The 2020 Duo Trusted Access Report

Introduction

Although it feels very of-the-moment, remote work has been on the rise for years now. That said, the recent and rapid expansion of work-from-home culture presents new security challenges. How can employees access all their applications without exposing mission critical information to unnecessary risk? How can organizations allow employees to use their devices on unsecured networks, and ensure that users keep their operating systems and software up to date? There's a lot to think about. 

At Duo, it's our job to make application access more secure for organizations of all sizes, and while every organization's remote access strategy will be slightly different, there are a few fundamental factors to consider — key plays to have in your remote access playbook, so to speak. 

In this report, we'll look at what companies are doing to secure remote work and discuss what makes a good remote access strategy. 

Overview

The core considerations for a good remote access strategy generally fall into three categories. We'll look at each in depth.

Users

Who has permission to access your information?

Devices

Which devices are being used to access applications?

Applications

Which applications are users accessing?

Methodology

In this report, our security research team analyzed data from over 26 million devices, more than 500,000 unique applications and roughly 700 million authentications from across our customer base, spanning North America, Western Europe, and Asia Pacific.

Users

As the workforce becomes more distributed, protections against credential theft are becoming both more stringent and more granular. This year, we saw 85% more customers disallowing less secure methods of multi-factor authentication — looking at you, SMS! — and the most-used authentication method, by a large margin, is Duo Push with almost 69% of total authentications.

More About Users

In the full 2020 Duo Trusted Access Report, we'll explore:

Devices

With an increasingly remote workforce, companies can't solely rely on corporate networks or recognized devices to provide security protections. Instead, thoughtful security policies allow users to access applications on the devices they have available, whether they're corporate-managed or not. 

Policies are being used to help companies adapt to changing circumstances and security threats — over the past year, we've seen companies allow login attempts from certain countries but not others. Last year, a Chrome vulnerability prompted an uptick in browser limitation policies. 

More About Devices

Get the full 2020 Duo Trusted Access Report to learn more about:

Applications

Unsurprisingly, our data shows that remote access and cloud applications are becoming more popular year over year (between June 2019 - June 2020). But the implications of this trend go far beyond user convenience and market availability. Cloud applications are easy to protect with a security layer, like Duo's Multi-Factor Authentication, reducing time-to-security for new vendors, and bringing users the productivity tools they need to work effectively in a remote setting. 

Remote access technologies, like VPN and RDP, further secure sensitive data and are still an essential part of most work-from-home strategies — in fact, they're by far our most commonly accessed application type, claiming almost 37% of total authentications.

Application Insights

See key trends in the types of applications companies are protecting.

of authentications are to remote access technologies.

increase in authentications to VPN and RDP applications.

growth in cloud app adoption among enterprise companies.

of authentications are to on-premises applications.

More About Applications

Get the full 2020 Duo Trusted Access Report to learn more about:

* = required