Cisco Duo - Premier Edition

My main use cases for Cisco Duo are to protect the jump hosts as a two-factor authentication method for logging in. A password is provided to the jump host and then every time I log in to that jump host, I get a Cisco Duo push request to my phone. We have approximately 200 users of our jump host, and there are another four jump hosts that I regularly log into that are also using Cisco Duo for two-factor authentication.

The benefits I have realized from using Cisco Duo include having an easy-to-use two-factor, single sign-on option. We definitely need more security, and it seems to be the least friction-creating way to implement it. That is probably the main benefit.

The features of Cisco Duo that I appreciate the most include its easy interface and the speed of using your thumbprint, which makes it much faster than having to type in a passcode every time. Microsoft Authenticator is probably the solution that comes to mind where the amount of times you have to type in a passcode and provide a number and provide another authentication factor just to achieve the same thing that Cisco Duo accomplishes with one thumbprint immediately. There is a significant difference there. We did not replace Authenticator with Cisco Duo. We have Authenticator in other places and Cisco Duo in some places, so I would say Cisco Duo is faster and much easier to use.

In terms of the adaptive authentication feature, Cisco Duo has helped secure user access by adding another layer into the whole process. Instead of just having a passcode that gets rotated every few weeks, I have that passcode and Cisco Duo, which is tied to my phone number. This provides another layer of security.

Cisco Duo's trusted endpoint device capabilities have helped improve our security policies by running on our jump host alongside a number of security software. Cisco Duo is one of them and makes up the whole stack of security so I can trust these endpoints are protected. It is very difficult for Cisco Duo to be hijacked given that it is tied to a phone number and tied to an application on the handset. There is a lot of trust there.

I assess the effectiveness of Cisco Duo's single sign-on on reducing login complexities for our users by comparing it to competitors. The way that Cisco Duo is integrated with its single sign-on is much better than Microsoft Authenticator. It seems more streamlined. Being able to just use a thumbprint makes it very fast. Sometimes with Microsoft, I find that I have to type it in once and then have to type it in again and again, whereas I have never had to repeat a push request to get something working. If I did, it would usually be due to the server rather than Cisco Duo itself.

The implementation of two-factor authentication, specifically with Cisco Duo, has slowed down the ability to log into a jump host, changing it from what was previously about a five-second process to approximately 15 to 20 seconds. Where there is slowness, it is probably more on the network side than it is on Cisco Duo's side. The Red Hat servers seem to be somewhat slow at passing that request on at times.

Cisco Duo could be better by processing multiple Cisco Duo requests. Typically, when I am doing Cisco Duo requests, I might be logging into a few different things. It would be nice if the app is still open and I have done one request, if it will process the rest automatically. It might reduce authentication times from 15 seconds to completing the first request in 15 seconds, and then the next few in five seconds. That is probably the main area for improvement.

I implemented Cisco Duo approximately a year and a half ago, which has greatly enhanced our security processes since adoption.

Before using Cisco Duo, I used Microsoft Authenticator and SecureAll. They are all slower. We still have them in other parts of the company and they are used for other things. Microsoft Authenticator is integrated with the Office 365 stack, so there are not really many ways around that. It is still there, but I would say if it was all Cisco Duo, it would probably be a lot easier than it currently is.

I would describe my experience with deploying Cisco Duo, along with my colleague who is also doing the survey, as pretty easy. We did the integration with the jump host servers. It seemed that we just had to point, using Linux CLI, toward some servers based in Australia, and all of the integration seemed to be pretty frictionless. The main friction came from the Cisco Duo team within my company who were managing Cisco Duo. We were largely the guinea pigs for it, and so they did not know what they were doing with the integration. All of our steps were quite easy, but getting them to those steps seemed quite difficult. I would put that down to lack of experience within my company rather than Cisco Duo.

Regarding whether I have seen a return on investment from using Cisco Duo, I do not do the financials, so I cannot comment, but I would imagine it is probably a pretty cost-effective way to have delivered it.

I would rate Cisco Duo a nine out of ten overall because I think it could definitely improve. There are ways to speed it up, so it cannot get a perfect score, but it is probably the best solution for two-factor single sign-on that we currently have, so I am happy to use it.

My advice for someone who is researching or implementing Cisco Duo based on my experience would be to take a look at the various solutions, how long they take to deploy, how easy they are, and the end-user experience, which ones create the most headaches. I believe Cisco Duo will come out on top.

One of the most used cases of Cisco Duo for us is providing two-factor or multi-factor authentication to our servers. Since these are our on-premises servers, Cisco Duo is the only source for doing MFA or two-factor authentication.

By using Cisco Duo Single Sign-On, it is much more effective. It helps a user log in quickly in about five seconds, whereas without single sign-on, I would spend one and a half to two minutes on authentication again, so it goes from seconds to minutes for one user.

