The MFA Challenge & Cisco Duo

Ascend Technologies has previously written about the benefits of Multi-Factor Authentication (MFA) for securing resources. Many use the Microsoft Authenticator application, which provides a nice user interface and is beneficial for a variety of use cases. In 2020, our experts worked with many clients to secure remote access to the environment by implementing Microsoft’s MFA on their Cisco AnyConnect VPN. But another option available is Cisco DUO.

Cisco Duo MFA

Cisco Duo provides a user-friendly experience much like Microsoft Authenticator, but also provides several additional capabilities. Duo gives you the policies and controls you need to limit access easily based on the device, endpoint, or user risk. For example, in cases where there are domain-joined or otherwise suspicious device logins, users could be MFA-prompted via automation. This is the frontline worker use case that makes logical sense for network users.

Ascend is very aware of the increase in compliance and insurance standards that may require you to expand your utilization of 2FA or MFA. The Cisco Duo solution goes beyond securing a Microsoft cloud application or VPN by meeting security compliance standards for:

Laptop or workstation MFA
Server Remote Desktop Protocol (RDP) MFA
On-premises switch access via Radius and MFA

Cisco Duo offers full-featured two-factor authentication with:

Protected logins with Duo's MFA
Insights and overviews of device security hygiene
Management of Duo's solution with Admin APIs
Duo's secure Single Sign-On (SSO) providing a consistent user login workflow across applications
Protected access to both on-premises and cloud applications

Cisco Duo Access

Upgrade to Cisco Duo Access which includes Everything in Duo MFA, plus:

Essential access security suite to address cloud, Bring Your Own Device (BYOD), and mobile risks
Complete visibility into both mobile and desktop devices, including corporate-managed and unmanaged (personally-owned) devices to support BYOD policies
Mobile device breakdown with visibility into enabled security features and tampered/unencrypted devices
Detailed device insight
Enforce rules on who can access which applications, and under what conditions (adaptive authentication)
Notify users to update their devices based on device access policies
Full-featured dashboards for compliance audits and ease of administrative management

Cisco Duo Beyond

Take it further with Cisco Duo Beyond which includes everything in Duo Access, plus:

A zero-trust security platform that addresses user and device risk for every application.
Get visibility into BYOD - detect if devices are corporate-managed or unmanaged (personally owned)
Enforce a policy to allow only managed devices’ access to sensitive applications
Provide modern remote access to multi-cloud environments (on-premises, Azure, AWS, Google Cloud Platform) while enforcing zero trust security principles

Ascend Can Help

Duo supports a variety of architectures for authentication, and on top of that, we have a team of experts who can assist your team with tool implementation and management. We help integrate the technology into your environment seamlessly and without disruption and provide additional support for multiple configurations:

Duo Single sign-on (365)
Duo Azure Conditional Access
Cisco VPN Architectures
Single Sign-on
Access Gateway
Duo Radius + Authentication Proxy
Duo + ASA with LDAPs
Azure ASA VPN Architecture

If you have any questions or are ready to get started, feel free to reach out!

Tags:

Cybersecurity, Multi-Factor Authentication (MFA), Zero-Trust