VPNs protect network traffic in transit, but weak user credentials remain a major vulnerability — multi-factor authentication (MFA) through tools like Cisco Duo adds a critical second layer of verification to remote access connections.
MFA and Duo for VPN Security
VPN can help keep our information private and secure across public networks. However, if our end users aren't practicing good security techniques, then we're going to run into problems, and their account could be compromised — and now our network is compromised. One of the ways that we can counteract that is with MFA and Duo.
Typically, when we're connecting a site-to-site VPN, we have a router at each one of our sites, and we get on the router or firewall or whatever we're using here and we set it up to be a site-to-site VPN. There is static information that we're setting on both of these devices, and as long as that static information remains secure, then we're probably fairly good.
However, we have these remote users that also need to connect into the company network, and we need to make sure that that is secure as well. A lot of times what we'll have is we'll have it set up and prompt them for a username and password, and then they'll log into the network. However, usernames and passwords are pretty easily compromised nowadays, unless your users are practicing good password habits. So that's where we want to use something like MFA, multifactor authentication, to help solve that problem.
Multifactor authentication, or MFA, is a way to combat a lot of users' inability to really manage their passwords well or have good password habits. MFA is this idea that there's multiple factors that you're authenticating against, and usually that is with something maybe you know, like a password; maybe it's something you have, like your phone or a password authentication software; and maybe something you are, like a finger or something. It could be any combination of these, but the idea is that it's multifactor, it's more than one. So you can't just have a password — maybe it's a password and also your phone.
Cisco actually has a solution for this, and it's Cisco Duo. Cisco Duo is an app that you can install on your phone, and then you use it for the authentication process as part of the multifactor authentication.
So when a user now goes to connect to a company's network, they first of all are going to have to provide their credentials. That's going to be passed, and then this company will then send a notification to the phone through this Duo app. It could pop up in a couple different ways. Number one, you have to go in there and get a little code that's on there and plug it in to make that connection. Or it could pop up with a little button that says, do you want to accept this type of connection. It just depends on how you set it up. Either way, you're going to want to have push notifications for the Duo app turned on on the phone, so that way you can be notified when you're connecting in.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →