Cisco Duo in a Zero Trust Architecture

What it is

Cisco Duo verifies the user and the device before it lets them reach an application, which is the core of zero trust for the workforce.

Zero trust says never trust and always verify. Duo applies that at the point of login. It checks that the user is who they claim to be, that the device is healthy and trusted, and that the request fits policy.

How it works

Duo has several parts, and each answers a different zero trust question.

Multifactor authentication

Multifactor authentication (MFA) needs two or more kinds of proof: something you know, something you have, or something you are. A stolen password is then not enough. Duo offers several methods.

Push fatigue is an attack where an adversary sends many prompts until the user approves one. Defences include number matching or verified push, where the user enters a code shown on the login screen, and limits on the number of attempts. Phishing resistant methods such as security keys are the strongest.

Single sign-on

Duo Single Sign-On provides one login to many applications. It acts as a SAML identity provider, so the application trusts Duo for the assertion that the user is authenticated. Users sign in once, with MFA, and reach their applications, while administrators apply the same policy everywhere.

Device Trust and health checks

Device Trust asks whether the device itself is trusted. There are two parts to the idea.

• Health: the device is up to date and secure. The Duo Device Health application can check the operating system version, whether the firewall and disk encryption are on, whether a passcode is set and whether security software is running.
• Management: the device is known and managed, for example it holds a certificate that your organisation issued, or it is reported by an endpoint management tool.

A trusted device can be given an easier path, while an unknown or unhealthy device can be restricted or blocked. This stops a valid password on a compromised or unmanaged device from being enough.

Adaptive Access policies

Adaptive Access policies are the rules that decide the outcome for each login. They look at the context of the request.

The result can be to allow, to ask for more proof, or to deny. A policy can apply to all applications, or to one application. A stricter rule on a sensitive application is a form of least privilege.

Trust Monitor

Trust Monitor looks at authentication data to find unusual and risky behaviour. It learns what is normal for an organisation and for each user, and then surfaces events that stand out. Examples are a login from a new country, a new device for a user, or an unusual time of day.

It uses machine learning to cut the volume to a few events worth review. Analysts can then act, for example by adding a stricter policy or by contacting the user.

Cisco Identity Intelligence

Cisco Identity Intelligence (CII) looks at identity data from several sources, such as identity providers and directories, with Duo. It aims to find identity risks such as accounts without MFA, unused accounts and unusual access. It supports identity threat detection and response, and it gives a view of the identity posture across the organisation.

How Duo connects to other systems

Duo integrates with applications through SAML, and with VPNs and network devices using RADIUS. The Duo Authentication Proxy handles the RADIUS side. It receives the request, checks the first factor against a directory, and calls Duo for the second factor.

[radius_server_auto]
ikey=INTEGRATION_KEY
skey=SECRET_KEY
api_host=API_HOSTNAME
radius_ip_1=10.1.1.1
radius_secret_1=SHAREDSECRET
client=ad_client
port=1812

This outline shows the shape of a RADIUS section of the proxy configuration. The ad_client section, which names the directory, is defined elsewhere in the same file.

Duo and the other zero trust pieces

Duo covers the user and the device. ISE and network segmentation cover the network, and Secure Access covers private application access. Together, access is granted per request and per application, using identity, device health and context.