Home Health Good & Frictionless Zero Belief Entry

Good & Frictionless Zero Belief Entry

Good & Frictionless Zero Belief Entry


Offering safe entry and a frictionless consumer expertise are sometimes competing initiatives, however they don’t must be! Learn on to be taught why.

In our world at present, context adjustments rapidly. We do business from home, espresso retailers and the workplace. We use a number of gadgets to do work. And on the flip aspect, attackers have gotten more and more savvy, getting round safety controls, similar to multi-factor authentication (MFA), to realize unauthorized entry.

To cite Wendy Nather, Cisco’s head of Advisory CISOs, “Belief is neither binary nor everlasting.” Due to this fact, safety controls should continually consider for change in belief, however with out including pointless friction for end-users.

It’s no shock that the just lately printed Cybersecurity Readiness Index, a survey of 6,700 cybersecurity leaders from throughout the globe, revealed that extra progress is required to guard id, networks and functions.

To handle these challenges and to make zero belief entry for the workforce straightforward and frictionless, Cisco Duo introduced the final availability of Threat-Based mostly Authentication and enhancements to our enterprise prepared Single Signal-On answer at Cisco Stay EMEA 2023 earlier this week.

Threat-Based mostly Authentication

Chart showing how Risk-Based Authentication starts by evaluating the risk signal analysis based off of device trust, location, wi-fi fingerprint, and known attack patterns. Based of off this, it decides what kind of authentication is required - including no authentication, Duo push 2FA, verified Duo push, FIDO2 authenticator - before allowing (or blocking) access to corporate resources.

Threat-Based mostly Authentication fulfills the zero belief philosophy of steady belief verification by assessing the danger stage for every entry try in a fashion that’s frictionless to customers. A better stage of authentication is required solely when there is a rise in assessed threat. Duo dynamically detects threat and mechanically steps up authentication with two key insurance policies:

1. Threat-Based mostly Issue Choice

The Threat-Based mostly Issue Choice coverage detects and analyzes authentication requests and adaptively enforces probably the most safe components. It highlights threat and adapts its understanding of regular consumer habits. It does this by in search of identified assault patterns and anomalies after which permitting solely the safer authentication strategies to realize entry.

For instance, Duo can detect if a corporation or worker is being focused for a push bombing assault or if the authentication system and entry system are in two totally different nations, and Duo responds by mechanically elevating the authentication request to a safer issue similar to phishing resistant FIDO2 safety keys or Verified Duo Push.

Chart showing how Risk-Based Authentication, when picking up on known attack patterns, will either request a Verified Duo Push or Block access.

2. Threat-Based mostly Remembered Units

The Threat-Based mostly Remembered Units coverage establishes a trusted system session (like “keep in mind this pc” test field), mechanically with out asking the consumer the test a field, throughout a profitable authentication. As soon as the session is established, Duo seems to be for anomalous IP addresses or adjustments to a tool all through the lifetime of the trusted session and requires re-authentication provided that it observes a change from historic baselines.

The coverage additionally incorporates a Wi-Fi Fingerprint offered by Duo Machine Well being app to make sure that IP tackle adjustments replicate precise adjustments in location and never regular utilization eventualities similar to a consumer establishing an organizational VPN (Digital Personal Community) session.

Chart showing how Risk-Based Authentication, when using location and wi-fi fingerprint to determine that risk levels are low, won't require authentication.

Duo makes use of anonymized Wi-Fi Fingerprint to reliably detect whether or not the entry system is in the identical location because it was for earlier authentications by evaluating the Wi-Fi networks which might be “seen” to the entry system. Additional, Duo preserves consumer privateness and doesn’t observe consumer location or gather any non-public data. Wi-Fi Fingerprint solely lets Duo know if a consumer has modified location.

Single Signal-On

A typical group makes use of over 250 functions. Single sign-on (SSO) options assist workers entry a number of functions with a single set of credentials and permit directors to implement granular insurance policies for software entry from a single console. Built-in with MFA or passwordless authentication, SSO serves as a vital entry administration device for organizations that need to implement zero belief entry to company functions.

Chart showing how Duo SSO integrates with SAML 2.0 and OIDC applications

Duo SSO is already fashionable amongst Duo’s prospects. Now, we’re including two new capabilities that cater to fashionable enterprises:

1. Assist for OpenID Join (OIDC)

An growing variety of functions use OIDC for authentication. It’s a fashionable authentication protocol that lets software and web site builders authenticate customers with out storing and managing different individuals’s passwords, which is each troublesome and dangerous. Thus far, Duo SSO has supported SAML internet functions. Supporting OIDC permits us to guard extra of the functions that our prospects are adopting as all of us transfer in the direction of a mobile-first world and combine stronger and fashionable authentication strategies.

2. On-Demand Password Resets

Password resets are costly for organizations. It’s estimated that 20-50% of IT helpdesk tickets are for password resets. And in response to a report by Ponemon Institute, giant enterprises expertise an common lack of $5.2 million a yr in consumer productiveness attributable to password resets.

When logging into browser-based functions, Duo SSO already permits customers to reset passwords after they have expired in the identical login workflow. And we heard from our prospects that customers need the choice to proactively reset passwords. Now, Duo SSO provides the comfort to reset their Energetic Straight passwords earlier than they expire. This functionality additional will increase consumer productiveness and reduces IT helpdesk tickets.

Screenshot of Duo's self-service password reset prompt

Threat-Based mostly Authentication and enhancements to Duo SSO can be found now to all paying prospects based mostly on their Duo Version. In case you are not but a Duo buyer, join a free 30-day trial and check out these new capabilities at present!

We’d love to listen to what you suppose. Ask a Query, Remark Under, and Keep Linked with Cisco Safe on social!

Cisco Safe Social Channels





Please enter your comment!
Please enter your name here