9 ms·
Cisco plans to acquire cybersecurity firm Duo Security for $2.35B
- paulie_a 8y agoConsidering Cisco's history you will probably be able to use default credentials. I no longer would trust duo.
- daxorid 8y agoTrying to understand the downvotes to this comment. Cisco's been caught on multiple occasions including backdoors in their products. Expressing skepticism of their stewardship of a security company is perfectly reasonable.
- deleted 8y ago[deleted]
- paulie_a 8y agoCisco, Adobe and Oracle seem to be having a competition of who can release the most security vulnerabilities. I personally and professionally will never want to touch their products.
- throwaway5752 8y agoAre they a cybersecurity company? I thought they were more about IAM. I realize this is the CNBC headline, but I am curious if Duo does something I was unaware of, like rev. engineering, pen. testing, etc. ps - congrats to Duo!
- johnmaguire2013 8y agoDoesn't do identity, relies on external IAM. Look into Duo Beyond.
- mtgx 8y agoDuo Beyond was a very smart move on their part, taking Google's enterprise security architecture and turning it into a third-party turnkey solution for enterprise customers. They did it before Cloudflare, too. I bet that is a big part of the reason why Cisco is paying so much now.
- hb3b 8y agoThere isn't anything particularly innovative about Duo Beyond. Inspect the Docker containers and you'll see they simply rebranded simplesamlphp and wrote a custom ngx_http_auth_request_module handler for NGINX for their authenticated reverse proxy product. If Cisco paid 2 billion dollars for this, my mind is really blown. I'm struggling to figure out how they ended up at 2 billion because I don't see it in anything material -- perhaps the patents or a play against Okta for recurring revenue from smaller companies which might not have Cisco gear?
- trhway 8y agoCisco didnt pay $2B for simplesamlphp, they paid it for "Duo Security provides cloud-based tools to prevent security breaches on devices." :)
- throwaway5752 8y agoInteresting, thank you!
- castillar76 8y agoNot to be too sticky about it, but IAM is cybersecurity. There's a lot more to security than reverse engineering, pen-testing, and vulnerability research.
- throwaway5752 8y agoSorry for making it about semantics when it should be about celebrating Duo and discussing the acquisition. I just don't love the term "cybersecurity" in the first place because HR (training, background checks) and facilities (physical security) are just as important to an overall security posture. I think proper IAM policy and implementation are part of that and none of them succeed in isolation.
- castillar76 8y agoThat's an excellent point! It would be good to get away from 'cybersecurity' as a term and more towards focus on general security. You're right that none of these succeed in isolation. :)
- geofft 8y agoI've never been clear about the connection to the core business but Duo Labs does a lot of vulnerability research / reverse engineering. https://duo.com/labs https://duo.com/labs
- DEADBEEFC0FFEE 8y agoThey are increasingly adding features that check the health and security of endpoints. So not unlike some MDM.
- alexmaddenuk 8y agoAt least it isn't Oracle.
- rman666 8y agoCongrats to Dug and Jon and the whole Duo team!
- youdontknowtho 8y agoI really hope that Duo survives this. Cisco isn't necessarily known for handling acquisitions well...or software...but who knows. Maybe it's the shot in the arm that many companies will need to move to token based auth. Lot's of enterprise IT departments take Cisco's word as divine. I have had some bad experiences with Cisco the company, but the devices have always been really good even if they lag behind some of the more aggressive competitors in features or speeds.
- Bluecobra 8y agoI agree 100%. My experience with Duo has been awesome compared to other 2FA solutions such as RSA (which was a dumpster fire setting up and maintaining). I would hate it if it Cisco ruined it.
- charlietango92 8y agoAlso made the switch from RSA to Duo - was like a breath of fresh air. Sales rep said that about half of their clients that had an MFA solution already were converts from RSA (not surprising really.)
- castillar76 8y agoThe more recent acquisitions like Meraki and OpenDNS seem to have fared better. Perhaps the lesson here is that the acquisitions do better when left alone by the mothership. :)
- davidu 8y agoThe acquisition track record for the Cisco Security business is pretty incredible. Like HBS Case Study good. Sourcefire, ThreatGrid, OpenDNS, Lancope, CloudLock, Observable. Great products and teams brought to scale and maintained. Even IronPort 10+ years later has done fantastically well. I'm thrilled that Duo will be joining an amazing business filled with a deep bench of security talent and wonderful customers. It's a really strong fit with what Duo has already built and with where both teams are going, now together. I guess I should mention I was founder / CEO of OpenDNS, was acquired by Cisco, previously led the Cisco Security business, and am still an executive at Cisco. So maybe a bit biased, but still factually on the mark. ;-)
- deleted 8y ago[deleted]
- wytian 8y agoGoogle, Duo, who's next? Clinc?
- jwhiz22 8y agoI've added 2FA to a handful of sites with Duo's product. It was a great experience and would recommend it.
