jameeka_aron

Jameeka has over 20 years of Information Technology and Cyber Security experience. She is a versatile leader, successfully leading teams as both a CISO and CIO across various industries including; Aerospace & Defense, Apparel, Retail, and Manufacturing at both Fortune 100 and privately held companies and many spaces in between. <br>
She is highly skilled in Business Engagement (International and U.S. based) Audit, Compliance, Vulnerability, Risk and Identity Management, Digital Transformation, Mergers, Acquisitions, Divestitures, and leading Cross-Functional and Matrixed teams.

CISO

Jameeka Aaron

Rapid change introduces workforce and app risks. Auth0 Security team’s advice on what to fix now.

Fast response allowed many organizations to survive and thrive in 2020. Orgs went remote overnight; businesses launched consumer-facing apps, and [consumers shifted buying patterns online](https://auth0.com/blog/how-brick-and-mortar-approaches-improve-digital-experiences/).

Going fast gets products to market, it gives consumers choices, and it helps companies scale. But when you jump ahead seven to 10 years in your digital road map, you risk leaving a few security and data privacy concerns behind. I reached out to key members of my security team, as well as our data privacy team, to put together this three-part series based on our industry experience and observations.

Each post will focus on protecting and securing two critical areas: your workforce and your consumer-facing apps. The first post will focus on security details to check and mitigate now. The second will focus on immediate data privacy concerns with the help of Auth0 Vice President, Privacy Lucy McGrath. And the third post will help you put together a plan for the future that will make it easier the next time you want to turn on the speed — and to remain current in an ever-changing security landscape.

The thing is that security is a global team sport.  As more of us shift to working and living online, everything is more connected — and that can be a good thing. Securing your personal identity, your business identity, and helping increase security at your business can actually make an impact. Here’s what you can do to help make the internet safer for everyone.

## Why Remote Work Forced a Change in Security Thinking

Before the world started working remotely, a lot of companies used a castle-and-moat approach to security. They relied on a combination of physical security and internal networks to ensure that employees and outsiders only accessed necessary information. They might even have relied on SaaS companies to provide some of their protections, but the thinking was still pretty much “protect the castle.”

Suddenly workers were working anywhere in the world, maybe on their own devices. Without remote experience, your security team might not have had time to think through all of the security issues inherent with having remote endpoints. For example, to ensure that they properly protect these assets against current threats like ransomware and malware, it would be appropriate to install leading next-gen antivirus on these machines.

Role-based privileges and policies also abruptly needed to follow the user. I know I work for an identity company, but it was identity and policy [federation](https://auth0.com/blog/why-identity-federation-matters/) that anticipated this need and allowed for a rapid response.

[Now some companies are making work from home a permanent](https://www.businessinsider.com/companies-asking-employees-to-work-from-home-due-to-coronavirus-2020) part of their employee offering. Since Auth0 was built as a remote-friendly, globally dispersed company, we’ve had some time to think through the security concerns. Here’s what you need to consider to protect your customers, your business, and your employees:

1. **Secure the endpoints.** Services like CarbonBlack or CrowdStrike can help prevent malware or breaches occurring from endpoints.
2. **Update bring your own device policies.** Rethink how and where employees are accessing business and customer data. Do you need to restrict access in public spaces? Adjust policies?
3. **Update action policies**. What do your employees do if a work computer is stolen? What steps do they need to take if the information is exposed at home? A [1Password survey](https://www.darkreading.com/51--of-wfh-parents-say-children-have-accessed-work-accounts/d/d-id/1339754) found that 51% of work from home (WFH) parents surveyed said their children had accessed their work accounts, sometimes accidentally deleting necessary files.  How can you support your employees??
4. **Human risk is increased.** Have a look at the next section.

## The Human Element

This is the critical part of this series — **the human element is the most important aspect of security and data privacy.**

> Security awareness training needs to happen at every single level of your organization.

A malicious actor is going to use everything you need to do business — email address patterns, information on your website, social media posts, and items gleaned from news articles all to try to gain entry to your system. While the attacks will vary, they usually follow this pattern: **human factor** + inject something into the code + lack of input validation + insufficient logging and monitoring.

If something looks like it’s coming from your CEO or payroll, an employee might fall for it and supply a way into your system. And once a bad actor is in, there’s lots they can do.

But if you train your entire team to watch out for phishing attacks, you can stop them at the first step. [This post is a good place to start.](https://auth0.com/blog/protecting-against-phishing-attacks/)

Attacks evolve, so even though security awareness is something you should pause and do now, it’s something you’re going to need to do regularly. Developing a security culture throughout your org provides great protection. To do business with some industries like finance or healthcare, the training will be required to cover specific areas and will need to be documented. The training you provide can also help protect your employees in their personal lives.

## Top 7 Things to Do Now to Check Your App’s Security

This can seem like a lot if you don’t have an in-house security team (and maybe if you do). One principle of security is encouraging diversity of thought not only because it’s the right thing to do but because studies show it makes teams more productive. In security, [diversity of thought](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/innovation-in-a-crisis-why-it-is-more-critical-than-ever) makes it easier to spot potential threats. This is part of why even large teams rely on external testing vendors and may even need to provide proof of outside testing for certifications like [CSA Star](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/) and [PCI](https://auth0.com/blog/what-is-pci-a-business-guide-to-compliance/).

