Cisco plans to acquire cybersecurity firm Duo Security for $2.35B(cnbc.com)
cnbc.com
Cisco plans to acquire cybersecurity firm Duo Security for $2.35B
https://www.cnbc.com/2018/08/02/cisco-buys-security-start-up.html
17 comments
> downtown A2 is very expensive already, but you can live in the nearby areas for considerably less
A big part of the August 7th primary will be about building more housing. Taylor wants more, Eaton wants to freeze Ann Arbor in amber so that no one else can move in and change the town.
A big part of the August 7th primary will be about building more housing. Taylor wants more, Eaton wants to freeze Ann Arbor in amber so that no one else can move in and change the town.
We maintain this list of startups in Ann Arbor :)
http://madeina2.com/
http://madeina2.com/
i love the simplicity of the site! would you consider open sourcing or selling a license so we can do a replica of it for our community?
haha edit - i didn't scroll down. you guys rock! - https://github.com/MadeInA2/madeina2
haha edit - i didn't scroll down. you guys rock! - https://github.com/MadeInA2/madeina2
Actually planning on a major update soon—lmk if you end up using it!
Work a bit next door to the Llamasoft office, it's a good spot. Really love A2 and glad to see the budding tech scene here really making it.
A2 and the tech scene in the area is great. Glad to see this!
Duo Press Release: https://duo.com/about/press/releases/cisco-announces-intent-...
Cisco Press Release: https://newsroom.cisco.com/press-release-content?type=webcon...
Letter sent by Duo CEO to customers: https://pastebin.com/AdTMYzzH
Cisco Press Release: https://newsroom.cisco.com/press-release-content?type=webcon...
Letter sent by Duo CEO to customers: https://pastebin.com/AdTMYzzH
I really hope that Duo survives this. Cisco isn't necessarily known for handling acquisitions well...or software...but who knows. Maybe it's the shot in the arm that many companies will need to move to token based auth. Lot's of enterprise IT departments take Cisco's word as divine. I have had some bad experiences with Cisco the company, but the devices have always been really good even if they lag behind some of the more aggressive competitors in features or speeds.
The acquisition track record for the Cisco Security business is pretty incredible. Like HBS Case Study good. Sourcefire, ThreatGrid, OpenDNS, Lancope, CloudLock, Observable. Great products and teams brought to scale and maintained. Even IronPort 10+ years later has done fantastically well.
I'm thrilled that Duo will be joining an amazing business filled with a deep bench of security talent and wonderful customers. It's a really strong fit with what Duo has already built and with where both teams are going, now together.
I guess I should mention I was founder / CEO of OpenDNS, was acquired by Cisco, previously led the Cisco Security business, and am still an executive at Cisco. So maybe a bit biased, but still factually on the mark. ;-)
I'm thrilled that Duo will be joining an amazing business filled with a deep bench of security talent and wonderful customers. It's a really strong fit with what Duo has already built and with where both teams are going, now together.
I guess I should mention I was founder / CEO of OpenDNS, was acquired by Cisco, previously led the Cisco Security business, and am still an executive at Cisco. So maybe a bit biased, but still factually on the mark. ;-)
Wow, that's really cool. OpenDNS is/was awesome. I think Cisco also does some great work in the security research space.
It's been a long time since my negative experience and I should probably update my prejudices. Cheers.
It's been a long time since my negative experience and I should probably update my prejudices. Cheers.
OpenDNS was pretty good until Cisco bought it, made the interface worse arbitrarily, and started increasing the cost without providing anything new worth having. The second we heard it was acquired I turned to my boss and said we ought to be looking for an alternative.
Ironport and openDNS are not doing better. Sourcefire is mediocre and I don't know about the rest.
I hope you read this,the reason why Cisco chooses to aquire rather than compete is the same reason those companies would do better without Cisco. I am glad for the founders who get aquired but at least the John Chambers era aquisitions did not fare well.
