do we have a good picture of what that looks like? And so kind of when we're talking about that total visibility piece as like administrators and things like that, it can be very difficult to kind of paint that picture, whether we're trying to put that together because, you know, we need.02:17:13To do some sort of compliance audit or we're trying to get the information together to do an RFP or for insurance or whatever that might be. Generally that means extra work in IT burden to go pull from those different systems, aggregate that information together. And even if we do have a tool that's around it, often.02:17:33Times it's kind of clunky and and doesn't work extremely well. And so this is kind of a deeper dive into that visibility. We kind of get a picture of these silos now, right? We have our on prem AD kind of siloed off. We have our cloud based identity providers, maybe entra, Okta and google, right? Kind of siloed off. And now we have these even additional sources.02:17:53Is like things like our HR system like workday, and AWS and GitHub also have their own IAM solutions and all of these kind of live on their own little island and kind of getting that picture together from all of them can be quite difficult. And that's the thing that CII does very, very well. And you may even say, well, I'm I'm putting all the.02:18:13Right into a sim today, e.g., and I'm getting all the, you know, I'm sending all that data and and that is true, you're probably pulling that in, but the one thing that CIA does extremely well is give context around that information. It it's able to give us context around what our users are doing, the behaviors, how they're using the applications, and.02:18:33The machines that they're using all in concert together to really give a 360 degree view of identity across the entire landscape as opposed to just points of data in time.02:18:53So if we kind of take a look at this picture here on the left, we have that kind of, you know, image of this is where we're grabbing the data from our identity providers, our HR systems, our applications, and all of that information's coming into CII, either event streaming or static data coming through. And we're doing two main things.02:19:06We're we're looking at posture. So we're looking at, you know, again, are, are there accounts without MFA? Are there doormant accounts that we are hadn't noticed? Are people overprivileged? Are there applications? Is there shadow IT kind of things going on that we're not aware of and giving kind of a unified view of that posture and, and then all.02:19:25Also an ITDR component or detection and response where we're looking at known attack patterns and things through telemetry to kind of surface things that could be problematic within the environment. And then on the right, we have the actual ability to take action on that information. So, you know, that could be sending messaging through platform.02:19:45Like Slack, Webex teams, directly to specific teams that need to know on that specific issue or it could be creating tickets in things like ServiceNow or Jira or in some instances depending on the platform, being able to do some mitigation and action right from within.02:20:05CIA itself. The one thing I would like to call out is, you know, Cisco has been working extremely diligently to try and unify and and kind of use our suite of products to give better access and telemetry across the entire Cisco security suite, and that's an ongoing process, but we're already doing that today.02:20:25With signals from secure access XDR and firewall.02:20:45So if we take a look at this picture here and it's kind of busy and it kind of is intentionally, right? Because data is kind of noisy. There's all these different points of data that are coming in and different things that are happening with our environment. And this is what we call the identity graph. It's the ability to take and kind of pull all that together and give.02:20:51A a real three 60 degree view of what's going on with a user in our environment. And, and so, you know, the identity graph is kind of the distillation of all of these points of data into kind of one kind of singular view.02:21:11And then the last part of the agenda that we're gonna talk about is that like I said, the new kit on the block that from from Cisco and Duo is Active directory defense. So we have two main portions of that. There's kind of like two pillars of that. The visibility and the intelligence side is kind of what we're gonna look at today. That's gonna be the, the mostly what we're looking for.02:21:25As in this demo, but I did want to call out the protection piece. Got somebody had actually mentioned it earlier on that there was one of the things they were looking at where we're able to insert MFA into legacy offloads and at the command line. So that is a feature that is available now, as far as the command line that is out now and you can kind of check.02:21:45That out. One of the newer pieces, I'll kind of go to this slide here to kind of give a picture of that. This might be how an environment is today, right? And, and CII is already really good at the top level here where we're looking at Okta, Entra and Duo or or whatever our IDPs might be out there. And, you know, generally they're using SSO and maybe SAML or OID.02:22:05See to kind of give access to our applications, we're already getting really good visibility today if we have CII set up into that infrastructure already. The newest piece that we've kind of added here is the identity intelligence piece, and this is in beta and you can try this out today where we're able to now bridge that gap and take the on prem.02:22:26Some information from Active Directory and get that into CII as well. So.02:22:45We're able to essentially, you know, kind of make that picture even stronger than we were before by kind of bridging that gap because most folks still have legacy on prem AD, even if they're trying to move away from it, there are still service accounts, there are still generally things that are going on on prem that we kind of lacked visibility into.02:22:51And then down here on the right at the bottom, we're talking about kind of the the MFA insertion piece, like I had mentioned before on the command line side, with that's available today with SSH PowerShell, SFTP, right? We can insert MFA into those flows from the command line. And then in alpha right now is where we can actually put.02:23:11MFA in front of right on the domain controller for NTLM and Kerberos authentications. So again, I'm not today I'm not gonna focus too much on that part and that part is pretty cool. We're gonna focus mostly on the identity intelligence piece, but definitely wanted to call those pieces out and make you guys aware of of kind of the stuff that's happening with Duo and Active directory.02:23:31The Fans.02:23:51So kind of going back