1. **Get an external third-party pen test — and implement the recommendations**. A penetration test is where you hire a verified third party to attempt to find your app’s vulnerabilities. They will sign a non-disclosure agreement (NDA) and provide a detailed report outlining their findings and usually with recommended fixes cataloged by severity. Discovering vulnerabilities can be scary, and there is the temptation to use fear to drive organizational change, but we’ve found that partnering and collaborating with other teams and leadership can often get changes implemented faster. 
2. **Review best practices for your cloud-based services.** When people go really fast, they may not take the time to fully understand the technology and security controls. This is a great time to go back and pay really close attention to the docs provided by your third-party vendors.

> “Many common AWS security issues, for example, happen as a result of not following AWS security best practice guidelines when setting up the infrastructure. This can lead to open and accessible EC2 security groups, public S3 buckets, unprotected EMR clusters, and more,” says Auth0 Detection and Response Security Engineer Troy Wegner (formerly of AWS and Amazon.com).

3. **[Perform static](https://www.overops.com/blog/static-vs-dynamic-code-analysis-how-to-choose-between-them/) and [dynamic code analysis](https://www.overops.com/blog/static-vs-dynamic-code-analysis-how-to-choose-between-them/)**. Static analysis reviews the code as it exists. Dynamic analysis looks for vulnerabilities while the code is being executed and for unexpected outcomes. Ideally, you want to move towards baking both into your Software Development Lifecycle (SDLC). Devs may not always enjoy adding this to part of their process—more on how to add this analysis to your long-term software development plans in the final post.
4. **Think through vulnerability management and updates**. Since humans are fallible and it’s humans who make code, it’s inevitable that you’re going to run into vulnerabilities. If you don’t have a plan for pushing updates, now’s the time to make one so you don’t hear about something BIG like the [Heartbleed Bug](https://www.vox.com/2014/6/19/18076318/heartbleed) and find yourself painfully updating ad-hoc.

> In general, you’re going to need to test every time your devs update something and whenever your tech stack libraries or any of the main operating systems updates. Services like Chef, Puppet and Terraform can make this easier by pushing updates from a central server to connected servers. In the final post, we’ll get into longer-term strategies for updates, like maintaining a Golden Amazon Machine Image (AMI) if you’re on AWS. For now, just document how and when you’re going to update and test.

5. **Threat model**. A lot of security is determining risks. Ideally, you’ve threat modeled before building your app, but in some ways, it’s easier to model after it’s live. Yes, you can hire a trusted third party to do this for you. To give you a sense of the thought process, I asked Troy to threat model this restaurant scenario. Security engineers often diagram vulnerabilities, so we also include Troy’s whiteboard as a reference.

Let’s say you’re a local restaurant who responded to COVID by offering the ingredients to make your tastiest dishes and recipes to your customers via curbside pickup. You hired someone to put the app together quickly, but now your region is opening up, and you’ve decided this channel of operations should continue contributing to your bottom line. 

![Whiteboard](https://images.ctfassets.net/23aumh6u8s0i/3qWEruezG4YZw2AwS2w4Nf/ccb3121e94d794c8baa0ec470e4b084d/diagram.jpg)
**Figure 1:** _Auth0 Senior Security Engineer - Detection and Response Troy Wegner’s whiteboard of our restaurant scenario._

* Start with authentication because you know customers need to authenticate in order to interact with your app. How are they authenticating? Are they only using a username and password? If they are only using a username and password for authentication, then you have just hit on your first major risk (user compromise/phishing/user impersonation). 
* As a way to address the first risk identified, you have chosen to go with two-factor authentication for your users. But here is where things get interesting; which 2-factor options do you want to support? There are authenticator apps, FIDO U2F, Push-based 2FA, and SMS (the weakest available option). Each option has its own pros and cons to consider.
* Since this is a restaurant, you’re also somehow connecting the app to the food supply. How are you measuring and validating your existing ingredients inventory to ensure you do not oversell based on your total ingredients available? Are you using a database to store this information? If so, where does this database live, is it protected or hardened information security wise, and if so, how is it hardened? How do you authenticate to the database, is it updated regularly, do you perform backups, etc. 
* If your service has gotten really popular, too many people might try to order at once, and that could overwhelm the app’s limits. The app could go down due to resource constraints based on how it is architected. This is basically the risk a DOS/DDOS would present in bringing your app down and making it no longer available to your customers. In order to mitigate a DDOS risk, you might have a plan to make your app more fault tolerant and highly available by using load balancing, increasing back-end servers to handle the load, or using a front-end CDN to help distribute load across various edge locations.
* Most likely, your app is taking payment and processing it in order to fulfill orders; how are customer payment and other sensitive information being handled/stored? If you accept credit cards or debit cards, PCI compliance is a concern you should address.
* Here is where you would now want to think through and fully diagram out the rest of how the app works and uncover any other risks or bottlenecks that currently exist with your app, place a severity on those risks, and determine by severity which risks you want to fix, and which ones you are ok accepting.


6. **Turn on your logs — and make sure they’re monitored**. Turning on logs can seem like common sense, but because there’s often an expense attached to logging and getting the data analyzed, the logs might not always be turned on. It’s really hard to know what to fix after a malware outbreak or other issues occur, especially if your logs aren’t turned on and are being actively analyzed. 