I hope you read this,the reason why Cisco chooses to aquire rather than compete is the same reason those companies would do better without Cisco. I am glad for the founders who get aquired but at least the John Chambers era aquisitions did not fare well.
Yo can we get some snacks in SJC15?
I'm supportive. Feel free to ping me and I'll see if I can give you some pointers of how to make some progress on that ask.
> Feel free to ping me and I'll see if I can give you some pointers of how to make some progress on that ask
Spoken like a true Cisco executive. You could have just said "I'm supportive but it's out of my hands."
Or perhaps, no reply at all.
Spoken like a true Cisco executive. You could have just said "I'm supportive but it's out of my hands."
Or perhaps, no reply at all.
I take that as a compliment. I really like working with almost every single one of my peers.
I'm not responsible for the buildings or teams in SJC15 and the OP knows that. The people who work with me at Cisco know that when I say I'll help, I do.
I'm not responsible for the buildings or teams in SJC15 and the OP knows that. The people who work with me at Cisco know that when I say I'll help, I do.
> The people who work with me at Cisco know that when I say I'll help, I do.
The same can be said for people who know David outside of Cisco too. I know David from SHDH, EveryDNS, & OpenDNS. He's a man of his word.
The same can be said for people who know David outside of Cisco too. I know David from SHDH, EveryDNS, & OpenDNS. He's a man of his word.
It wasn’t.
Caveating your offer of support three or four times signals hostility not helpfulness.
Any rational actor reading that statement would assume you’d forward their message onto HR without a real response. And make note of the complainer in question.
If you can’t be concrete with your words, why even bother?
Caveating your offer of support three or four times signals hostility not helpfulness.
Any rational actor reading that statement would assume you’d forward their message onto HR without a real response. And make note of the complainer in question.
If you can’t be concrete with your words, why even bother?
I'm not normally one to defend upper management, but that's a dick thing to say to someone who probably genuinely wants to help, but isn't authorized to pay for and ship an expensive snack machine into a random building in a giant company.
"I'll see if I can give you some pointers of how to make some progress on that ask"
probably means
"I'm not the god damn office facilities manager, and I'm not spending my limited time and social capital to quarterback your request for you, but I'll see if I can figure out who in god's name in this 70,000+ person company you should talk to, and tips for how you might convince them to change their budget to give you free snacks".
"I'll see if I can give you some pointers of how to make some progress on that ask"
probably means
"I'm not the god damn office facilities manager, and I'm not spending my limited time and social capital to quarterback your request for you, but I'll see if I can figure out who in god's name in this 70,000+ person company you should talk to, and tips for how you might convince them to change their budget to give you free snacks".
No way dude! That could cost the company thousands of dollars. Is this good for the company?
/s
/s
Cisco is essentially composed of nothing but acquisitions. That is what Cisco does.
The reputation of Cisco's internal engineering culture used to be pretty grim. I never understood why any PM or lead would actually build something from a Cisco internal MRD, rather than jumping ship, building it privately, and selling it back to Cisco. I know of more than one person that did literally exactly that, successfully.
But post-Sourcefire I think it's a different scene there; they have some very large, long-lived teams with coherent cultures now. I assume in the post-Sourcefire Cisco game plan, Duo stays Duo.
The reputation of Cisco's internal engineering culture used to be pretty grim. I never understood why any PM or lead would actually build something from a Cisco internal MRD, rather than jumping ship, building it privately, and selling it back to Cisco. I know of more than one person that did literally exactly that, successfully.
But post-Sourcefire I think it's a different scene there; they have some very large, long-lived teams with coherent cultures now. I assume in the post-Sourcefire Cisco game plan, Duo stays Duo.
The culture didn't shift much post-Sourcefire, it just melded a bit. Everything they acquire becomes a little Cisco-y, depending on how big it was. Duo will become "Cisco-y Duo". But it may be more Cisco or Duo depending on the strength of the culture.
Talos is a good example: it was created from merging Cisco SIO and SourceFire VRT, but I would wager it's 80% VRT [in terms of culture]. They also have so many researchers now that it probably has sub-cultures. Even a single remote office can have its own culture.