to the identity graph here and kind of, you know, this busy slide, it really is just showing the example of how we're, we're taking and bridging that gap from on prem and adding that into CII. We're now able to look for dormant accounts on prem. We're able to look for service accounts that maybe, you know, haven't been used.02:23:52In quite a long time or remove overprivileged accounts and just really kind of fix those gaps that and that visibility piece that we were kind of lacking from the on prem portion.02:24:12So when we kind of started the module today and Sheila kind of kicked us off, you know, we kind of talked about how Duo was built as a security 1st identity and access management platform, right? From, you know, our easy and secure MFA that we kind of looked at and you guys are probably well aware of, but to things like device trust with trusted endpoints, a true.02:24:26New SSO solution with passport like it's it's bridging, you know, not only, you know, in the browser but multiple browsers and at the desktop and then passwordless and duo directory, but we're kind of bookending it here at the end with looking at the identifying risk and protecting against risk and and using the telemetry that we have within.02:24:46CII to really make this a full end to end solution for you for you all as duo customers.02:25:06So I'm gonna jump into CII now and kind of show you guys what that looks like. I will do my best to cover it. CII has a lot of stuff going on here, so I will try and cover as much as possible, but please feel free to ask questions in the Slido and we'll try and cover anything that I don't get to here.02:25:14And waiting for my demo environment here to load, of course, there we go. So I'm gonna take a little bit of a different tact here. So this is kind of where we would land if we had a fully, you know, set up CII instance. More than likely if you're here today, you may not have that already, right? So the 1st thing you're gonna do is actually.02:25:33Land in your duo admin panel and and provision CII. But once you do that, you'll, you'll land in CII and where you're gonna come is more than likely here on this setup page. And this setup page kind of gives you a step by step instructional list of kind of how to get started, right? It's gonna give you some information about what CII is. You're getting some of that from, from this.02:25:53Demo today. And then the 1st the next thing it's gonna ask you to do is to connect your identity providers. So this is where we're gonna pull in things like Entra or on prem AD or Okta to try and give, you know, CI the telemetry that it needs to be able to give you actionable insight. After that, it's gonna have you create your 1st target notification.02:26:13Right, so where do you want to send that information? That can be like in like we mentioned earlier, something like Slack, Webex or teams. It could be web hooks, any number of different things, and we'll kind of look at the integration list here in a little bit. And then there's a couple optional things you can do. One of them is flag certain apps as sensitive.02:26:33So if you know there's an app that you have that has a lot of PII and you want to make that app sensitive, you can kind of market as such so CIA is aware of that. We do have some auto discovery in that area, so you can turn that on and we will look for applications that we know may cover that, but.02:26:53Oh, my screen's really small for you. Let me see if I can fix that for you guys. Give me 1 s here, see if that's, let me know if that's a little bit better, Sheila. And then so and the last piece that it's going to like ask us if we want to do and if if you are a workday customer.02:27:10We have a native integration with Workday or you can bring, even if you're not, you can bring in your HR system in via CSV and give CII some again more context around your user there.02:27:30So when from here, if like I said on step two, we're gonna take a look at the integrations. This is quite a full filled out integrations page. You're likely, if you have this many integrations, I guarantee you CI is gonna give you some really good information here. But more than likely you're gonna come in here and it's just gonna have your duo instance, right? It's gonna be provision.02:27:43Automatically. So it's it's gonna essentially, you know, you'll have that and you'll probably want to add your 1st integration. So you come up here to the top, you'll click add integration, and you'll kind of see the providers up here, which are kind of the eyes and ears of CI. So these are the things, the places that we're gonna ingest the data from, right? So, you know, that.02:28:04Might be, you know, we, the 1st thing we might do is we might want to bring in our ontra instance. So we would click add integration and we're gonna have different information for these different integrations, but the nice thing is always over here on the right hand side, you're always gonna have the documentation for exactly how to do that. So, you know, you can come in here, click right here, and you'll be taken directly.02:28:23To the information, you're gonna have screenshots and really good guide on how to get those integrations added into CII. Again, similarly, it's gonna look a little different if we were gonna go add on prem AD as a shout out to Active Directory defense, right? But we're gonna have, you know, our open source script over here that's you.02:28:43Used for that, it's gonna link out to the GitHub with all of that documentation and information to to help you be able to do that.02:29:03Then going through that setup checklist, we want to set up a notification target. So again, that's gonna vary organization to organization that might be as simple as an email that you want to send those notifications to. It could be a Slack channel or a Webex or teams channel. It could be an Amazon SS3 bucket or even.02:29:11Something that can accept webhooks, we can integrate with as well. So, you know, that also could be our ticketing systems. So we have data integrations with Jira and ServiceNow, so if you, you know, there is.02:29:30Both of those are available and then our Sim integrations with Sentinel and Splunk. And then again we have our own API client, so if you wanna pull data out of CII and some additional stuff down here in email around mail Gun and send Grid and some shared signal stuff down here as well. But for most folks, your f your 1st couple flo.02:29:44Things are gonna be adding your, your, your eyes and ears here and then kind of, you know, where these notifications are that you want them to go.02:30:03Next we're gonna jump over kind of into some of the platform specific areas of CI. So once you've started to kind of ingest that information and pull it in, the 1st one we're gonna look at is users, and this is probably one of the most beneficial for most folks. It's, you