NIST 800-171 and Duo for Multi-factor Authentication

I see more and more people in the DoD contracting world going with Duo for their answer to the 800-171 control 3.5.3 Re: MFA for Local and Remote logins. We looked at them in-depth several times since we started researching MFA products last January and determined that, unless all of your work is done on your local site and none of your users travel, you cannot use Duo to truly protect the data on your company laptops and also be able to support your remote users.

The problem with Duo is that all of the authentication happens in the cloud. This means that if a user has no internet connection then the options are either Fail-Open or Fail-Close depending on how you set it up. If you Fail-Close then this means that you can't even log into a WiFi hotspot anywhere that uses a login screen to access it, such as a hotel, conference center, coffee shop, etc. Also, in the event of them losing their cell phone or Yubikey, they are SOL until they get the device replaced. As an Admin or Help Desk, you also have no ability to log in and help them remotely.

The alternative is even worse from a security standpoint. In a Fail-Open config if you don't have an internet connection the Duo app In all of the implementations that I have seen, they have the Windows app configured to turn off if no internet connection is detected and the user just logs in with their Domain credentials. This means that all a malicious party has to do to defeat your MFA is flip the airplane mode switch or pull the ethernet cable out. How on earth is that providing multi-factor protection for your data? I also find it very funny that nowhere on their website, that I could find, do they call attention to the fact that Duo only works with an internet connection.

After looking at all the major players in MFA we ended up going with Bomgar Verify. We were already familiar with them and use their Remote Support appliance. Verify splits the seed record between your on-site hosted server and the soft token app when you register it. This allows you to still be able to log into a laptop even when you are offline. They also offer SMS or Email pre-load, voice call, QR code, wearables verification, NFC, and laptop softtokens as options. This was the only product we found that we felt gave us a number of ways to support people in remote sites or traveling without compromising the MFA protection.

The cost of this product was a slightly higher than Duo MFA in year 1, due to a one-time implementation charge, but the annual renewal fee was actually cheaper than Duo and by year 4 Verify will be cheaper overall.

Source: Implementing NIST 800-171 where I work. We have been researching 2FA vendors (and much more) for the last 17 months and speaking with sales and technical resources at Duo several times and as recently as yesterday.

Edit: Added comment