Cisco Cyber Vision New UI Administration Guide, Release 5.6.0

PDF

Cisco Cyber Vision New UI Administration Guide, Release 5.6.0

Duo integration with CV SRA Plus

Updated: September 8, 2026

Want to summarize with AI?

Log in

Enable automated device posture checks with Duo integration to ensure only compliant devices access critical OT assets.

Secure OT access with Duo device posture checks is a security approach that enforces device compliance before granting access to Operational Technology (OT) assets.

  • Automates system posture checks using Duo integration.

  • Ensures devices meet security requirements prior to OT access.

  • Protects critical OT assets such as PLC, HMI, and robotics software from unauthorized access and lateral movement.

Risks of weak security posture and benefits of Duo integration

Standard workstations used for diverse tasks are vulnerable to unauthorized access if not properly managed. Weak security posture can expose sensitive data, create entry points for lateral movement, and endanger critical OT assets.

  • Exposure of sensitive data

  • Entry points for lateral movement into remote networks

  • Endangerment of critical OT assets (PLCs, HMIs, robotics software)

To mitigate these risks, integrate Duo to enforce device posture checks before granting access to OT assets.

  1. Integrate Duo with your access management system.

  2. Configure automated posture checks for devices.

  3. Grant access to OT assets only if device meets security requirements.

For instance, when a user attempts to access a remote PLC through the CV SRA Plus method, Duo verifies that the workstation has up-to-date security patches and endpoint protection. Only compliant devices are allowed to connect, reducing the risk of unauthorized access to critical OT systems.

How Duo integration works with CV SRA Plus

Duo integration with CV SRA Plus ensures that only devices meeting security posture requirements can access sensitive OT assets remotely.

  • Only devices that satisfy Duo security posture policies can access sensitive OT assets using CV SRA Plus.

Summary

The following are the key components and actors involved in the Duo integration process with CV SRA Plus:

  • SRA System Admin: Configures Duo integration with CV SRA Plus and manages policy requirements.

  • Duo administrator: Maintains Duo settings and policies.

  • Duo authentication service: Assesses the security posture of the user's device and provides access status.

  • End user: Attempts to access remote OT assets through CV SRA Plus.

This process ensures that only compliant devices are granted access to OT assets through CV SRA Plus by enforcing Duo security posture checks.

Workflow

These stages describe how Duo integration with CV SRA Plus enforces device security posture before granting access to OT assets:

  1. The SRA System Admin sets up the Duo integration and policies.

  2. The end user activates CV SRA Plus access for a remote session.

  3. Duo evaluates the user's device against defined security posture requirements.

    • If the device passes, the Duo indicator turns green and enables CV SRA Plus connectivity.

    • If the device fails, the user receives an error message, and access is denied.

  4. Users can review Duo session details for compliance feedback.

  5. If Duo integration is not enabled, posture checks do not occur, but CV SRA Plus access remains available (without posture validation).

Configure Duo external integration with CV SRA Plus

Enable posture-based device security checks for users accessing OT assets through CV SRA Plus by integrating Duo.

Use this configuration when you want CV SRA Plus to enforce device posture checks for remote access. Note that Duo integration for user login and SSO follows a separate process.

Before you begin

  • Ensure you have a Duo Admin account and the unique URL for your Duo environment.

  • Confirm you have access to the CV SRA Plus instance as a System Admin.

  • Verify that Duo policies exist to enforce security posture checks for remote OT asset access.

  • The integration process applies only to CV SRA Plus sessions—not to system login.

  • To evaluate the solution, you may request a free 30-day Duo trial compatible with IoT OD at Duo.com .

Procedure

  1. In your Duo Admin account, create a new Web SDK application for CV SRA Plus.

    • Select Applications > Protect an Application.

    • Choose Web SDK and select Protect.

  2. In the Duo Admin dashboard, rename the Web SDK application to "CV SRA Plus".

    • Go to Applications > Web SDK.

    • Under Settings, update the Name field to "CV SRA Plus".

    • Click Save.

  3. Locate the integration key, secret key, and API hostname for the CV SRA Plus application in Duo.

  4. In the CV SRA Plus admin console, enter the Duo integration key, secret key, and API hostname in the Duo external integration section.

  5. Apply and save the changes to complete the integration.

Duo integration with CV SRA Plus is enabled. Device posture verification is now enforced for all users accessing OT assets through CV SRA Plus.

What to do next

  • Test the integration by initiating a CV SRA Plus session and confirming that Duo posture checks are applied as expected.

  • Adjust Duo policies or CV SRA Plus settings as needed.

Configure CV SRA Plus policies in Duo

These policies determine which devices can access OT assets through CV SRA Plus.

Before you begin

Procedure

  1. In Duo, go to Policies .

  2. In Custom Policies , click New Policy .

  3. Enter a policy name.

  4. Configure these policy settings for CV SRA Plus users:

    • Authentication Policy : Select Enforce 2FA (to enable device posture checks).

    • User Location : Allow chosen countries ( No Action ), deny all others ( Deny Access ).

    • Device Health Application : For Windows, require the app, firewall, and system password. Block access if an endpoint security agent is not running.

    • Operating Systems : Allow only Windows devices .

    • Networks > Authorized Networks: In Allow access without 2FA from these networks, enter 0.0.0.0-255.255.255.255 to disable 2FA for CV SRA Plus.

    • Click Save Policy .

  5. Go to Applications in Duo and select the Web SDK application for CV SRA Plus.

  6. In the Policy section, click Apply a policy to all users .

  7. Select the new Policy from the drop-down menu.

  8. Click Apply Policy .

  9. Click Save at the bottom of the page.

Devices are now evaluated against these policies during CV SRA Plus posture checks.

Enable Duo integration in CV SRA

Link CV SRA Plus with Duo to enforce security posture using Duo integration.

Before you begin

  • Have Duo Client ID, Client Secret, and API Host information ready from the Web SDK application.

Procedure

  1. In the left Service panel, navigate to SRA > System Management > External Integrations.

  2. Click Add External Integration to open the Add External Integration panel.

  3. Choose Duo from the Integration Type drop-down list.

  4. Enter an appropriate name and a description.

    Note

    Switch back to Duo and choose Applications > Details to retrieve the Client ID, Client Secret, and API Hostname. Beside each field, click Copy (the lettering switches to Copied), then switch back to CV SRA and perform a paste in the appropriate field.

  5. (Required) Enter the Duo Account Settings from the CV SRA Plus application created in Duo:

    1. Paste the Client ID (Alphanumeric Duo application key).
    2. Paste the Client Secret (Alphanumeric Duo application password key).
    3. Paste the API Host (API server that validates the login request).

  6. When finished, click Add Integration (bottom right). The Enable External Integration prompt opens, stating that enabling the new integration record will disable any previously enabled Duo Integration. With the Duo integration enabled, you can now activate CV SRA Plus with the integrated Duo posture check.

    Note

    The external integration for Duo allows adding multiple Duo accounts to CV SRA Plus, for example, for troubleshooting purposes. But only one Duo account can be chosen as Active in CV SRA Plus at any moment.

Duo integration is now live and ready for enforcing posture checks on CV SRA Plus sessions.

Verify the CV SRA Plus and Duo integration

Ensures posture enforcement is ready and functioning.

Before you begin

  • Complete all prior configuration steps.

Procedure

  1. In IoT OD, from the left pane, choose SRA > System Management.

  2. Click the External Management tab.

  3. Verify that the Duo integration is Active .

What to do next

CV SRA Plus and Duo integration is verified as active and posture enforcement is functioning correctly.