ndly method that may enable its 130,000 customers to securely work anyplace, from any machine, with out friction. By leveraging its personal Duo Passwordless, the group was capable of eradicate phishable multi-factor authentication components, enhance usability and productiveness, scale back authentication actions by 93%, and safe its workforce from anyplace.
At Cisco, securing our office for the long run means repeatedly adapting to technological developments and staying forward of the menace panorama. Leveraging our personal suite of safety merchandise, together with Duo, has been key in serving to us try this.
When most of our workforce labored remotely throughout the pandemic, we carried out Duo Past and moved from a conventional network-based perimeter and VPN mannequin to a zero-trust framework in order that customers might securely work anyplace, from any machine, with out friction.
At this time, our zero-trust journey continues as we try to fulfill the safety wants of right this moment whereas adapting for what’s subsequent with Duo Passwordless. Identification is now the perimeter— the primary line of protection towards cyber threats. With most knowledge breaches coming from weak or stolen credentials, it’s clear that the long run requires passwordless authentication.
The issue with passwords
To place it merely, passwords are a straightforward goal for hackers. As soon as the gold customary for safeguarding delicate info, passwords at the moment are outdated and weak within the ever-evolving menace panorama. They’re extremely inclined to phishing assaults, could be simply forgotten, and infrequently result in person frustration that brings an inflow of password-related assist desk tickets to IT groups.
When tormented by password fatigue, customers are inclined to make use of weak, reused, or solely barely modified passwords throughout totally different accounts. Good password administration is difficult and troublesome to implement, and previous to utilizing Duo Passwordless, Cisco IT struggled to handle these challenges throughout an enormous workforce spanning greater than 130,000 customers.
As a big firm and a frontrunner in know-how, a compromise in our safety can have a serious influence on our enterprise and our innovation. If attackers get hold of delicate info corresponding to supply code, inside system particulars, buyer knowledge, or mental property, it not solely places our enterprise and workers in danger, however the clients who depend on our know-how. We would have liked to adapt our method to authentication to mitigate the password associated safety dangers to our enterprise and challenges confronted by our workers and assist groups.
Conventional multi-factor authentication (MFA) is not ample
Authentication has developed as cybercrime has grow to be increasingly subtle. We began with “one thing you realize,” or a username and password. We added MFA, which mixes “one thing you realize” with “one thing you will have” or “are” like a tool or fingerprint. Whereas stronger than a username and password alone, the “one thing you realize” issue of a password remained inclined to vulnerabilities.
The transfer to passwordless: specializing in safety and person expertise
We started working intently with the Duo product group to take a user-friendly, zero belief method that not solely enhanced safety but in addition improved the person expertise. To do that, we carried out Duo Passwordless. It wasn’t nearly enhancing safety, however on the similar time cultivating a seamless expertise that may higher serve our clients and workers each now and into the long run.
While Duo Passwordless continues to be MFA, it takes it a step additional and combines the expertise into one step, making for a smoother person expertise. It depends on cryptographic public-private key pairs, using biometrics (corresponding to fingerprint or facial recognition) or safety keys like YubiKeys to authenticate customers with out the necessity for passwords.
Enhancing Duo as buyer zero
As “buyer zero” for Duo Passwordless, we had the power to check and enhance the know-how by way of early pilot applications earlier than launch. Utilizing a multi-phased method, we began with a small group of IT and safety workers, enhancing efficiency and performance by way of suggestions earlier than steadily increasing to the complete workforce over 10 months. The data gained from preliminary pilot teams and insights into how totally different customers could be impacted helped form our method to speaking the adjustments with our workforce.
By cautious collaboration between groups throughout our group, Cisco IT Safety and the Safety and Belief Group (S&TO) started driving the path of our passwordless future. My group inside IT Safety served as the primary drivers behind this effort, with S&TO offering change administration assist, and IT UX, IT Comms, and IT Analysis & Analytics supporting as wanted. Assist@Cisco additionally performed a job as soon as we shifted to obligatory passwordless just for key apps, managing the assist course of for our inside customers so service groups might give attention to the operation and enchancment of the product.
Challenges and classes realized
Whereas the complete rollout has seen excessive ranges of natural workforce enrollment with restricted promotion, there have been some challenges with adoption. Many customers reported preliminary issues with using biometrics. For instance, Home windows Hiya customers who didn’t log in with biometrics by default, merely didn’t know to set it up. Until particularly instructed, customers on this state of affairs didn’t understand biometrics had been an choice for them.
To treatment, we targeted on worker training round how biometrics are used, the place they’re saved, in addition to the worth of shifting to passwordless authentication. As well as, we offered options to biometrics. For instance, on Home windows, customers can use a PIN. In the event that they don’t like platform-based authenticators, they’ll use a YubiKey with a PIN or setup a passkey on a cellular machine.
Additionally necessary to notice, we didn’t initially mandate the transfer to passwordless. Our method to encouraging worker adoption and alter was formed by our dedication to delivering the perfect person expertise. We wished to ship companies and know-how that acted as a magnet for adoption fairly than a mandate.
Now that we’re additional into our journey, we’ve began Passwordless Solely enforcement on sure apps. The slower, however at-will transition allowed natural adoption and helped get folks comfy with the brand new know-how prior to creating the observe obligatory.
The influence: A safer and productive workforce
Because the passwordless answer was made obtainable to all the workforce, we’ve seen substantial advantages together with:
- Zero password-related safety incidents
- A frictionless expertise for over 130,000 workers with zero belief safe entry
- Improved usability and productiveness, lowering authentication actions by 93%
- Enhanced safety by eliminating phishable MFA components
- Substantial discount in IT time and prices attributable to fewer password-related points
The long run: Continued innovation and enlargement
Whereas there’s a lengthy street forward of a full business shift away from passwords solely, this has primarily been about altering the expertise for our workforce right this moment and mitigating potential future threats for our enterprise. Getting ready for a very passwordless future is a journey that we proceed to construct and enhance on, together with:
- Bettering safety and value for our workforce: Our journey started with our implementation of Duo Past and continues with Duo Passwordless, underpinning our present transition to Cisco Safe Entry inside Cisco IT (extra to come back!). Identification safety is a basis for zero belief entry, and Duo is way more than simply MFA.
- Strengthening and evolving our zero-trust structure: The profitable rollouts of our Duo options mixed with the newest rollout of Cisco Safe Entry unlocks even stronger zero belief outcomes with an identify-first SSE.
Be taught extra about Duo Passwordless Authentication, our journey, and the highly effective mixture of Cisco Safe Entry and Duo. For Cisco workers, discover ways to arrange passwordless in your Cisco machine right here.
Further Sources:
PS: Attending Cisco Reside in San Diego this June?
You’ll have a particular alternative to speak stay with Cisco IT consultants to dive into these success tales and different deployments! Look for Cisco on Cisco in every of the showcases and make sure to search Cisco on Cisco within the session catalog to add our classes to your schedule!
Share: