Other Topics - Duo Security

Kyle Lady, Duo’s Senior R&D Engineer, wrote up a blog about Duo Labs’ analysis of the Anti Public Combo List. This is over 500 million usernames/passwords aggregated from data breaches/password dumps. Most accounts were consumer accounts - nearly hal...

We want to make it as easy as possible to get end-users up and running with Duo. We’re looking for any information on how you informed your user bases about what Duo is and how they will interact with it. https://guide.duo.com is publicly available b...

Yesterday, a Gmail phishing attack leveraging OAuth spread quickly to multiple users. There are a number of features that you need to be aware of that made this attack incredibly successful. Read more about the details of the attack and how to protec...

Stolen RDP logins from education, healthcare and government organizations are particularly in demand on the dark web, according to a recent analysis from Flashpoint. In many instances these credentials are brute-forced, then put up for sale on a larg...

In November, we filed Freedom of Information (FoI) requests to 70 universities throughout the U.K., surveying them about their phishing experiences. In this new blog, Jordan Wright of Duo Labs discusses the results, which indicate that phishing conti...

Our new Liftoff guide will walk you through the key deployment stages when rolling out Duo, along with our best practices and key resources for each step of the way. Our aim is to make your Duo deployment as easy and as successful as possible. The gu...

Duo signed a joint letter penned by Rapid7 recommending the addition of a vulnerability disclosure and handling process in the National Institute of Standard and Technology’s (NIST) cybersecurity framework. Many other security companies and organizat...

This new blog by Duo R&D Engineer Pepijn Bruienne covers updating Apple firmware, and how it can be less visible than patching software - it may not be something that is monitored in config management systems to the same extent software patching is. ...

Last Friday night at 11:42pm, emergency sirens rang out across Dallas County for over an hour. Hearing these “tornado sirens” is not uncommon, but this time was different: there was no storm – the siren emergency system had been hacked. Learn more ab...

One of the largest sustained global cyber espionage campaigns is targeting managed IT service providers (MSPs) in order to gain access to MSP customer networks, known as Operation Cloud Hopper, according to a report by PricewaterhouseCoopers (PwC) an...

Recently, Microsoft patched a vulnerability that could be used in phishing attacks to direct users to malicious websites, known as CVE-2017-0022. This is one of three that have been exploited by attackers in the wild since last year. The security upd...

When you’re trying to parlay a multi-factor authentication (MFA) product into a solution that complies with current requirements and stays ahead of future ones, it’s hard to tell which way the ship is sailing — especially when you run up against part...

This is the third in Wendy Nather’s blog series on BeyondCorp - all about setting up the access proxy policies. In this blog, she lists the different types of access policies to consider: Warning - strongly recommending or requiring action at some po...

Duo’s Information Security Journalist Thu Pham attended a talk last week featuring prominent investigative journalists Bastian Obermayer and Laurent Richard. Topics covered include an inside perspective on the precautions taken during the Panama Pape...

Hello! Earlier this week we published a new how-to video for installing Duo protection for Pulse Connect Secure SSL VPNs. This integration has been around for a while but we haven’t had a video for it until now. You can watch the video on the Documen...