Cisco Duo Features

Process of providing credentials and logging into multiple systems is easy and intuitive for users

Supports required 3rd party Authentication Technologies. Example systems: bioMetric, passwords, key cards, token based systems, etc.

Provides support for Multi-Factor authentication, so users are required to provide multiple factors to authenticate. For example, something they know, Something they have or something they are.

Support SSO via Web agents, proxy agents, agent-less, SAML or oAuth and WS-Federation authentication and authorization Web services depending upon the application and business use case

Can serve as the identity provider to external service providers so that when the user logs into a service, instead of providing credentials to the service provider, the service provider trusts the identity provider to validate the credentials.

Can serve as the Service provider from an external service so that when the user logs in externally they have seamless SSO to internal applications from a service provider.

Provides ability to control access to PC's, Mobile devices, and other endpoint devices.

Controls access to legacy applications, web based applications, network resources and servers while employees are on the companies local area network.

Controls access to legacy applications, web based applications, networks resources while employees are outside the local area network.

Controls access to users that are not company employees that are either within the companies local area network or outside the network

Enables users to use their own device to access company applications.

Installation process is easy and flexible.

Options for resetting and enforcing password policies

Provides Administration tools/console that are easy to use and learn for routine maintenance tasks

Easily provisions new systems, platforms or applications using configuration and not customization.

Users can set, change passwords without interaction from IT staff

Documents access and alterations of the database for analytics and reporting.

Unveils data connected to infrastructure and applications used to help manage and maintain compliance within complex IT systems.

Supports LDAP Protocol to enable access control and governance.

Encrypts all data transfers using end-to-end encryption.

Provides audit trails to monitor useage to reduce fraud.

Complies with regulations for strong customer authentication such as KYC, PSD2, and others.

Keep identity attributes consistent across applications whether the change is made in the provisioning system or the application.

Enables administrators to create access policies and applies policy controls throughout request and provisioning processes.

Provides or integrates with a cloud based directory option that contains all user names and attributes.

Integrates with common applications such as service desk tools.

Access pre-built and custom reports to monitor user activity and storage.

To what extent are there partner applications readily available for integrating into this product? Partner applications typically provide complementary, best of breed functionality not offered natively in this product.

Documents access and alterations of the database for analytics and reporting.

Supports Endpoint access control to multiple operating systems

Allows user authentication to be honored by all the hosts in two or more domains

Support access to browser based applications across required browser types

Provides required failover mechanisms to ensure if one server, network, etc fails users are still able able to authenticate

Contains pre-built and custom reporting tools to required to manage business

Provides mechanism for auditing authentication for trouble shooting purposes.

Can call and pass credentials to third party web services.

Sends a one-time passcode (OTP) via SMS.

Provides a one-time passcode (OTP) via voice-call.

Sends a one-time passcode (OTP) via email.

Supports hardware tokens, which are often USB-sized, fob-like devices that store codes.

Offers software tokens, which are applications installed on a mobile phone, wearable devices, or desktops and generate time-based one-time passcodes (TOTP) that a user can easily copy. Software tokens work both online and offline.

Allows biometric factors such as fingerprints, faceprints, voiceprints, or other biometric information to be used as an authentication factor.

Offers mobile push authentication, which is a user-friendly method that does not require a user to copy a code, but rather accept or deny an authentication using a mobile application. Mobile push authentication only works when a user is connected to the internet.

Analyzes users' IP addresses, devices, behaviors and identities to authenticate a user.

Allows the use of tokens on multiple devices. This feature can also be turned off if the user does not want this.

Offers encrypted backup recovery stored by the vendor.

Offers FIDO2-enabled authentication method

Works with hardware security keys

Offer users multiple ways to authenticate including, but not limited to: mobile push on trusted devices, FIDO-enabled devices, physical security keys, keycards, smart watches, biometrics, QR codes, desktop app + pin, and others.

Offers solutions when users are offline or do not have access to a mobile phone.

Simplifies or automates user provisioning, deprovisioning, and other user role changes.

Offers password management tools to end users.

Offers single sign-on functionalities to end users, allowing them to authenticate once and be given access to all of their company accounts.

Enforces user-access policies based on individual, role type, group membership or other factors to prevent unauthorized access to company systems and data.

Authenticates users prior to granting access to company systems.

Offers multi-factor authentication methods to verify a user's identity.

Allows administrative control over network components, mapping, and segmentation.

Allows visual display of networks segmented components and their connected resources.

Utilizes behavioral analysis to improve security procedures and documentation.

Application Programming Interface - Specification for how the application communicates with other software. API's typically enable integration of data, logic, objects, etc. with other software applications.

Allows administrative control over automated security tasks.

Protects application access and data. Prompts additional authentication for suspicious users.

Protects computing resources across a network. Prompts additional authentication for suspicious users.

Protects informatin stored on premises and in the cloud. Prompts additional authentication for suspicious users.

Provides some level of encryption of files and data in transit and sensitive information while it lives online.

Constantly monitors acivity related to user behavior and compares activity to benchmarked patterns.

Stores data securely either on premise or in an adjacent cloud database to prevent loss of data at rest.

Allows administrators to set policies for security and data governance.

Provides a risk-based approcach to determining trust within the network.

Calculates risk based on user behavior, permissions, and requests.

Monitors users attempting unauthorized access to databases, applicaitons, and othe network components.

Protects sensitive data by disguising or encrypting data, keeping it usable by the organization and approved parties.

Manages policies for user data access and data encryption.

Stores data securely either on premise or in an adjacent cloud database to prevent loss of data at rest.

Constantly monitors acivity related to user behavior and compares activity to benchmarked patterns.

Supports compliance with PII, GDPR, HIPPA, PCI, and other regulatory standards.

Analyzes data associated with denied entries and policy enforcement, giving information of better authentication and security protocols.

Monitors data quality and send alerts based on violations or misuse.

Allows for reporting and documentation of individual user behavior and privileges.

Connections use open standards such as SAML or RADIS.

Offers developers a mobile software development kit to seamlessly add biometric authentication into their applications.

Integrates with identity and access management (IAM) solutions to manage workforce authentication.

Integrates with customer identity and access management (ICAM) solutions to manage customer authentication.

Allows administrators to provision access based on the individual user and their role.

Defines which users have access to the different modules of the software and how.

Allows for reporting and documentation of individual user behavior and privileges.

Monitors data quality and send alerts based on violations or misuse.

Provides an IAM solution for on-prem systems.

Provides an IAM solution for cloud-based systems.

Tracks user activities across protected systems.

Provides reporting functionality.

Log and report all modifications to user roles and access rights.

Provide standardized reports for regulatory compliance and audits.

Offers an easy to understand user interface to make setup smooth.

Offers a mobile software development kit (SDK) for iOS, Blackberry, and Android.

Offers a software development kit (SDK) for web-based applications.

Condenses long documents or text into a brief summary.

Allows users to generate text based on a text prompt.

Simplifies user authentication across multiple services while maintaining security.

Ensures that users are verified through multiple credentials before access is granted, reducing the risk of compromised accounts.

Grants access based on the user’s role within the organization, adhering to the principle of least privilege.

Integrates with external identity providers to manage user identities across different platforms and services.

Mandatory encryption of data both at rest and in transit protects against unauthorized access.

Continuous monitoring and real-time response capabilities with EDR help detect and mitigate threats on endpoint devices.

Verifies the security status of a device before granting access to network resources, ensuring that only compliant devices can connect.

Divides the network into isolated segments to prevent lateral movement by attackers, ensuring that if one segment is compromised, others remain secure.

Replaces traditional VPNs by enforcing granular, context-aware access to applications based on user identity, device, and other factors.

Detect and prevent unauthorized access or transfer of sensitive data.

Data classification automatically categorizes data based on its sensitivity, allowing for appropriate security measures to be applied

API support ensures that the zero trust platform can integrate seamlessly with other security tools and existing infrastructure

Provides the ability to enforce security policies at the application layer, ensuring that access to specific applications is tightly controlled.

ensures that only authorized users can access critical applications, protecting against unauthorized entry points

UEBA identifies unusual behavior that may indicate a security threat, enabling proactive threat managemen

Provides real-time visibility into all network traffic, user activities, and data flows to detect anomalies

allows for automatic application of security policies based on predefined criteria, reducing the risk of human error and ensuring consistent enforcement

Regulatory compliance assists organizations in adhering to industry-specific regulations, such as the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), or the California Consumer Privacy Act (CCPA)

This works across different environments, including on-premises, cloud, and hybrid setups, ensuring comprehensive security coverage

This ensures that security policies are consistently applied across all users, devices, and application

Detailed reports that provide insights into security events help organizations maintain compliance and optimize their security posture

Capability to perform complex tasks without constant human input

Works across multiple software systems or databases

Improves performance based on feedback and experience

Anticipates needs and offers suggestions without prompting

Grant access based on user attributes, location, device posture or risk.

Automate onboarding, offboarding, and access reviews throughout user lifecycles.

Enable users to reset passwords and update profiles without admin support.

Identify unusual access patterns using machine learning models.

Dynamically adjust access policies based on risk and AI-generated insights.

Suggest appropriate user roles based on usage patterns and peer behavior.