know, this is essentially a phone book or a directory of.02:30:13All known users across all of the platforms that we've ingested. So if we're taking a look at like Alto here, we can see he came in from he he's in AWS, he's in antra, he's in GitHub, right? So we can kind of see where the sources of all of these are and get some, you know, really high level but good information across the screen here about.02:30:32You know, when they were last seen, you know, if they're trusted, what their trust level is and kind of just get an overall viewpoint from here. On the left hand side, we can filter all of this information. So maybe I just want to look at, hey, I want to look at my on prem users, I can click on my on prem integration here and I will pull up, you know, just the users that are in on prem.02:30:52Similarly I could do that with duo, right? And just pull in all of my duo users and kind of look at them as well. There are all kinds of things that you can do on this list on the left to filter by. You can look through groups, you can look by if they have MFA configured, there's a whole list of things that you can kind of filter by, but not only that, up here at the top, we can use.02:31:12This kibana query language if we want to, to kind of put in Kibana queries. Now, I will be the 1st to admit that I am not an expert in Kibana, so what I like is the AI assisted search. I can come up here and I can say show me users with week.02:31:32MFA in Okta, and so now I will get a list of users that have been pulled out. And so let's pick one of the users here and we're gonna pick Modio tall here and just click on him.02:31:49So now we're getting kind of, you know, that identity graph for a modio. We're seeing what is his trust level and we can kind of get some more information about how we get trust levels up here at the top, but we're getting, you know, a summary of the user, you know, how many login attempts he's had, how many times he was challenged with MFA, how many failures there were.02:32:10And kind of a record over time, right? If we see a really large spike here that could indicate either Armodeo is having problems or maybe somebody has access or is trying to get access to his account, right? We can kind of get some quick information there. On the left hand side, we're gonna see all of the cards for all of the places where he's being pulled in. So we can see he's being pulled in.02:32:29In from Okta and duo. And we can also see right here that week MFA was used to successfully sign in. It was kind of flagging that here, as well as over here in the authentication factor section, we can see that he was using SMS and which is we consider a week or low assurance factor, and you know for duo, he was using desktop authenticator, right? And that's gonna vary depending.02:32:49On the, on the user and and what we're pulling in. We can kind of get a snapshot of everything though his groups, the applications that he has access to, how many of those applications are unused, what are the most frequent applications, right? If we have ServiceNow or Jira integrated, we can get ticketing information. And then lastly, one thing to kind of.02:33:09Note here as well is.02:33:29CI is really good about aggregating the user and kind of putting these cards together, but maybe Amodio is an admin and he has an obscure admin account intentionally, right? And so there's NO way for us to really link that or know that. You can always come down here and search the user manually and you could find another user, e.g., if he had another account.02:33:32To that account, click it here and link that user and it would aggregate and correlate all of that information for that user to make sure you're still getting that full three 60 degree kind of picture of the user.02:33:52So, and that's just the overview tab. There's quite a few tabs along the top here, but most of it kind of just breaks down more of this in, in greater detail. So if we look at the activity law here, we're gonna get pretty much every piece of activity that we know of from any of those integrations that we're pulling in from, you know, whether or not that person was granted.02:34:03An application, they updated an MFA factor, you know, they they were user authentication via SSO. And the other thing that I really like about CII is almost all of these big fields are always things are always clickable and they always can kind of grant additional information about them. And it's gonna vary depend.02:34:22On the event what we have, but if we look at here, we'll see like anomalous behavior was detected on this specific thing. We can kind of view similar events to this, see this event in context, we can even grab the raw data out of here if we want to if we need to bring it somewhere else. So kind of really comprehensive list of kind of the full.02:34:42Activity of this user from within our our environment. Moving along into the network section here, this is gonna just give us, again, a really strong list of or basically all known networks that this user has kind of used our environment from. It's gonna give us these tags that you're gonna see a lot within CII, you know, with.02:35:02The new ISP or a novel ASN to us, is it coming from a tour exit node or a VPN? You know, whatever information that we can kind of glean from those IPs and kind of look at how many successful events and failed events came from these specific networks and really break that out by the source so that you can kind of get a good picture of how that.02:35:22That is happening within your environment. Similarly with devices, we're kind of getting a picture of all of the different devices that Emotio has used when he's tried to access, you know, things in our environment. How many times he's used them, what OS they're coming from, what integration, and just kind of again giving us a more detailed look.02:35:42At the specific activity or the specific devices that he's using to to do the activity within that environment.02:36:03With applications, we're getting a complete application overview of all the unknown applications that this user has access to. We're also getting a kind of quick snapshot as we kind of looked at earlier about what ones are used versus unused, right? So this can be really good for shadow IT kind of situations where we're not even aware of some of these applications.02:36:11Questions, but it can also help us maybe for licensing going, hey, you're only using three of your 23 applications, maybe there's some room there to kind of scale back some licensing on certain things if that user NO longer needs them. We can also kind of see how this user compares to other people in their department. So, you know, if he has three times as many.02:36:31The applications as other folks is in a, is a department that might be over provisioning, maybe they transferred departments from one to another, and maybe that change in their old access wasn't removed, and this can kind of highlight some of that as well. And the groups is just gonna show us every single group that we know of from the different integrations this.02:36:51Specific users mostly only they only has Okta groups. So it's kind of limited here. But again, we get that same kind of view of comparing and contrasting to other folks in the department. So if we see something that looks out of line, you know, again, they have doubled the the number of groups as other folks that could indicate that there's some kind of issue or overpro.02:37:11Provisioning on the account. And then lastly, and we'll get into Chuck's a little bit more because they're very.02:37:31Critical portion of CII, we can see what checks this user is failing. And as we know, he was failing week MFA was used to successfully sign in because we saw that. But this will list all of the kind of problematic things that we know about with this account, where they have failed to check and maybe things that we need to kind of look in.02:37:37Into with this specific user. We can also take some action within CII itself. What you can do here is dependent on your integration list. Not all integrations have the same exact features, but we could open a ticket if we, again, we have ServiceNow directly from here and kind of give some content here and create a ticket.02:37:57Directly from here or, you know, we might be wanting to send refresh the user data because, you know, even though we're bringing in the data consistently, we might want to get the clearest, most concise picture of of the snapshot in time and kind of pull that information and it'll tell us, hey, we're going to refresh it. It's gonna apply to these two.02:38:17Integrations where we're able to refresh this data kind of more in real time.02:38:37So moving from users, and I know there's a lot in here, so I'm trying to go through it. Applications is, is going to look very similar, but again, this is more of just giving us an entire application inventory within our environment. We still have our filtering over here on the left hand side, so, you know.02:38:42We're able to filter by the source that it's coming from. If we just want to see what applications e.g. we have coming from Okta, we can kind of filter on all of that. Again, we still have the kibana query language at the top that we can use. And then as I had mentioned earlier, this is where we can also flag our applications as sensitive. So if, you know, maybe for us, you know, we, we.02:39:02Know workdays is sensitive, but maybe we need to add crossbeam, we can kind of add that toggle here and give CII that information to say, hey, we need to pay attention, this is a sensitive application. We can also kind of get an idea of the utilization of the applications within our environment. If I filter by logins or sort by logins here, you know, we can see that this is our.02:39:22Like most logged into application, you know, how many people are assigned to that application? How many people are actually using it and unvive versus unused and like our overall percentage of utilization here. So this can be a really good way for us to kind of get an idea of how our employees or how our work, you know, people within our environment are actually using applications.02:39:42What they're using the most, what maybe is kind of going unused again as we're kind of looking for maybe opportunities to find things that, you know, are over licensed or over provisioned. It can be a really good resource for that.02:40:02And then moving into devices, similarly, it's kind of an inventory of every known device that we have with from all of these different sources that we've pulled in from CII. So we still have our filtering, but you know maybe there's an upcoming pending iOS update where we know that there's gonna be a change on some.02:40:17Machines that are are OSs that are gonna be end of life, which is actually happening here shortly. So, you know, maybe we need to get our hands around that and see how many people in our environment, you know, are on old versions of iOS. We can kind of come in here and filter out for that and try and get, you know, and export that list out and kind of, you know, make a.02:40:37A targeted plan to try and make sure that we can assist those users or get them a different authentication device or whatever that might need to be.02:40:57And then the last piece on this kind of section that we're gonna talk about are, are non human identities, right? So our service accounts are kind of shared mailboxes, and now even if you're not dealing with it yet, you will be like MCP and egenic AI applications, right? These things never really sleep they.02:41:06We often sometimes kind of get forgotten about, they get set up especially agenic AI, it moves so fast, these agents are gonna pop up and then, you know, they're going to change and just trying to really make sure that we have our hands around where these are, that they exist, and, you know, if we need to unprovision them, you know, make sure that they're actually.02:41:25They're, they're being rotated, their password and their API keys are being rotated as well as it's gonna surface things like our our break class accounts and and those types of things. Again, we still have our filtering on the left where we can filter by those types. So if we wanted to just look at our agentic apps, we could do that. But again, this is.02:41:46Just kind of a place for you to go for those service accounts, those non human identities to to kind of separate those out so that they're not just dumped in with the rest of your users there.02:42:05And then the other piece that I wanted to take a look at with you guys today, again, this is kind of where the heart and soul of CII is, and we kind of mentioned it earlier when we looked at the user who is failing using weak MFA to successfully sign in or the checks. So this is kind of what we do with all of the data, right? So we're, we're we're talking.02:42:16Thinking about getting all this data into CI, we want to pull as much information as we can, and this is why. These are kind of what we're comparing to against to look for things like posture. So we kind of can see right here where we have kind of a score, so we're at like 50 % with on our NO MFA configured check, but you know, we have a vast.02:42:36List of different checks. And this is kind of where you and your organization will kind of have to go through this list and decide what is important for us to surface here and what are we interested in? Obviously if you don't have Okta, e.g., Okta session login policy compliance is probably not something you're concerned with. So you can toggle these on and off.02:42:57Here within the checks panel itself. And then if we take a look at like our NO MFA configured check, e.g., every check when you come into it will have the details about what that check is doing up here at the top. So in this instance, it's pretty self explanatory with their NO being NO MFA configured, but some of the checks might be a little bit, you know, more.02:43:16More confusing and this will kind of give you more detail into exactly what that what that check is looking for. And then not only does it do that, but it gives us our recommended actions, right? In this instance, it's going to probably be to MFA that user, but then we also get our compatibility here. So this will tell us which which integration.02:43:36Questions that this specific check is compatible with. So, you know, we can see Entra, Okta Duo, google, and GitHub here. This is all looking at at that. And then we get our list of failing users. We can click through these users directly. We can download a list of these users, and kind of, you know, create a plan from there to kind of how do we address this specific.02:43:56Check how do we remediate it? Up at the top, you'll see the check settings. All of the checks will have different variables because they're all doing some things that are a little bit different. So some of them will have some customization, like for instance, if you know that your HR folks bring in people 30 days early and they onboard.02:44:17For their accounts, you probably don't want a 14 day grace period. So you'd come up here and you might want to bump this up to like 30 or 31 days so that the user's not getting caught in this check because they're basically gonna fail it from the jump, right? This is also where we can kind of set notification settings, so where do we want this to go? Do we want it to go to an Okta workflow? Do we want to send it to a Slack channel or.02:44:36For an S3 bucket, right? Kind of we can determine which check needs to go where to kind of decrease that noise that we were talking about earlier, you know, not everybody needs every alert, so you can kind of tailor the alerts to go where they need to go so that the folks that actually need to do the remediation are the ones that are being notified.02:44:56And then we get some additional users, right? Or information here about who else failing the checks. We also get a per integration failing, so we can see here it's mostly in Okta this is failing, so we might need to, you know, engage the folks that we're, you know, working with over there to make sure that, you know, we come up with a plan as to, hey, why, why don't we have this many.02:45:16Why do we have so many users without MFA in this specific integration, and this could be any integration. It really, it just gives us that information. And then the failing users per type can be extremely helpful too. Say these were all external users that were failing this. It might give us a real indication that we need to get on our vendors and make sure our vendors are.02:45:36Using MFA, right? And make sure that that we have.02:45:56A good plan around how to do that. So again, the checks are kind of what everything kind of hinges on here. That's what we're notifying on. We can add those kind of, again, those channels directly here as well from when we're kind of turning those checks on. But this is kind of the critical portion where you guys will.02:45:59Want to go in and kind of decide what's most important to you. And in the beginning you may start with one or two of these and just try and kind of, you know, not eat the entire elephant in one bite and kind of work through and remediate a check as you, you know, you kind of see fit to try and get that security posture up over time and kind of work through where you.02:46:20We may have problem areas.02:46:39Then here as well on the left, we have our report section. So this is kind of going to, all of these are downloadable from right here so we can grab a CSV. We can also add these directly to those notification targets so we can have those kind of auto sent to those notification targets. And we can also filter these, right? Like our risk and compliance folks are probably.02:46:43You're gonna be most interested in these kind of risks risk and compliance reports. Whereas, you know, IT ops and costs are probably gonna be looking at things like Microsoft license utilization, right? So we can kind of also tailor these reports, automatically send them out to where they need to go or we can come directly in here and grab them.02:47:03As well. So we're kind of gonna go full circle now and come back to where we started and land on the dashboard. So, you know, this is kind of the intuitive way you probably would have started in CII, but this is you know what it will look like if you have all of your integration.02:47:22Spun up and you have your information coming in. We're going to get our posture dashboard on our identities, and that's gonna give us a a real quick snapshot of how we're doing across our identity environment. So, you know, what is our posture score? And not only is it gonna give us a score, but it's gonna give us recommended actions to take to raise that score, so how we can increase that post.02:47:42Posture. It's gonna give us things like our trust level per users, risky user distribution, where our administrators are logging in from, where the source of most of our users, and this environment happens to be okta, right? We can kind of get an idea of where most of our identity is happening within our environment from this as well, as well.02:48:02Well as inactive accounts, you know, overall kind of login, just all the kind of information on the posture side of the regular user identities within our environment. Similarly, the non human identities portion is gonna focus just on that, the the service account, the AI agents, all of that kind of information and kind of distill that down into kind of a.02:48:22Report card. I should mention all of these are downloadable by PDF as well. So if you have to present this for whatever reason, maybe you do have to do a compliance kind of meeting or you have to do something you're putting together for an audit or any number or maybe you just need to present to management, right? This can make that much easier for you to do and also give you a way to try.02:48:42Back that over time. So if you have that historical information, you can look at your PDF that you did, you know, in March and then look at it in April and make sure that you're making progress across that as well as you're kind of presenting that information and going through these. Our MFA posture again is our MFA overall MFA hygiene. So, you know.02:49:02How many play where do we not have MFA configured? Is weak, where, how many times are we seeing weak MFA being used? Are accounts that, you know.02:49:22Or never have logged in accounts that have also have NO MFA on them, right? We're getting kind of all of those kinds of things as well as, you