configuring-multi-factor-authentication-with-duo

name	configuring-multi-factor-authentication-with-duo
description	Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup, adaptive authentication policies, device trust assessment, and phishing-resistant WebAuthn/FIDO2 deployment aligned with NIST 800-63B AAL2/AAL3. Use when adding or hardening MFA for remote access, VPN, or privileged logins with Duo.
domain	cybersecurity
subdomain	identity-access-management
tags	["iam","identity","access-control","authentication","mfa","duo","multi-factor"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]
mitre_attack	["T1621","T1110.004","T1110.003","T1078","T1556.006"]

Configuring Multi-Factor Authentication with Duo

Overview

Deploy Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points. This skill covers Duo integration methods, adaptive authentication policies, device trust assessment, and phishing-resistant MFA deployment aligned with NIST 800-63B AAL2/AAL3 requirements.

When to Use

• When deploying or configuring configuring multi factor authentication with duo capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with identity access management concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Configure Duo MFA for VPN, RDP, SSH, and web applications
• Implement adaptive access policies based on user, device, and network context
• Deploy phishing-resistant authentication (Duo Verified Push, WebAuthn)
• Configure device health policies (trusted endpoints, OS version enforcement)
• Set up Duo Admin Panel monitoring and reporting
• Implement MFA bypass and emergency access procedures

Key Concepts

Duo Authentication Methods (by security strength)

1. Security Keys (WebAuthn/FIDO2): Phishing-resistant, AAL3 capable
2. Duo Verified Push: Requires code entry, resistant to MFA fatigue attacks
3. Duo Push: Push notification to Duo Mobile app
4. TOTP (Duo Mobile Passcode): Time-based one-time password
5. Hardware Tokens: OTP from physical token
6. SMS/Phone Call: Least secure, use only as fallback

Duo Integration Architecture

• Duo Authentication Proxy: On-premises proxy for RADIUS/LDAP integration
• Duo Web SDK: Embed Duo MFA in web applications
• Duo OIDC/SAML: SSO integration for cloud applications
• Duo for RDP: Windows Logon MFA
• Duo Unix: PAM-based MFA for SSH

Adaptive Access Policies

• Trusted Networks: Reduce MFA friction for corporate networks