- yawgmoth 8y agoCongratulations to my neighbors at Duo! That's a crazy amount of money and I hope that many Ann Arborites pay it forward in the tech scene from which Duo came. Lots of good tech in A2 in general - Deepfield acquired by Nokia, SkySpecs, Trove, FarmLogs (a YC startup), LLamasoft (my employer!), IBM is here, Toyota, Hyundai, a rapidly increasing number of medtech companies, and plenty of boutique consulting. It makes for a healthy life - a strong tech scene drives wages up, yet the cost of living is still fairly low (downtown A2 is very expensive already, but you can live in the nearby areas for considerably less). There were four companies from A2 in the who's hiring page the other day. Take a look! :)
- sampl 8y agoWe maintain this list of startups in Ann Arbor :) http://madeina2.com/ http://madeina2.com/
- taylorhou 8y agoi love the simplicity of the site! would you consider open sourcing or selling a license so we can do a replica of it for our community? haha edit - i didn't scroll down. you guys rock! - https://github.com/MadeInA2/madeina2 https://github.com/MadeInA2/madeina2
- sampl 8y agoActually planning on a major update soon—lmk if you end up using it!
- georgehotelling 8y ago> downtown A2 is very expensive already, but you can live in the nearby areas for considerably less A big part of the August 7th primary will be about building more housing. Taylor wants more, Eaton wants to freeze Ann Arbor in amber so that no one else can move in and change the town.
- mgoblu3 8y agoWork a bit next door to the Llamasoft office, it's a good spot. Really love A2 and glad to see the budding tech scene here really making it.
- starpilot 8y agoUnbelievable. I went to school with Jon and talked to him a few times.
- niftich 8y agoDuo Press Release: https://duo.com/about/press/releases/cisco-announces-intent-to-acquire-duo-security https://duo.com/about/press/releases/cisco-announces-intent-... Cisco Press Release: https://newsroom.cisco.com/press-release-content?type=webcontent&articleId=1937036 https://newsroom.cisco.com/press-release-content?type=webcon... Letter sent by Duo CEO to customers: https://pastebin.com/AdTMYzzH https://pastebin.com/AdTMYzzH
- karpodiem 8y agoCongrats to Duo!
- tialaramex 8y agoDuo's "Duo Push" push based second factor says it "can protect against man-in-the-middle (MITM) attacks" but I don't see how this type of push system can do that. Does anybody have an explanation, or is this claim in fact entirely hollow and a real world MITM would work just fine but they're pretending to believe real users would do stuff like verify their IP address in a phone message?
- jiveturkey 8y agoyou are right, it can't
- dangoor 8y agoI know some of the Duo folks and they are serious security nerds and I don't think they would make this up. That said, I don't have any knowledge of the implementation. I did find this[1]: > Duo Push technology employs asymmetric encryption to sign and verify communications between Duo's servers and a smartphone running the Duo Push app I'm thinking this is saying something like they sign the contents of the push notification with a key that the app knows and that the man in the middle wouldn't have. So, they're not just relying on the provider of the push notification service. [1]: https://searchsecurity.techtarget.com/answer/Do-two-factor-authentication-vulnerabilities-outweigh-the-benefits https://searchsecurity.techtarget.com/answer/Do-two-factor-a...
- johnmaguire2013 8y agoYeah, I believe this is in comparison to SMS-based 2FA.
- tialaramex 8y agoYeah, this doesn't help with a MITM because what happens is the victim is at Mallory's site thinking it's their real sign on site, Mallory is taking to their real sign on service. The victim types in real credentials, and says OK let's use Duo Push... Mallory now has their credentials and does Duo Push. The push is securely sent to the victim's phone, and they press OK because they really are trying to sign in. Mallory is allowed in. FIDO tokens break this attack because the token is talking to the victim's web browser, and that's not visiting the real site so it doesn't work. If Mallory lets the victim's browser talk to the real site, sign in works but Mallory is cut out of the loop. It's a Confused Deputy problem. Push 2FA assumes that if you confirm that you're trying to sign in at 9:14 and there's an attempted sign in at 9:14 then that's one event, but unlike U2F the only thing connecting the two is the timing, which Mallory can choose.
- jiveturkey 8y agoah, no wonder they are completely unresponsive to pre-sales inquiries. they have been busy getting acquired. good on them, since their product is largely uncompetitive today. (they had their moment but it has passed)
- segmondy 8y agoI'm so excited for Duo, amazing folks with amazing products. This is another solid proof that one doesn't have to be in the Bay to build Unicorn, amazing companies or have fantastic exit.
- sakshyamshah 8y agowe offer similar Trusted Access and Session Analytic Platform - https://seknox.com/trasa https://seknox.com/trasa We have been successfully offering on-premise solution to local financial institutes here in Nepal and we are working on launching our SaaS offering (it's currently in beta with few users). If you are interested for beta access, drop me a message at sakshyam[at]seknox.com Disclosure: I am founder of this startup.
- thickice 8y agoLooks like Duo provides a 2FA for accessing any application ? Does it work for any random app ? Are there any details online about the technical details on how that works ?