So this is where we tell you to turn on the logs for all the services you’re using. You should also make sure that a trusted third-party vendor or trained security engineer is watching your logs and building actionable detections based on those log sources to look for suspicious or anomalous activity.

7. **Take action**. Logs, vulnerability assessments, pen tests — these things can help you identify what needs to be fixed, but you still need to fix it. Breaches and ransomware are the obvious security problems you want to avoid. How your security challenges impact consumer behavior might not be as clear. Lost conversions, abandoned shopping carts, and low time on site are all indications that your target audience may not feel comfortable sharing their data with you. Our customers tell us that an app or site that feels secure (think smooth login, logical and smooth payment process) supports their business goals.

## If You Need More Help

Authentication is often a critical part of securing an app or workplace. If you’d like to understand how Auth0’s solutions might help make your app more secure, please reach out to the [team at Auth0](https://auth0.com/contact-us).

My next post will focus on immediate data privacy concerns with the help of Auth0 Vice President of Privacy Lucy McGrath.

<include src="asides/AboutAuth0" />

Accelerated Your Road Map? Go Fix Workforce and App Security

hunter-jensen

Hunter Jensen is CTO of Permission.io. Having launched his first website in 1998 and his first iOS app in 2008, Hunter has been at the forefront of the software design and development industry for over 20 years. He is a distinguished speaker, author, entrepreneur, and thought leader in the digital world, well-known for leading teams to release best-in-class web & mobile products, including for Samsung, Cisco, Salesforce, Avalara, and many more. Hunter joined Permission as CTO in early 2020 and helped guide the company to a successful launch of multiple digital products.

CTO of Permission.io

Hunter Jensen

Permission.io’s CTO Hunter Jensen on crypto regulation, advice for the crypto-curious, and blockchain

_EDITOR’S NOTE: Crypto (digital currency) is becoming more mainstream with crypto exchange [Coinbase’s IPO splash](https://www.ibtimes.com/whats-next-coinbase-coin-after-blockbuster-ipo-fintech-analysts-weigh-3184496) and the [creation of the cyber yuan](https://www.wsj.com/articles/china-creates-its-own-digital-currency-a-first-for-major-economy-11617634118). Permission.io’s business model uses Auth0 to protect its platform while delivering digital currency in exchange for permission-based advertising. We invited their CTO, Hunter Jensen, to pen a post to share his thoughts on crypto’s future._

Today crypto is highly volatile — investing can be a real roller coaster. But that’s changing. We just saw the first public valuation of a cryptocurrency company, with [Coinbase coming in at $86 billion](https://www.nytimes.com/live/2021/04/14/business/stock-market-today). [Governments are creating digital currency](https://www.barrons.com/articles/central-banks-are-trying-to-muscle-aside-bitcoin-what-investors-need-to-know-51618866586) or at least talking about it. Here’s why I think everyone will eventually be carrying a crypto wallet.

## What Is Cryptocurrency Anyway?

Cryptocurrency is a digital currency issued by blockchain software and regulated by a decentralized set of systems, software, and rules.

Blockchain is really just a decentralized accounting ledger that records transaction after transaction. What makes it interesting is that it's decentralized — in most cases, there's no central authority running it. Blockchain also uses really complex and complicated cryptography and algorithmic mechanisms to be able to verify each one of these transactions. If you believe in the technology, you don't need a bank to be an intermediary to know that the transaction is taking place.

It helps to contrast cryptocurrency with fiat currency, which is issued by a government decree (or fiat) and regulated by a central authority.

Fiat is stable and controlled, which means it works well as a store of value and a unit of account. You can transfer it from one place to another and have it be the same value in both places. If a country prints a lot of money, it risks hyperinflation and depression, but that takes a certain amount of time to happen. Money, as we know it, has been around for thousands of years.

It’s also expensive and time-consuming to do big complicated transactions with fiat currency. If you’ve ever tried to buy a house or send money from the U.S. to a country in Eastern Europe, for example, it can get very tricky and take a long time.

### Crypto pros and cons

Crypto is not without its pros and cons. It's much faster and cheaper and is often anonymous. You don't have to go through a trusted third-party to conduct a transaction. The benefit is that the transactions are generally faster, cheaper, and easier. But the ability to conduct peer-to-peer transactions sometimes relies on that anonymity for illicit purposes. 

Crypto is also extremely volatile. As such, it is not yet stable enough to be a unit of account. It can hold value, but the value will fluctuate dramatically. In the course of the 30 minutes I’ve been working on this post, my crypto portfolio might be down 10%, but it will come back up in another couple of hours. The main difference between crypto and Fiat currency is how it's regulated and how one transacts with it.

Like Fiat currency, cryptos can be listed on an exchange like Coinbase and be bought and sold and exchanged in a similar way to how stocks are bought and sold on the stock exchange. Currently, there are some 4,800 cryptos on CoinMarketCap, and my prediction is that number will keep going up for a while. But you can also issue crypto without listing it on an exchange. Technically it is still a token, but you can’t sell it. This means that it doesn’t have transferable value, only intrinsic value. If you’re getting into crypto, you need to be aware of what you’re really getting. More on that later.

## We Welcome Government Regulation — Really

The first thing that might surprise you about Permission.io and like-minded crypto-based companies is that we welcome government regulation. Right now, it’s the Wild Wild West out here. There’s just not a lot of predictability, which is tough on businesses.

We are seeing major companies like JP Morgan, Visa, PayPal, Tesla, and others with Bitcoin and other cryptos on their balance sheets. But it’s also not clear how a company like [Tesla is going to report Bitcoin on their taxes due to the lack of regulation](https://fortune.com/2021/04/27/tesla-tsla-bitcoin-btc-bet-how-much-has-it-made-elon-musk-profits/#:~:text=Result%3A%20Tesla%20still%20holds%20around%2038%2C300%20Bitcoin%20that%20cost%20%241.329%20billion). (Tesla no longer accepts Bitcoin for purchases, [other car dealers are still accepting the cryptocurrency](https://www.caranddriver.com/news/a36434628/tesla-bitcoin-wont-accept/). In the U.S., in particular, there’s a real patchwork of regulations that can make it hard for companies to comply or even conduct an ordinary business.

But that challenge isn’t making digital currency go away. As I said, the numbers are growing, and governments themselves are getting interested in digital currency. 

The global crypto market’s been estimated at $1.99 trillion according to my latest check of [CoinMarketCap](https://coinmarketcap.com/). China has already created the [cyber yuan](https://www.wsj.com/articles/china-creates-its-own-digital-currency-a-first-for-major-economy-11617634118). The U.K. has formed a task force to explore the creation of [‘Britcoin](https://www.reuters.com/business/finance/uk-launches-taskforce-potential-bank-england-digital-currency-sunak-2021-04-19/).’ In [Latin America](https://www.spglobal.com/marketintelligence/en/news-insights/latest-news-headlines/crypto-s-2020-boom-sparks-interest-from-latam-legacy-banks-61781257), legacy banks are also noting the need for regulation. In the U.S., the Biden administration put former investment banker and crypto professor [Gary Gensler](https://www.investing.com/analysis/secs-gensler-will-spur-next-leg-up-for-cryptocurrencies-market-crisis-ahead-200575268) in charge of the Securities Exchange Commission (SEC). Gensler’s strong opinions on crypto will likely drive clarity through regulation. In the United States, I’m expecting regulation later in 2021 or in 2022.

## Want to Get into Crypto? It’s Not for the Risk-Averse

Think of someone with high-net-worth. If that person has crypto in their portfolio, it’s probably their highest-risk asset unless they’re doing early-stage startup investing. With crypto, only risk something you’re ready to lose. This is not the place to risk your retirement savings. Crypto is extremely unpredictable and volatile. 

But if you’re still crypto-curious, here are some critical pointers:

* **Make sure you’re trading on a well-known and reputable exchange.** There are some dangerous exchanges that might run away with your coin. Make sure you’ve[ researched the exchange](https://www.investopedia.com/best-crypto-exchanges-5071855) for reputation and reliability, and make sure that you can safely trade in your country. Sometimes you might be allowed to buy crypto but then find that you can’t trade it due to your location.
* **Watch out for phishing attacks.** [Phishing](https://auth0.com/blog/phishing-goes-viral-covid-19-themes-in-cybercrime/) relies on tricking users into giving up information that gives malicious actors access to their accounts. While anyone who uses digital systems is a target, crypto can make you a tastier target. Stay up-to-date on the most common exploits. Pausing before you click can protect your coin.
* **Crypto timing is minutes, hours, days, weeks — not years.** When you're trading stocks, you're thinking in terms of days, months, or years. Crypto trading is in minutes or hours — sometimes days or weeks. There are people who are thinking in terms of years, but since crypto hasn’t really been around that long, that’s extremely unpredictable.
* **Trading happens 24/7.** In the U.S., the stock exchange runs Monday through Friday with holidays off. Crypto is 24/7, not a day off — always on. If you’re in the U.S., for example, when you get up in the morning, people in Asia have been trading all night. This can have a big impact on your crypto wallet.
* **Only risk what you’re willing to lose.** Repeating this point because it’s important. This is a highly volatile, under-regulated space. Take care to protect yourself.

## How Secure Is Crypto Really?

Bitcoin itself is incredibly beautiful in terms of how secure it is. Every line of code is wide open, which means that some of the smartest minds in the world have spent years trying to break in and haven’t succeeded yet.

But in the news, you’ve probably seen stories about “the Bitcoin Hack.” Bitcoin didn’t actually get hacked. Companies in the Bitcoin ecosystem got hacked. The [cryptocurrency hardware wallet Ledger](https://www.forbes.com/sites/billybambrough/2020/12/23/massive-hack-exposes-bitcoins-greatest-weakness/?sh=4730b594da7d) exposed data through a vulnerability in their site that exposed their e-commerce and marketing database. So the bad actors got people’s emails, phone numbers, and the last time they visited the site, which made it easy for phishing attacks. 

When you think of everyone using the internet, much of our data is already out there. If bad actors know someone has a crypto wallet, it can make them a focused target of phishing attacks designed to convince folks to give up their private keys.

So while you have a core system — Bitcoin — that is very secure, you still need to secure all the third-party systems that hold information about that data. Securing crypto needs to be like the American banking system — you need to create a strong ecosystem and remain vigilant. It wasn’t that long ago that Americans were dealing with card skimmers when they used their debit cards at the gas station. Banks had to respond by adding chips to cards. Any industry with sensitive data is going to need to remain vigilant.

Like a bank, Permission.io needs to know the true human identity of every single user in our system. We need to be able to transport that identity from system to system and to third-party systems and know that they haven’t been broken into. 

In the traditional banking financial system, you have to go into a branch and show somebody your driver's license and very clearly prove your identity. It's a lot harder to do that in the digital space, but identity management alongside other security measures is completely critical to the infrastructure of the entire cryptocurrency system.

## The Future of Crypto and Blockchain

Three years ago, blockchain was still an experiment for a lot of industries. That’s changed. A supply chain is probably the biggest adopter of blockchain after crypto. We see [Walmart](https://www.computerworld.com/article/3454336/walmart-launches-world-s-largest-blockchain-based-freight-and-payment-network.html) and other companies turn to blockchain to solve challenges. Blockchain’s also in use in the insurance industry, fintech, energy, and medical records. Because blockchain offers an immutable record, I expect we’ll see even greater adoption as the ecosystem of third-party support around blockchain uses continues to expand.

Crypto, like blockchain, is maturing. Recently, [Elon Musk sold off 10% of Tesla’s Bitcoin](https://www.bloomberg.com/news/articles/2021-04-26/musk-tesla-sold-bitcoin-to-prove-liquidity-as-cash-alternative) investment. On Twitter, Musk said he did it “to prove liquidity of Bitcoin as an alternative to holding cash on the balance sheet.” These actions will likely speed regulation. 

Five years from now, I believe we’ll have clear regulation. 

We will see a consolidation of coins. Those that don't have big backing financially and don't have utility will go by the wayside. I believe we will see a lot of national governments issuing their own digital currencies. We’ll have seen a consolidation of coins, and the ones that remain will be a stable way to transact.

In 10 years, I think the average person will start thinking about value in terms of bitcoin. Bitcoin itself will be a unit of account in a store of value.

There are three things that a currency needs to be mature and stable. It needs to be transferable, it needs to be a unit of account, and it needs to be a stable store of value. There’s still a lot of volatility right now, but as crypto matures, I think this is where we’re headed. Crypto will become a bigger part of businesses and governments, and life for average people.

The not-so-hidden bit is that I’m just not so sure that governments are going to be in charge of money for that much longer. The decentralization of economic and financial systems is scary for them. But if governments lean into it, they can make it work. If they fight it, then I believe that it's going to be even more problematic for them for the simple reason that you can’t control a banned currency. Instead, if governments choose to regulate and tax crypto, then the entire system becomes a more stable opportunity for everyone.

For further information, read the complete case study [here](https://auth0.com/case-studies/permission/).

The Future of Crypto

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Actionable Advice from Women Who Code InfoSec Panel + Auth0 QAs on How Women Can Transfer Skills to Help Close that Gap



By 2021, there will be [3.5 million open cybersecurity jobs globally](https://cybersecurityventures.com/jobs/), reports Cybersecurity Ventures. [Worldwide](https://cybersecurityventures.com/women-in-cybersecurity/), women hold 20% of the filled positions.

<include src="TweetQuote" quoteText="Actionable advice on how women can transfer skills to fill the project 3.5M gap in cybersecurity talent. @womenwhocode"/>

[Women Who Code](https://www.womenwhocode.com/), a nonprofit dedicated to supporting women’s career growth in the tech industry, sponsored a panel of seasoned InfoSec professionals from [Nike](https://www.nike.com/us/en_us/?ref=https%253A%252F%252Fwww.google.com%252F), [Intel](https://www.intel.com/content/www/us/en/homepage.html), [Google](https://www.google.com/about/), and [Auth0](https://auth0.com/) at their [Portland chapter](https://www.womenwhocode.com/portland). The panel shared how they got into cybersecurity, what they’re looking for when they hire talent, and how interested applicants can easily transfer their skills to lucrative cybersecurity roles ([full video](https://youtu.be/lAraWX64ZJw)).

<include src="TweetQuote" quoteText="Discover what it’s like to be a woman in InfoSec at @google, @intel, @nike, and @auth0. —and find out how to make the most of your opportunities. @womenwhocode  (https://youtu.be/lAraWX64ZJw) "/>

Auth0 Former CISO/VP Operations **Joan Pepin** suggested we reach out to two other women on our cybersecurity team to talk about how they ended up in InfoSec, what it’s like to work at Auth0, and advice for women looking to break into the field.

## Annybell Villarroel, Security Operations Manager 

![Annybell Villarroel, Security Operations Manager](https://images.ctfassets.net/23aumh6u8s0i/PMOss4ZNEJdF9Rum21Quy/66839db9c86453c90d646c6b6612b9af/annybell-villarroel)

Anny started working with Auth0 as a contractor back in 2015. She joined the company as a technical support engineer in 2016 and has since transferred her skills to infosec by becoming our security operations manager.

### What made you make the switch to security?

While working on a ticket, I realized something that could potentially be used in a phishing campaign. I did a quick experiment with a small sample group to gather feedback, and we noticed that our training could be improved in different ways. After hearing about the project, Jon Gelsey, our CEO at the time,  suggested to Joan (Auth0’s Former CISO) that I work in security. I got offered my current role. 

### Tell us about your current role

Besides managing projects for our Security Team, I’m preparing our Security Awareness training as well as our quarterly phishing campaigns. I recently took training at the Black Hat Conference to learn best practices and how to raise our general security awareness through [social engineering attacks](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/).

### How have your skills transferred?

As a support engineer, I learned a lot about the product itself, knowing the historical context and how it works has been useful for a few projects in the security team and my experience talking with customers has helped me with the training. I believe that asking “why” and trying to find the root cause of the problem can be useful in any project.

### What’s been the biggest challenge so far?

It’s been pretty smooth and I feel very supported in this role and the team is super-great. If I don’t know something everyone is willing to help. 

### There are a ton of jobs for women in InfoSec. Why work for Auth0? 

The job was offered to me and in general, the opportunity was given. I really like the culture here and have an emotional connection to the company. I’ve seen it grow. Auth0 is a security-first company and I find it rewarding to do work that fits with our mission statement of making the internet more secure.

### What advice would you have for women breaking into InfoSec?

Don't be afraid to ask security engineers for help. Be willing to make experiments, and take online courses on your own to learn. Practice with Capture The Flag challenges with a mentor that can guide you, and if you like to understand people or are a people person, learn about Social Engineering. **We’re hiring**.

## Eva Sarafianou, Application Security Engineer

![Eva Sarafianou, Application Security Engineer](https://images.ctfassets.net/23aumh6u8s0i/1WB3sUlt6NSIx4GFKnqb9T/6d148e76110d0246bd276b8943a15f27/eva-sarafianou)

Intrigued by cryptography’s underlying maths, research, and study while working on her masters at the University of Athens led Eva to a career in InfoSec, which she describes as “a whole new world.” Eva joined Auth0 in Aug. of 2018.

### Tell me about your current role

I work as an application security engineer. In the Product Security team we work closely with the developers, try to find vulnerabilities in our codebase and give guidelines for mitigation. We’re working on security automation, building tools that will help the engineering team write secure code by default and we're also responsible for the vulnerability disclosure program

### How have your skills transferred? 

A few months prior to obtaining my master's degree, an internship for security consultancy gave me the opportunity to start applying security in industry instead of academia, specifically web security and mobile — how many things you can control as a user even if you shouldn’t. And how, if you really dig into it you’ll usually find something interesting, even if a code does seem very secure. It may not be something huge, but security is an ongoing effort. It never ends. Even with something small, some very sophisticated attacks are possible.

### What’s been the biggest challenge so far?

Being a woman in InfoSec. During my internship, we were visiting customers for assessments and because I was young and the only woman in the office, the customers asked my manager whether or not I knew things. I had to put in extra effort to make sure the customers believed that I knew what I was doing and could explain things. It got better over time, but male interns who came to the office after me didn’t receive questions like these.

### Anything seem surprisingly easy?

I think the problem most engineers have is that they love working on their computer and digging into code. If they have to explain this to a non-technical person, they find it a bit difficult. It’s easy for me to take an issue step-by-step and make sure that somebody without the technical background understands.

### There are a ton of jobs for women in InfoSec. Why work for Auth0?

I knew Auth0 four years before I joined and really liked the product and the culture. Remote working is the most productive thing.

### What advice would you have for women breaking into InfoSec?

First of all and maybe take a direction in college and university that has to do with a computer. Be confident. I think that in InfoSec — not in Auth0 — there are many people who believe they are experts and will ask you “why” in a not very friendly way always. Always ask what you don’t know.
I’m usually the only woman on my teams — even at Auth0, in our small team, I am the only woman. Feel confident and don’t feel at all weird that you’re always a minority.
If we want more women in tech, as companies and we can do participate in organizations like WWC, but this needs to be spread to the world — it’s how parents raise their daughters. My parents were the same with me as they were with my brother — no change. I was never the little girl that had to be protected and I think that helped.

<include src="TweetQuote" quoteText="Find out what’s like to be a woman in InfoSec (https://youtu.be/lAraWX64ZJw)  — and learn how to get the most out of lucrative cybersecurity job opportunities. @womenwhocode"/>


3.5M Open Cybersecurity Jobs Worldwide by 2021

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

Join us for Avocado Lab talks, advice on setting up your own bug bounty program, and learn a bit about what we're doing to improve our cybersecurity stance



Building and maintaining a security culture where employees make secure decisions, trust and collaborate effectively with the security team, and feel empowered rather than afraid is key to being a trusted brand that makes the internet safer. Each October, National Cybersecurity Awareness month gives us an opportunity to celebrate that effort.

At Auth0, we focus tremendous efforts on both our organizational culture and our security culture, since Security is at the core of what we do, and trust is one of our key principles. Throughout the year, we provide training tailored to each of our audiences, run multiple engagement programs, as well as context-specific awareness campaigns. So we can't miss the opportunity of celebrating October National Cybersecurity Awareness Month both internally and externally.

This year Auth0 is hosting several events for the community:

* [Avocado Labs](https://avocadolabs.dev/) Online Talks: 
    * [Look! There's a threat model in my DevOps](http://avocadolabs.dev/events/avocado-labs-episode-13/). Alyssa Miller, Application Security Advocate - Snyk
    * [Trust: From Zero to Hero](http://avocadolabs.dev/events/avocado-labs-episode-12/), Annybell Villarroel, Security Culture Manager - Auth0
* Social media content highlighting those who keep us safe, those who create the tools and features we need, those who make it safer for us.
* Content on the Death of the Corporate Network from Senior Director of Engineering Duncan Godfrey, securing Node.JS Senior Manager, Product Security Marcin Hoppe, advice from CSO Joan Pepin on setting up your own bug bounty program, and a guide to treating identity as the perimeter from Cybersecurity Researcher Kim Berry. 

For our employees, we will have internal challenges and experts from our Security team as well as industry-leading guests will provide talks focused on a wide range of topics:

* **OWASP Top 10:** Jim Manico (@manicode), Founder & Secure Coding Instructor at Manicode Security, will come to give us a remote training session on OWASP Top 10
* **Hacker mindset and Burp Suite Training:** Katie Paxton-Fear (@insiderPhD), Ph.D. Student, Occasional Bug Bounty hunter & Educational CyberSecurity YouTuber, will teach us how to think like a hacker and how to use Burp Suite.
* **Internal Bug Hunt Challenge:** to encourage employees to safely find vulnerabilities in Auth0. High or Critical severity findings get added to our internal Hall of Fame, receive swag prizes, and get company wide recognition.
* **Security Demo Day:** this session walks employees through a vulnerability found in the platform and showcases discovery, exploitation, and remediation.
* **Phishing Challenge:** we run phishing campaigns on a regular basis. Now, we are reversing the roles, and employees will have the chance to phish our Security Culture Manager, who will also explain to them how to do it safely.
* **InfoSec Career Panel:** the path to infosec is varied within our team; in these sessions, we will talk about personal experiences, learning paths, skills requirements, and we will have a Q&A session.

At the end of the month, all employees that complete a series of goals will participate in a raffle for prizes.

At Auth0, we are passionate about providing secure access to everyone but not just anyone, and we believe that empowering our employees to have a strong security mindset in their personal and professional lives is key to achieve this goal.

We invite you to come to celebrate with us through our external events. Happy National Security Awareness Month! 

<include src="asides/AboutAuth0" />


National Cybersecurity Awareness Month (NCSAM) at Auth0

Jose-Romaniello

I started working at Auth0 before the first line of code for our authentication platform existed. I’ve been able to go through the journey of seeing our ideas go from prototype to living production code that impacts millions of people. It’s satisfying to know that my actions here are having a positive impact in solving problems for developers like me.

Head of Engineering

Jose Romaniello

Learn how to apply the Scout code to software development to get code to a better state continuously.



When I was a kid, I practiced [_Scouting_](https://en.wikipedia.org/wiki/Scouting) for eight years I picked up a lot of excellent values and my scouting experiences helped to shape my character and make me a better programmer. Let me show you why.

As a Scout, you get to experience nature by camping outdoors which teaches you one of the core values — **respect life**. Scout rules help support core Scout values. One of the first rules I learned was:

> Always leave the campground cleaner than you found it.

This rule comes from a quote by [_Robert Baden-Powell_](https://en.wikipedia.org/wiki/Robert_Baden-Powell,_1st_Baron_Baden-Powell), founder and first [_Chief Scout_](<https://en.wikipedia.org/wiki/Chief_Scout_(The_Scout_Association)>) of [_The Scouts Association_](https://en.wikipedia.org/wiki/The_Scout_Association), and founder of the [_Girl Guides_](https://en.wikipedia.org/wiki/Girlguiding):

> Leave this world a little better than you found it.

What this rule represents is that you should not only pick up your trash, clean the area where you started a wood fire and the soil where you built your tent, but also you need to take a look at the campsite and do something to leave it better than it was before.

It is an explicit instruction. It helps you accept the notion that something can always be better. There’s always room for improvement. You had the opportunity to enjoy the area and its resources but you also have the opportunity to pay back by leaving the area in better shape for others.

I believe that when kids are taught this kind of values through games, repetition, and rewards, it becomes a habit. This is nominally known as [_positive reinforcement_](https://en.wikipedia.org/wiki/Reinforcement#Positive_reinforcement). Positive reinforcement takes place when a reward is presented as the result of certain behavior and the behavior increases. This trait has been embedded in my mind so that I don’t need to apply it consciously. It has become a behavioral reflex that integrates naturally in my day-to-day activities.

## The Codebase Is the Developer's Campsite

Even if I don't go camping often nowadays, I follow this rule in a lot of different situations in my life. One of them is in my daily work — programming!

Working on a new feature or a bug feels excellent. Working on a codebase change feels like camping as a Scout. It is an opportunity to:

- Experience the environment.
- Understand the problem.
- Put what I know in practice.
- Use my skills to create solutions.

The codebase will host me for hours or days. Even if I don't enjoy the codebase too much, I still have to respect it because other people have worked hard on it. It gives me an opportunity to learn new things and to possibly use tools I have never been exposed to before.

<include src="TweetQuote" quoteText="Even if we don't enjoy a codebase too much, we still have to respect it because other people have worked hard on it. We can work on taking little steps to improve it."/>

Once again, I have to assume that other people will get to "camp" in the project after me. People I haven't met yet and probably will never meet. They may be developers, project managers, even end-users. As thought leader and software craftsman [_Uncle Bob Martin_](https://twitter.com/unclebobmartin) says in his [_Scout Rule_](https://www.amazon.com/Things-Every-Programmer-Should-Know/dp/0596809484):

> “Indeed, the act of leaving a mess in the code should be as socially unacceptable as littering. It should be something that just isn't done.”

Therefore, not only my work in the codebase needs to be clean, but it should leave the code at least a little better than I found it.