Talos is a good example: it was created from merging Cisco SIO and SourceFire VRT, but I would wager it's 80% VRT [in terms of culture]. They also have so many researchers now that it probably has sub-cultures. Even a single remote office can have its own culture.
>I assume in the post-Sourcefire Cisco game plan, Duo stays Duo.
Not overly surprisingly if so. Meraki, and in some ways OpenDNS, have stayed mostly their own with varying degrees of integration.
Not overly surprisingly if so. Meraki, and in some ways OpenDNS, have stayed mostly their own with varying degrees of integration.
I agree 100%. My experience with Duo has been awesome compared to other 2FA solutions such as RSA (which was a dumpster fire setting up and maintaining). I would hate it if it Cisco ruined it.
Also made the switch from RSA to Duo - was like a breath of fresh air. Sales rep said that about half of their clients that had an MFA solution already were converts from RSA (not surprising really.)
In my experience Cisco leaves acquisition alone for at least couple of years providing its brand and sales force. If the acquisition isn't proving its worth and/or if revenue growth is staying flat then start packing your bags.
On the other hand I don't like how the acquisition's leadership gets to absorb other BU's which are targeting similar market space because there is a lot of time and effort that gets invested into integrating teams working culture and style. Also the incoming teams fight to keep their product portfolios alive which leads to sub-optimal decisions.
On the other hand I don't like how the acquisition's leadership gets to absorb other BU's which are targeting similar market space because there is a lot of time and effort that gets invested into integrating teams working culture and style. Also the incoming teams fight to keep their product portfolios alive which leads to sub-optimal decisions.
Cisco follows a survival of the fittest strategy without really saying it or pushing teams/acquisitions to the death.
They provide all the resources you need, are very ethical and help your newly acquired team do your best. If your team (business unit as they call it) doesn't cut it after a few years, they start maneuvering those resources elsewhere. But they've always given every acquisition a fair chance to have their own story. See: Meraki, Insieme, Webex.
Cisco probably doesn't care if a few of their startup acquisitions don't work out.
They provide all the resources you need, are very ethical and help your newly acquired team do your best. If your team (business unit as they call it) doesn't cut it after a few years, they start maneuvering those resources elsewhere. But they've always given every acquisition a fair chance to have their own story. See: Meraki, Insieme, Webex.
Cisco probably doesn't care if a few of their startup acquisitions don't work out.
The more recent acquisitions like Meraki and OpenDNS seem to have fared better. Perhaps the lesson here is that the acquisitions do better when left alone by the mothership. :)
Exactly. They ruined the mobile startup I worked at. I don't have a lot of love for Cisco at the moment.
[deleted]
I've added 2FA to a handful of sites with Duo's product. It was a great experience and would recommend it.
Congrats to Dug and Jon and the whole Duo team!
Are they a cybersecurity company? I thought they were more about IAM. I realize this is the CNBC headline, but I am curious if Duo does something I was unaware of, like rev. engineering, pen. testing, etc.
ps - congrats to Duo!
ps - congrats to Duo!
Not to be too sticky about it, but IAM is cybersecurity. There's a lot more to security than reverse engineering, pen-testing, and vulnerability research.
Sorry for making it about semantics when it should be about celebrating Duo and discussing the acquisition. I just don't love the term "cybersecurity" in the first place because HR (training, background checks) and facilities (physical security) are just as important to an overall security posture. I think proper IAM policy and implementation are part of that and none of them succeed in isolation.
That's an excellent point! It would be good to get away from 'cybersecurity' as a term and more towards focus on general security. You're right that none of these succeed in isolation. :)
They are increasingly adding features that check the health and security of endpoints. So not unlike some MDM.
I've never been clear about the connection to the core business but Duo Labs does a lot of vulnerability research / reverse engineering. https://duo.com/labs
Doesn't do identity, relies on external IAM. Look into Duo Beyond.