The feature I like the most about Cisco Duo is how simple it is to understand, as the UI is designed such that you don't need very specific, in-depth training. It is very intuitive; you can read through and navigate the pages, and it makes you understand that this is very simple. For me, as an administrator, it is very simple to use, and that is what I like the most.

Cisco Duo's adaptive authentication helps to secure user access because we can set up the authentication by deciding how we want the users to authenticate and which factors we want them to use. The control is with us as we set what we want for the user; for example, we can specify that users have to use updated mobiles or that their devices should be configured to a certain level, so the control stays with us.

Cisco Duo's dashboards identify security vulnerabilities through a reports section, and for my day-to-day tasks, I am always going through the reports that show what is expiring and how vulnerability looks for our company. On the dashboard, if something critical is happening or there are updates regarding our tenant, we can see them marked as important, which is a great feature.

Cisco Duo's trusted and untrusted device feature is really helpful for us in our telecommunication company, as some users are not using a trusted device or are using bring-your-own-devices. By using this feature, we can see if the firewalls are on, which OS they are using, and whether we should trust them or not. We can regulate who can log in and who cannot based on the trusted devices, which is a great feature we are currently using.

Cisco Duo push notifications are used by most of our users at present because it is phone-based, and while another method people in our company use is a hardware token, Cisco Duo push notifications are preferred. They are really quick, and I feel they are more secure also because they expire very soon. You have to identify your biometrics and then enter the code, and that is one of the most recommended methods I can suggest as a security engineer.

In our tenant, we use Cisco Duo Single Sign-On, which helps certain people who cannot use other single sign-on methods. We have different environments that can provide single sign-on, but it depends on the user's requirements. Cisco Duo Single Sign-On reduces the time for the users; if a user is already using Entra ID, they can log in with Cisco Duo, which is an advantage for us as a multi-IDP-centric company.

Cisco Duo's solution can be improved by introducing the FIDO2 mechanism, possibly by bringing in a passkeys feature with Cisco Duo, which is the requirement we are looking for now, as this is currently missing.

We have been using Cisco Duo for more than four years.

Another thing I love is the support for Cisco Duo; whenever we need support, it is available within hours if it is not urgent, and if it is urgent, we can have a support case raised and have been contacted within 15 minutes.

For my use case, we have not used any other solution, as we were in the market looking for a second-factor provider for our servers. We reviewed a couple of providers, and Cisco Duo suits us based on our licensing, how our company operates, and how many IDs we have. Cisco Duo was flexible enough, and since then, we are not looking for another solution, just asking for FIDO2 now, as mentioned.

While deploying Cisco Duo, the scenario is complex, and it is very critical to start the deployment, but we always have support. Whenever we request support, Cisco engineers are on call to explain each and every setting to us, as this is a new product for us to deploy and understand. We had lengthy discussions about various settings and their benefits. It took time; it took months to fully understand what we were doing, but at present, everything is balanced thanks to their support.

From using Cisco Duo, we get a lot of returns in terms of security, as we primarily use Cisco Duo for our servers. Earlier, it was a security threat, and we implemented a policy that requires every login to be MFA'd, giving us a sense of security knowing that whenever our servers are accessed, Cisco Duo is there at the entry door to keep us secure.

In terms of pricing and licensing cost, I believe our company has a great relationship with Cisco Duo, as we always get the numbers on how many licenses are left whenever we request. It is not always easy to track how many licenses we have due to our environment where one user has multiple IDs, making the cost very complex in those scenarios. We always receive great support from our Melbourne Cisco Duo team, and we have a package based on our requirements, which works well for us.

If I have to rate Cisco Duo, I would give it a nine out of ten, as I am a happy customer. The only reason for not giving it a ten is that we are still waiting for FIDO2 implementation and passkeys, which is the only thing missing. Otherwise, I truly appreciate the team I am working with.

In my role as a technical lead for the Bangladesh region for two and a half years, I provide solutions to partners and customers from the networking and security perspective, ensuring we collaborate effectively to address any issues customers face.

After COVID, our customers, particularly in the financial and government sectors, are primarily using Cisco Duo for remote worker management due to distributed job locations. Many employees are working from home and unable to go to the office, causing disruption in their work with the existing security architecture. I offer solutions such as Intersight to assist these customers, enabling their remote workers to securely connect to the office or branch networks, leading to a much easier daily life under the security fabric.

Cisco Duo's most valuable feature is its ability to secure remote workers using the office network, which was previously a concern. With the implementation of two-factor authentication through Cisco Duo, these users can now access their internal network from remote locations seamlessly, which greatly simplifies their work process and ensures compliance with security standards.

Customers using Cisco Duo's adaptive authentication feature find it beneficial for securing user access, especially since they are working across multiple applications on different platforms. Organizations faced challenges with multi-platform application access, and Cisco Duo provides the right solution to facilitate secure access for remote workers whether they are connecting to their office or a cloud platform.

