Sean Frazier is Advisory CISO, Federal at Cisco’s Duo Security. In his role, Sean acts as the voice of the CISO for Duo's federal business. Prior to joining Duo, Sean spent more than 25 years working in technology and public sector security for companies such as Netscape, LoudCloud/Opsware, Proofpoint, Cisco & MobileIron. Sean has helped lead numerous projects used by the Department of Defense and Intelligence Community, including the Fortezza Crypto Card, Defense Messaging System (DMS) and many others. He also has extensive experience in identity and public key infrastructure (PKI), network, applications, mobile and IoT. Sean has testified in front of the U.S. Senate Homeland Security and Government Affairs Committee on the importance of public/private partnership in protecting the nation’s digital infrastructure. Sean also advises public/private partnership working groups including ACT-IAC, ATARC and many others.
When NIST updated SP-800-63 to rev. 3, they did more than just make it okay to have alternatives to PIV/CAC. The forward-thinkers at NIST also envisioned a world where the flexibility extended to federating identities AND proving separation between the authentication and ID-proofing. The future will be modern.
Not all 2FA solutions are created equal. It’s up to the enterprise to pick the right one. This won’t stop some news outlets from posting headlines like, “Phishing attacks that bypass two-factor authentication are now easier to execute.” Which is misleading.
The Office of Management and Budget (OMB) released their new identity guidance for federal and government workers. The new ICAM updates for credentialing for people and devices paves the way to a zero trust security journey.
Duo Security's multi-factor authentication (MFA) is compliant for federal government use, approved by the Department of Homeland Security and is listed on the Continuous Diagnostics and Mitigation (CDM) Approved Products List (APL).
The Department of Homeland Security (DHS) made a curious announcement during the shutdown that had everyone scratching their collective heads ... at first. DHS gave agencies 10 days to get their account security in order, specifically calling out two-factor authentication (2FA) and other protections due to DNS hijacking vulnerabilities.
