Item: Cisco Duo
Rating: 9
Author: Verified User

Use Cases and Deployment Scope

We use Cisco Duo for MFA of Active Directory and other software/services that are used within the company. It allows us to require MFA for our servers, endpoints, and a variety of other platforms that we deem necessary to have MFA.

Pros and Cons

Provides a great user experience for MFA on Endpoints.
Offers multiple options for completing the MFA process from mobile apps to Yubikeys.
Allows for granular configuration based on each companies needs.

Documentation is oftentimes missing key information for proper implementation. This is circumvented by reading third-party guides or contacting support for additional details.
They do not push Fail-Closed as much as I think they should. Fail-Open is fairly trivial to bypass and it should be made known to the customer during setup how much this will affect overall security.
More vendor integration is something that is always craved by administrators. There are so many third-parties to integrate with.

Return on Investment

We have greatly bolstered our security by implementing Cisco Duo for MFA on our systems.
The biggest negative impact is that when you enable Fail-Closed, you are going to need an offline code set up for any device you want to log into while the internet or Duo is down. Fail-Closed is certainly the recommended way to configure this, but just keep that in mind, especially for servers and other critical systems that are necessary to be accessed during any sort of outage scenario.

Alternatives Considered

The Okta Identity Cloud

Cisco Duo had an integrated method for handling MFA on Endpoints and Servers. This was a huge bonus. Administration and implementation seemed more efficient as well.

Key Insights

Do you think Cisco Duo delivers good value for the price?

Yes

Are you happy with Cisco Duo's feature set?

Yes

Did Cisco Duo live up to sales and marketing promises?

Yes

Did implementation of Cisco Duo go as expected?

Yes

Would you buy Cisco Duo again?

Yes

Other Software Used

PRTG Network Monitor, ManageEngine Log360, ManageEngine ADAudit Plus, ManageEngine EventLog Analyzer, VMware vCenter Server, VMware ESXi, Pure Storage FlashArray, HPE MSA, Slack, Rapid7 InsightIDR, Rapid7 Managed Security Services (Rapid7 MDR), KnowBe4 Security Awareness Training, LastPass for Business, BeyondTrust Privileged Remote Access, Mimecast Advanced Email Security, Ubiquiti Networks UniFi, Palo Alto Networks Next-Generation Firewalls - PA Series, Tenable Nessus, BitSight Security Ratings, GoDaddy, Kemp LoadMaster, Milestone XProtect Video Management Software (VMS), Palo Alto Networks WildFire, Sophos Intercept X, Sophos Intercept X for Server, Sophos Mobile

Likelihood to Recommend

Cisco Duo is extremely well-suited for someone wanting to add MFA to an on-premise Active Directory environment. Some of the other vendors in this space do provide this feature, but they do not natively support it. One of the top competitors in this space requires signing up with another third-party service to make this integration possible. Less moving parts for something as crucial as this is a huge benefit and having only one vendor to point fingers at makes troubleshooting much simpler.

Goals and Objectives

To further protect our customers, as well as our employees. We want to be at the forefront of security and put ourselves in a position that allows us to encourage other companies to work towards similar security goals.

Expected Outcomes

We wanted a robust solution that had native integration for Windows Logon and Duo, without a doubt, had the best offering for that.

The native Windows Logon/RDP integration was a major selling point for us.

Reason for Selection

It pretty much ticked all the boxes and had some features that competitors did not have a direct comparison to.

Cybersecurity and AI

While AI will inevitably have a negative impact on cybersecurity, I believe legitimate companies will invest a significant amount of time and money into utilizing AI to better their own products, which should open up the jobs of IT/Security staff to spend more time on more meaningful tasks and less time on tasks that can be automated and "learned" by a computer system.

Predictive Threat Hunting

Yes. Many of our tools include these features and create actionable items to be reviewed.

AI lessens the time required to work through a detection and determine a course of action.

Leadership in Resilience

Work towards becoming intimately familiar with the product so that you are comfortable to handle difficult situations as they arise. Confidence is so important.

Likelihood to Renew

It has been working very well and I don't believe there is anything that quite compares to it in feature-set.

Implementation Rating

Documentation could have been better. I had to piece together different KB/admin guides to make certain things work and I also had to use third-party guides to get bits of information that were missing from Cisco Duo documentation. Support was also engaged multiple times to figure out an issue and after some back and forth it was usually determined that the information I needed was hidden somewhere else and had no direct correlation with the document that was linked from the platform.

MFA
Security
Compliance

Future Planned Uses

Adding MFA to additional products and services
Passwordless

Possibly the best vendor for MFA protection of Endpoints and Servers.

Overall Satisfaction with Cisco Duo