Cisco Duo's dashboards are highly effective in identifying security vulnerabilities, as they provide a single dashboard where users can monitor every threat or alarm. This comprehensive overview allows users to see what sites and applications are being accessed, setting Cisco Duo apart as it offers a unique capability that competitors do not.

Cisco Duo's push notification method has significantly improved authentication times for our customers, allowing their users to experience a seamless internet interface across all applications. This feature is indeed one of the most distinctive offerings of Cisco Duo.

Initially, some users have difficulties adapting to the single sign-on solution, but with time, they grow comfortable and find it reduces login complexities significantly.

Organizations with multiple branches and remote workers must adopt Cisco Duo for their security compliance. There are some renewal or expiry aspects that could be improved, but overall, I believe it stands out as a solid solution in our region.

Regarding the stability and reliability of Cisco Duo, while there are occasional issues with application integration, the responsiveness of Cisco's tech support ensures that solutions are provided within eight to twelve hours, which leaves both customers and me very satisfied.

My evaluation of Cisco support can be summarized as fabulous—they are much faster than any other provider in the current market, which leaves me pleased with their tech support services.

A couple of examples I can share include Dell, which previously used RSA for authentication. However, they switched to Cisco Duo due to RSA's limitations, which Cisco Duo effectively overcomes, offering a much more convenient method for users to interact with various applications.

Although I am not directly involved in deploying Cisco Duo, I focus on the presales aspect, while most partner companies handle the hands-on deployment tasks.

Before implementing Cisco Duo or two-factor authentication, organizations faced threats to their security posture. After adopting Cisco Duo, our customers report increased happiness with their enhanced visibility and control over end-users, highlighting the clear benefit and return on investment in terms of security.

Before selecting Cisco Duo, our customers evaluated different vendors, but the key point is that I provide demos and proofs of concept. After experiencing the features and visibility that Cisco Duo offers, they have no desire to consider other solutions, particularly since they see the value in renewing their contract annually.

Overall, I would rate Cisco Duo a perfect 10 out of 10 because no other company offers such a robust security platform currently available in the market, making it the best choice for our needs.

I use Cisco Duo mainly for RDP sessions as a second factor, so anyone who wants to access the servers can do so with Cisco Duo as an MFA layer.

This is for securing critical infrastructure, not just RDP but SSH as well on non-Windows machines. When someone wants to access critical infrastructure via either SSH or RDP, they use their Active Directory credentials as a first factor, and then they use a second factor using Cisco Duo, predominantly using YubiKey, with the Cisco Duo mobile app as well in some use cases where they don't have YubiKeys.

Otherwise, I use YubiKey TOTP as the second factor.

The way I sync users with Cisco Duo is based on group membership, where I set up the policies, application policies, global policies, and the mobile app versions or version restrictions in Cisco Duo, pulling the information from Entra, my IDP platform. Based on the group I configure in Entra, Cisco Duo pulls the users and groups information from Entra.

I haven't enabled any new features for Cisco Duo recently, but I am continuing with what I had before, using Cisco Duo as an MFA layer by pulling users and groups from Entra, having individual application policies for each application, along with an overarching global policy that protects all the applications.

I am not utilizing passwordless sign-in for Cisco Duo; it's always username and password as a first factor, and Cisco Duo as a second factor.

I do have Entra as the strategic IDP protecting the non-human agents' use cases, but I am not using Cisco Duo for that.

For managing risks for human users and non-human identities, such as AI agents, I am not using Cisco Duo for non-human identities, only for MFA as a second-factor authentication to the workloads.

Regarding capabilities beyond MFA with Cisco Duo, I do utilize device health checks for some use cases, especially for contractors out in the field, but as they migrate to AVD, that feature is being phased out as it's coming in as a native feature in AVD.

Having the MFA feature provided by Cisco Duo, which I was previously lacking, has positively impacted my organization by being helpful.

The measurable improvement I see with Cisco Duo is in the audit findings, where having an MFA layer on RDP or non-RDP and my server access use cases filled a gap for me. I onboarded any critical infrastructure onto Cisco Duo for providing the MFA support.

From a user-friendliness perspective, Cisco Duo is super easy to use and support, and I haven't had issues from a compliance or security audit perspective, where I ticked the mark.

One of the best features Cisco Duo offers is the MFA feature, especially on Windows or non-Windows machines, where, as I mentioned before, that's something I was lacking, and Cisco Duo helped me to have an MFA layer, which came in my Essential Eight security audit and also involves AVD accesses where I use Cisco Duo.

The cool features are the MFA, and it's also very user-friendly.