Interesting, thank you!
Duo Beyond was a very smart move on their part, taking Google's enterprise security architecture and turning it into a third-party turnkey solution for enterprise customers. They did it before Cloudflare, too. I bet that is a big part of the reason why Cisco is paying so much now.
There isn't anything particularly innovative about Duo Beyond. Inspect the Docker containers and you'll see they simply rebranded simplesamlphp and wrote a custom ngx_http_auth_request_module handler for NGINX for their authenticated reverse proxy product.
If Cisco paid 2 billion dollars for this, my mind is really blown. I'm struggling to figure out how they ended up at 2 billion because I don't see it in anything material -- perhaps the patents or a play against Okta for recurring revenue from smaller companies which might not have Cisco gear?
If Cisco paid 2 billion dollars for this, my mind is really blown. I'm struggling to figure out how they ended up at 2 billion because I don't see it in anything material -- perhaps the patents or a play against Okta for recurring revenue from smaller companies which might not have Cisco gear?
Cisco didnt pay $2B for simplesamlphp, they paid it for "Duo Security provides cloud-based tools to prevent security breaches on devices." :)
Considering Cisco's history you will probably be able to use default credentials. I no longer would trust duo.
Trying to understand the downvotes to this comment. Cisco's been caught on multiple occasions including backdoors in their products.
Expressing skepticism of their stewardship of a security company is perfectly reasonable.
Expressing skepticism of their stewardship of a security company is perfectly reasonable.
[deleted]
Cisco, Adobe and Oracle seem to be having a competition of who can release the most security vulnerabilities.
I personally and professionally will never want to touch their products.
I personally and professionally will never want to touch their products.
Duo's "Duo Push" push based second factor says it "can protect against man-in-the-middle (MITM) attacks" but I don't see how this type of push system can do that.
Does anybody have an explanation, or is this claim in fact entirely hollow and a real world MITM would work just fine but they're pretending to believe real users would do stuff like verify their IP address in a phone message?
Does anybody have an explanation, or is this claim in fact entirely hollow and a real world MITM would work just fine but they're pretending to believe real users would do stuff like verify their IP address in a phone message?
you are right, it can't
I know some of the Duo folks and they are serious security nerds and I don't think they would make this up. That said, I don't have any knowledge of the implementation. I did find this[1]:
> Duo Push technology employs asymmetric encryption to sign and verify communications between Duo's servers and a smartphone running the Duo Push app
I'm thinking this is saying something like they sign the contents of the push notification with a key that the app knows and that the man in the middle wouldn't have. So, they're not just relying on the provider of the push notification service.
[1]: https://searchsecurity.techtarget.com/answer/Do-two-factor-a...
> Duo Push technology employs asymmetric encryption to sign and verify communications between Duo's servers and a smartphone running the Duo Push app
I'm thinking this is saying something like they sign the contents of the push notification with a key that the app knows and that the man in the middle wouldn't have. So, they're not just relying on the provider of the push notification service.
[1]: https://searchsecurity.techtarget.com/answer/Do-two-factor-a...
Yeah, this doesn't help with a MITM because what happens is the victim is at Mallory's site thinking it's their real sign on site, Mallory is taking to their real sign on service. The victim types in real credentials, and says OK let's use Duo Push... Mallory now has their credentials and does Duo Push. The push is securely sent to the victim's phone, and they press OK because they really are trying to sign in. Mallory is allowed in.
FIDO tokens break this attack because the token is talking to the victim's web browser, and that's not visiting the real site so it doesn't work. If Mallory lets the victim's browser talk to the real site, sign in works but Mallory is cut out of the loop.
It's a Confused Deputy problem. Push 2FA assumes that if you confirm that you're trying to sign in at 9:14 and there's an attempted sign in at 9:14 then that's one event, but unlike U2F the only thing connecting the two is the timing, which Mallory can choose.
FIDO tokens break this attack because the token is talking to the victim's web browser, and that's not visiting the real site so it doesn't work. If Mallory lets the victim's browser talk to the real site, sign in works but Mallory is cut out of the loop.