know, the MFA threat section over here. If we're seeing any MFA flood or any of that sort of thing, it'll be surfaced over here. We can get a picture of our enrollment with MFA overall over time, as well as our foo.02:49:32Factory usage and kind of the insurance level of those factors. So how strong they are, right? Like are we mostly in the green or are we mostly in the red and kind of getting an idea of how folks are actually using MFA within the environment? It also will give us a snapshot like we were talking about earlier with passwordless. We can kind of check our passwordless enrollment and adoption.02:49:52And over and make sure that that is on track. And then our sensitive applications as well. We're tracking that information.02:50:12Devices. Similarly, we're getting kind of a report card here and I'm trying to speed up on my morn a little bit out of time, but we're looking at orphan devices, the stale devices, devices that might be outdated or need OS updates managed versus non managed devices. Operating system use.02:50:21Right just kind of that overall picture that we would expect from the devices. And then similarly on applications, we're kind of looking at entitlements, so this can be really helpful again when we're looking at things like over provisioning or SAS sprawl, where we're trying to make sure that, you know, we're not provisioning users into applications that they don't actually need to have.02:50:40And that's the posture dashboard. We also have a threats dashboard that's going to focus exactly on that. Things that we might see as threats within the environment. And if you scroll kind of down to the bottom, you'll see the insight and unusual activity, right? These are the checks going back to that that are are being kind of referenced here to kind of.02:51:00Aggregate this data. So this is gonna give us kind of more of a threat picture. We have our compliance dashboard that's gonna be kind of more geared towards those compliance folks and they can just download all of these kind of this kind of report right here as well. And then operations is just your integrations, so this is just how things are set up within CII.02:51:20So if there are any of the integrations were broken or anything like that, we would see that here. And then last but not least, the kind of ISA report, the overall IAM hygiene kind of a little bit of all of that kind of put together in kind of a picture to kind of give you that that kind of ISA picture about, you know, your user.02:51:40Just the status, active accounts, MFA analysis, a little bit of everything kind of thrown in as well as kind of the threat insight here down here at the bottom.02:52:00Alright, so that is about as much time as I think I have to cover on that, that there, again, there's a lot to go through in CII. I'm gonna jump back over to the deck real quick here, but what I'd like you to take from it if you don't have CII today, is that it's really easy to set up from, from.02:52:11Duo perspective, go into your admin panel, light up that integration. It's easier than ever to set up now with Duo SSO especially with Duo directory is being available to you, even if you don't have another off source set up for duo SSO, you can spin this up. If you're in advantage or premiere, you have access to this today. If you're not, if you're on free or essentials, you know, I think.02:52:30Think they're gonna talk a little bit later. Maybe there's a the you can light up a trial to go ahead and give that a shot and kind of see if you, you know, what kind of information you can glean for your organization. But then we're just gonna kind of go back to that setup list, right? We're gonna bring in the integrations that we want to have access and insight into. So that's, you know, the most important piece. Let's bring in the online.02:52:50The on prem AD, whatever other IDPs that you might have so that we can give CII that information and then take a look and review through those checks and find out what's relevant to you. Pick one to remediate, you know, pick one to go through, start to finish, to try and fix within your org, and and just kind of work through it and you let see.02:53:10Yeah, I hope you track the progress as you're going through it. And then make sure you set up your notification targets so that if you, you know, once you get that remediation piece done, it's a lot easier as, you know, to handle one or two of those issues as they pop up once you've kind of gotten the bulk of that remediated for those teams to be able to keep on top of a one or two user.02:53:30Issue and and kind of, you know, address that problem.02:53:50Alright, so that's my CI spill. I'm going to pass it over now to my coworker here, Wes and let him do some question and answer with you guys. Thanks Aaron. Great work.02:53:55Yeah, my name's Wes. I'm also a CSS on CX and we're gonna go through the live Q and A So we did get some questions come through as Aaron was going through his presentation, so we're gonna run through those real quick. How is CII licensed? So CI is provided with all advantage and premier, account entitlements, so if you.02:54:10You have advantage or premier editions of duo, that is already part of the entitlement, so you just basically have to go in and enable it as Aaron alluded to in his presentation. There are some more detailed specifics around count license counts and that sort of stuff because I'm sure somebody's gonna ask the question, well, I have more users in.02:54:30Entrail or AD or some other IDP source than what I have in duo. How is that accounted for? You know, we did provide that documentation in, in the the Q and A response, but largely it's not a big issue. We, we, we do account for that, but, you know, the account team will work with you to kind of sort any of those issues out if we do have any other.02:54:51Those issues.02:55:10And then we did have a couple of very specific questions about a tech support, kind of related issue in regards to CII. Unfortunately those issues I think we need to continue working with the duo support and Microsoft support on that. That five oh three error message is a generic error message on the microsoft side of things. So we do need to continue working.02:55:13On on duo with Duo and Microsoft support to kind of sort out that issue.02:55:33Let's see, thought I just saw one come in, so there were some questions in regards to.02:55:43To Reset password remove groups from user profile and locking users. So those are very specific to the specific IDP that are being com that the user's imported from. So there are some capabilities around resetting MFA for a user and that sort of stuff, but like.02:56:03Password reset, e.g., is not something that's done through CII that's done through the IDP itself. So e.g., if that's like a an entra or an AD user, you'd have to go to entre AD to do that rather than using CII