From an administrative point of view, I find Cisco Duo user-friendly because the console is very easy to use, and when it comes to the Cisco Duo agent installations, the documents are pretty clear. I just share the installation document without keeping any separate documents myself, simply pointing to the Cisco Duo agent installation document for Windows or non-Windows, saying just to follow this and install it. It's super easy, without many issues.

From an admin point of view, the console of Cisco Duo is super easy to use, with no issues around that, including the mobile app.

Signing in with Cisco Duo is not that difficult, as it's user-friendly, and, aside from a few features missing, it's super easy to use from a user perspective. It supports YubiKey for TOTP and the mobile app module, and I haven't had any issues.

Currently, Cisco Duo has a pull capability only, so it would be good to be able to push it from the Entra side. That's one capability that is lacking.

The reason I chose a seven rating for Cisco Duo is that, as I mentioned before, it's not cheap, and one of the key features that comes to mind is its dependency on the internet to make Cisco Duo reachable, which can lead to a failure. If there's no internet, it bypasses Cisco Duo completely, which I feel is a major security flaw, so it could be improved with some alternative options.

I have been using Cisco Duo for probably more than two years or three years, but I've been using it over a year, more than a year, maybe close to two years.

I have had no issues with the stability of Cisco Duo.

There are no issues with the scalability of Cisco Duo either, given that it's a SaaS module that scales vertically by itself.

The customer support for Cisco Duo is perfect; I haven't encountered any issues, and I can reach out to Cisco engineers directly, especially one in Australia, who supports me anytime.

When it comes to return on investment with Cisco Duo, it's mainly on the security side, which can't really be measured.

However, three people manage the Cisco Duo platform, with one person actively handling support tickets and new onboarding.

In terms of pricing, I would say it's not cheap, around 8 or 9 USD per user, and there's no setup cost since it's a SaaS offering, but I do pay the per-user license cost.

By the time I joined, Cisco Duo was already in place, and I just picked it up from where it was.

I would rate Cisco Duo as a seven, acknowledging it's not cheap and that it could be better.

Cisco Duo is deployed in a public cloud as a SaaS offering, so outbound internet connectivity is necessary to access Cisco Duo, and I don't have a proxy installed on-premises.

Cisco Duo is completely managed by Cisco Duo as a SaaS model, and I haven't got an installation myself.

Cisco Duo has not significantly influenced my identity strategy beyond authentication since I am not using anything else, but if I have use cases or full documents, I can have a look.

The advice I would give to others looking into Cisco Duo is that it's super easy to use. The MFA feature is the only feature I use, and it has pretty good documentation for anyone with a use case like mine.

My main use case for Cisco Duo is to control access to our servers, specifically on-premises servers.

One specific example of how I use Cisco Duo to control access to those on-premises servers is that when users log in to some of our sensitive platforms, they are prompted for a Cisco Duo login and they actually gain access once they provide the Duo information.

Recently, I have started using Cisco Duo mainly to log in to on-premises servers as a multi-factor authentication method.

Currently, as far as I know, we do not use Cisco Duo to secure AI agents at the moment, but we do secure them in the cloud using cloud-based features.

As I am aware, we use Cisco Duo for managing risks for human identities at the moment, and I do not think we have deployed it for non-human identities.

Cisco Duo has influenced my identity strategy mainly for authentication purposes.

Cisco Duo has positively impacted our organization by providing controlled access, which has given us a quite positive experience, and seamless integration has also been a positive experience for us.

The seamless integration of Cisco Duo into our platforms has been easy, and it has been reliable as well.

Our organization is using passwordless sign-in through passkeys and security keys, and it has been a good experience, leading to a reduction in the number of calls to the help desk for password resets.

I believe the help desk requests have reduced with Cisco Duo because it has been quite reliable for us.

The best features Cisco Duo offers mainly include acting as a multi-factor authentication method, and from an operational perspective, it is easy to troubleshoot holistic access across the platform.

It has been very reliable and quite easy to use as well, without having major issues with the platform over the last couple of months or years that I have used it, and it has worked seamlessly and been reliable.

It is very easy for users to sign in with Cisco Duo, and it was a good experience when we signed into Cisco Duo.

Cisco Duo seems to be quite a stable and mature product, and I believe it is at a good standard.

I have been using Cisco Duo for over the past one year.

Cisco Duo is stable.

I believe Cisco Duo is highly scalable.

We have not had any problems with customer support for Cisco Duo, and I think the customer support has been good, but I have not directly been involved recently with customer support.

We have not previously used a different solution before Cisco Duo because we have used only Cisco Duo.

On a scale of 1 to 10, I rate Cisco Duo an eight.

I chose eight out of 10 because I have not looked at the operational side much due to the lack of visibility over the recent platform changes.

I do not find any Duo capabilities beyond MFA to influence my choice at the moment.

I would recommend using Cisco Duo to others reading reviews on PeerSpot because it is a very mature platform, and there appears to be a lot of AI capability also coming into the platform, if not already available.