It's a Confused Deputy problem. Push 2FA assumes that if you confirm that you're trying to sign in at 9:14 and there's an attempted sign in at 9:14 then that's one event, but unlike U2F the only thing connecting the two is the timing, which Mallory can choose.
Why would Duo Push allow Mallory's site to initiate a Duo Push for RealSite.com without either a shared secret or certificate validation?
You present an obvious problem that has been solved securely many times over many products and act as if a group of IAM and 2fa professionals ignored or just hadn't thought of it before...
You present an obvious problem that has been solved securely many times over many products and act as if a group of IAM and 2fa professionals ignored or just hadn't thought of it before...
Because mallory.com (who's impersonating valery.com by ripping off the site design, and has a valid certificate for mallory.com) is running a full-up copy of Chrome in a VM, and is clicking the signin link just like a user would do.
I assume what Duo is referring to, though, is that they send through the IP address that your push request is coming from.
So if a user is observant and knows their public IP, they should see the difference.
I assume what Duo is referring to, though, is that they send through the IP address that your push request is coming from.
So if a user is observant and knows their public IP, they should see the difference.
The real site doesn't know this is Mallory, after all Mallory has the victim's credentials. It stands to reason it will offer Duo Push. And the victim is expecting Duo Push so they'll hit OK.
You insist this "has been solved securely many times over" but it famously hasn't, which is why I asked if Duo had some secret sauce. They evidently don't.
People keep building things that are very clever but don't actually respond to the threats in the real world, MITM is a real world threat, and one Duo shouldn't be pretending they're defending against with this Push technology.
You insist this "has been solved securely many times over" but it famously hasn't, which is why I asked if Duo had some secret sauce. They evidently don't.
People keep building things that are very clever but don't actually respond to the threats in the real world, MITM is a real world threat, and one Duo shouldn't be pretending they're defending against with this Push technology.
Yeah, I believe this is in comparison to SMS-based 2FA.
I'm so excited for Duo, amazing folks with amazing products.
This is another solid proof that one doesn't have to be in the Bay to build Unicorn, amazing companies or have fantastic exit.
This is another solid proof that one doesn't have to be in the Bay to build Unicorn, amazing companies or have fantastic exit.
Looks like Duo provides a 2FA for accessing any application ? Does it work for any random app ? Are there any details online about the technical details on how that works ?
we offer similar Trusted Access and Session Analytic Platform - https://seknox.com/trasa
We have been successfully offering on-premise solution to local financial institutes here in Nepal and we are working on launching our SaaS offering (it's currently in beta with few users). If you are interested for beta access, drop me a message at sakshyam[at]seknox.com
Disclosure: I am founder of this startup.
We have been successfully offering on-premise solution to local financial institutes here in Nepal and we are working on launching our SaaS offering (it's currently in beta with few users). If you are interested for beta access, drop me a message at sakshyam[at]seknox.com
Disclosure: I am founder of this startup.
At least it isn't Oracle.
Unbelievable. I went to school with Jon and talked to him a few times.
ah, no wonder they are completely unresponsive to pre-sales inquiries. they have been busy getting acquired.
good on them, since their product is largely uncompetitive today. (they had their moment but it has passed)
good on them, since their product is largely uncompetitive today. (they had their moment but it has passed)
Congrats to Duo!
[deleted]
Google, Duo, who's next? Clinc?
Lots of good tech in A2 in general - Deepfield acquired by Nokia, SkySpecs, Trove, FarmLogs (a YC startup), LLamasoft (my employer!), IBM is here, Toyota, Hyundai, a rapidly increasing number of medtech companies, and plenty of boutique consulting. It makes for a healthy life - a strong tech scene drives wages up, yet the cost of living is still fairly low (downtown A2 is very expensive already, but you can live in the nearby areas for considerably less). There were four companies from A2 in the who's hiring page the other day. Take a look! :)