to do that. So CII does have the ability ability to like reset MFA, and quarantine the user.02:56:22But again, that's dependent on the IDP, so we'll also provide a link for the documentation on that as to like what capabilities we have for each IDP because that's gonna be different for each IDP.02:56:42Okay, and here's one. How does CII help my team proactively manage identity drift and prevent potential breaches within our active directory environment? So CII provides a continuous visibility by running automated hygiene checks and surfacing.02:56:55That identity drift, the phenomenon where users user permissions and configurations deviate from secure baselines over time. CI detects active directory misconfigurations and reports on premise compliance by identifying these gaps such as orphans accounts or village users.02:57:12Before an attacker does security admins can remediate vulnerabilities and harden the identity infrastructure. Alright.02:57:29Yeah, feel free to to keep posting questions. We've got time if there's any other questions in regards to CIA.02:57:46I'm seeing any more come in.02:58:06Now here's one. Can I select which checks will be applied to my environment? Yeah, there's some, you have the ability to, to determine what checks you want in your environment, which ones you don't. And when you go to that check in the upper right hand corner, you have the ability to modify a check or disable a check.02:58:18So yeah, you can totally do that and we'll also provide the documentation for that as well.02:58:38Are there any other questions? Does CII detect AI agents? That is a good question.02:58:55I would say that, look forward to some RSA announcements in regards specifically to that, but I think there will be some capability coming to do that.02:59:12And outside of that we we do have the capability.02:59:32To kind of detect non human identities. So there is, what we will see as non human identities within, within CII, so we'll, we'll provide the documentation for that as well, but that's beyond just AI agents. So that could be like a service account.02:59:38Or something like that. There's also a set of checks that come along with that, so very similar to like a normal user check, but we have specific non human identity checks as well.02:59:57Just Wait to see if we get any other questions.03:00:32The CI work with other Cisco products to affect overall workflows. Yeah, so I think Aaron mentioned that we do integrate with other products such as XDR, ICE, secure access, et cetera. Yeah, Aaron, Aaron mentioned that in the, in the slide deck as well.03:00:41Alright, well we're gonna give you guys about another minute if there's any other questions you guys want to ask, in regards to CII.03:01:18Oh, I'm not getting anything, so I think we can go ahead and and kind of close it out there and we'll, we'll pass it back over to, to Aaron.03:01:38All right, thanks Wes. Yeah, so, appreciate you guys listening to me talk about CII for the last little while here. I I very much appreciate it. I think next I'm passing it over to Derek and he's gonna kind of do this series wrap up with you guys and kind of talk about a little bit about all of the stuff that we talked about today.03:01:58I mean we might take a break here. I'm just double checking to see if we're going directly into that or if we're gonna take a little bit of a break. Nope, we're gonna come straight to the.03:02:18And Jay? Okay, as we wrap up this webinar on behalf of our entire team, thank you all for joining our series today on identity protection with Cisco duo.03:02:38So we hope these technical insights provide a clear path forward for your implementation. Please be sure to check the resource links and the Q and A's and from this webinar presentation to start applying these strategies in your own environment. We started off our session with module one.03:03:00One to dive into how to protect your users and environment with duo.03:03:20Going over several different user syncs, all the different implementation options to help easily manage your workforce, from Duo directory all the way to different external identity sources, then reviewed the flexible user enrollment policies to cover any user's.03:03:25That is deep dived into user enrollment workflows and finished with our new duo identity verification feature set to help add an even stronger identity assurances during your critical user verification requirements.03:03:44We then jump to module two to explore Duo directory as your IDP going over technical insights into what this looks like with dual SSO applications, dual directory core features that opens the doors to really true passwordless experience.03:04:03Customizations with our user attributes and user provisioning, which includes SCIM, which is a system for cross domain identity management, which we support both outbound and inbound skim, and the power behind our routing rules to help even, you know, the most common.03:04:20Flex identity environments thrive under Dual's protection.03:04:40Then our last module we explored the comprehensive visibility and insights that our Cisco identity intelligence can bring as our premier identity threat detection and response platform to defend against identity based threats.03:04:45With most breaches involving identity, Cisco identity intelligence can bridge the gap to offer valuable insights into all your identity sources such as Duo, Microsoft, Salesforce, Slack, and many, many more.03:05:01All of the fine folks to help bring this webinar series to you today are really a part of our dual care signature customer support team. These are your technical customer success specialists which play a vital role as your technical security advisor under our signature customer support tier.03:05:24Part of the dual care signature support package unlocks a dedicated team, which includes our partners from our strategic customer success specialist side to help project plan and manage your deployments alongside our technical team.03:05:45Which brings the expertise in implementation strategies, security best practices, subject matter experts, and advisement through regular syncs with your organization's team as well. This tier also includes and unlocks priority ticketing SLA, a dedicated v.03:06:01The IP line with 24 by seven phone and email support just to name a few benefits.03:06:21So dual care signature customer support is actually a part of our overall Cisco trusted support offering structure, which is structured around three models. We also have standard support for a more reactive support if you want to target specific products to focus on foundational support structure and enhanced support, focus.03:06:31Focusing on quick resolution from our foundational foundational tier over a time bound engagement on specific use cases to help support your team.03:06:51And then lastly, as you've heard me talk before, signature support, which is where dual care services sits, which is our high touch and customizable engagement here, which offer all of the standard and enhanced offerings at an accelerated level, including all of the bullet points I mentioned.03:07:01On the earlier slide.03:07:21If any of these support models interest your team, you can get in touch with your Cisco account manager or Cisco account executive to get more details and how to begin using these services.03:07:24We wanted to also mention our self initiated free trial workflow for organizations who are on a lower tier.03:07:44That would, you know, like to test and run pocs for instance on any of our advanced features which we've discussed during this webinar. You can self initiate up to two times a year, a 30 day trial to advantage or premier edition as an administrator of.03:07:52Of your duo tenant.03:08:11This allows you to quickly and easily access our advanced products to make an educated decision on your security choices and offering with duo. And this is at NO added costs to the trial and after the trial ends and you decide to go back to your previous tier.03:08:14What action is needed as your attendant will revert back automatically?03:08:34To begin, you will go under your billing tab on the left pane of your admin panel and you would choose try it free for the edition that you would like to choose, and then you would click start your trial. Once you start the trial, it will open up a form for you to complete along with.03:08:39Some of the the different links of.03:08:58Towards documentation to help make your decision on which edition you would like to trial So we will now begin the final series Q and A.03:09:02Which you can ask our experts any questions you may have missed or have been holding onto since the 1st module or if you took, you know, that extra coffee or donut break in between, we will be using Slido to answer your questions as we have been throughout the webinar.03:09:20You should have the option within your Webex to open up Slido if it's not open already. And then if you wanted to join directly, the information is on the screen here. Let's start with the 1st question that was tabled from module two, I believe around automating deploy.03:09:38Deployment for duo on servers.03:09:58I believe I will pass that to Aaron Wolf to help summarize that particular question. Yeah, thanks Derek. So the question I was asked was when deploying Duo on servers, I can encrypt the integration key in secret keyboard running the encryption command after the off proxy is configured. Is there a way to deploy Duo across large environment with Duo for Windows and duo?03:10:02So Auth proxy configured along with handling the encryption automatically using GPO. So I'm gonna split that into two. Deploying Duo for when logon, that's an MSI that can be deployed and configured by GPO and we actually have a full guide for that. I'll repost this question in the Slido so you.03:10:22You can get the link for that. 2nd part is deploying the off proxy via GPL.03:10:42So that's a bit tougher. So that can technically be done with custom scripting, but there are concerns there you're gonna wanna keep in mind. It's also not something we generally recommend at least going and scripting it fully. The reasoning is, the do all proxy, it doesn't have its own GPO template. It's instead.03:10:48Figured the configuration's helped in an Ini file, and usually that's configured using the authentication proxy manager. But if you're deploying multiple off proxies, you can copy that file from server from.03:11:08The issue is, is when that when you run the encrypt command to encrypt all your, your, your application secret keys and then all your passwords in that, it uses a private key that's associated with that server directly. So those encrypted keys.03:11:21Do not copy, you would have to run that on each server individually.03:11:412nd security concern I would have is if you're trying to deploy this, deployed like, you know, a dozen or so off proxy servers or however you want to deploy it, you're not gonna wanna store, we definitely highly recommend storing an unencrypted version of that file.03:11:46Because the secret keys are stored in plain text in that case, and not encrypted, I wouldn't recommend storing that at all. So, the way if you're going to deploy it by GPO, you can script the install and install it that way but an admin still should follow up afterwards, put in those keys and passwords.03:12:04Just test the configuration and then run the encryption to close that out.03:12:24Just like someone else asked what happens when I enable features after the trial expires? It will go back to your existing edition. So essentially the policy stack that's there, it will go, let's say you enabled an advantage trial and you're on essentials, the advantage policy stack will essentially disappear. So you will run as if those policies.03:13:01Did that exist?03:13:21Thank you, Aaron. We'll keep up the series wrap up Q and A for a few more minutes, so any questions again that you maybe holding onto, feel free to ask now.03:13:40Okay, so.03:14:00Silence is golden sometimes, so we can move forward. The, the Q and A will still be open, but I will just forward along a few other information that hopefully will be helpful for the.03:14:19Audience here. So we do hope that this series has helped you learn more about your dual environment. However, if you need additional resources, we have those two. We have a plethora of documentations available publicly along with our Cisco community page, different duo webinar events past, present, and future.03:14:34As well as many links to resources directly from your admin panel.03:14:54As you can see here on the screen, as we close out the series, we really do strive to make sure that these sessions are useful for all who attend, and we'd like to request your feedback on a quick six question Slido questionnaire.03:14:58To help ensure we continue to improve these sessions in the future. As a thank you, I promise this is the last slide you will see for this webinar, along with Slido's. And then lastly.03:15:16Which also comes with my last promise that this is the last slide. We have a post webinar, ask me anything which is already open and you can start asking questions for anything you may think of about your duo tenant, which will be open for the next ten business days.03:15:37Our experts will be monitoring this AMA forum to help bring even more answers post live webinar sessions and then we will also share the link and you can also scan the QR code here on the screen if you wanted to get to that URL quicker.03:15:54Thank you for being part of this technical series. We hope this session has been valuable valuable and helping you optimize your workflows and we really look forward to seeing you again in our upcoming installments.03:16:14