These are some examples in which I have applied this improvement of the status quo within a project:

- It took me 30 minutes to understand what this function does. Can I rename it to something more declarative or expressive so that others can understand it quicker than I did?
- I wasn't able to run this project with the provided instructions. Can I write the instructions that I followed but are not documented in a README file?
- This code is more convoluted than it should be. Can I make it easier and clearer?
- This function doesn’t have enough tests. Can I add some tests?

These small improvements will help my teammates and myself later. The code is not going to end up perfect, but it will be better than it was before. By following this practice, the code grows in a better direction with every action that you take on it.

<include src="TweetQuote" quoteText="Small but powerful actions for teams that improve a codebase gradually: Vague naming? Make it explicit. Confusing code? Make it clearer. No documentation? Add steps to the README. Missing tests? Write one."/>

I have been doing software development for years and being a Scout had already prepared me to transfer the mindset and values exposed by Uncle Bob from the campsite to the codebase. But this approach is not an excuse for not allocating exclusive time and developers to fix issues in a codebase; it is just one way to continuously get things to a better state.

![Binary tree - example of clean code growing organically and gradually following the Scout development approach.](https://images.ctfassets.net/23aumh6u8s0i/5KLuJlW0dEoHg3Wf03i7t9/a11e8be6f2480802675a8d4daaf6c3c2/Binary-Tree)

<include src="asides/AboutAuth0" />


A Scout Approach to Software Development

Auth0 CISO Joan Pepin to speak Women Who Code Portland’s Networking Night + leadership advice video.



Want to know what it takes to be a successful woman in infosec?

Join us at [Women Who Code Portland’s Networking Night](https://www.meetup.com/Women-Who-Code-Portland/events/253324140/) on Thursday, Aug. 16 from 5 - 8:30 p.m. to hear what this group of notable women have to say about how they got into InfoSec, what their roles are like, and advice for someone breaking into the field. (Special thanks to sponsor [Mozilla](https://www.mozilla.org/en-US/).) The panel will include:

- **Joan Pepin** , Chief Information Security Officer (CISO) and VP Operations, Auth0
- **LJ Johnson** , Sr. Director, Information Security, Nike
- **Miki Demeter** , Security Researcher, Intel
- **Moderator:** Ann Wallace, Technical Cloud Consultant, Google

Recently, Joan expanded her Auth0 CISO role, adding VP of Operations to her title. As a preview, we asked her to offer some leadership advice for people stretching into new roles:

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4">
   Your browser doesn't support HTML5 video. Here is a <a href="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4">link to Joan Pepin Leadership video</a> instead.
</video>

</NonAmpContent>

<include src="TweetQuote" quoteText="Stretching into a new role? Here’s some advice from @CloudCISO_Joan — and an opp to hear her in person in Portland this week! #WWCode"/>



Auth0 CISO Joan Pepin to Speak at WWC Portland Networking Night

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Practical advice for mitigating your risk of identity theft.



Nobody wants to get their identity stolen. In fact, it's probably one thing that is pretty much universally feared. Not only is it scary to think that someone else could access your personal information and take your debit card on a joyride, it can also be a hassle to get everything back in order after suffering from identity theft.

We've put together this article to help you protect yourself from identity theft. Short of going off the grid and living anonymously in the woods, here are the best practices to reduce your risk of having your identity stolen.

## Refresher on personal security

This isn't the first time we've talked about protecting your identity on the Auth0 blog. So, here's a refresher of what we covered in our [most recent article](https://auth0.com/blog/personal-information-security-identity-guide/) on the topic before we begin: 

* **Use multifactor authentication.** Most apps, email platforms, and websites offer some form of multifactor authentication, the practice of using multiple devices to verify entry into an account, so check if it's available for your accounts (email, etc.) and set it up. 
* **Stay secure on social.** Use strong passwords, and update your security settings. 
* **Learn to identify and avoid phishing emails and phone scams.**
* **Protect your home wifi network** by setting up a password. 
* **Use a password manager** so that you can use a unique, strong password for each of your logins.
* **Only use secure wireless networks** and try to avoid unsecured, public wifi.

These are all common-sense suggestions to keep your accounts safe — we all know that we should use a strong password and install an antivirus. So now that we've covered the basics, let's look at some more ways you can protect yourself from identity theft and keep your information secure.

## Signs of phishing

In our previous post, we warned of email scams that can be malicious attempts to collect passwords and other data. Here are some more tips to avoid being duped by phishing.

* **If an email asks you to login to your account and provides a link — don't click!** Instead, type the link directly into your browser. For example, [this](https://twitter.com/benthompson/status/843855792587460610) fake email contains a link that could be legitimate, but redirects you to a malicious website:

![Phising Email](https://images.ctfassets.net/23aumh6u8s0i/4gX377dZcxFagpWph90TX7/d703bca802760f884d6196c5545e60a5/phishing)

* **Pay attention to the URL of the websites you use to log in or enter other information.** Most websites have a lock to indicate that they are “secure.” This is an indication that any data moved between the website and the web browser is encrypted, but it **isn't** an indication that the website itself is not malicious. This means websites like “www.login-paypal-inc.com” can be marked as secure, despite obviously posing as an extension of PayPal. If you're putting in a password or payment, double check the URL — and if it seems a little fishy, do a quick search of the company you're trying to interact with and see if the URLs match.

![Checking HTTPS](https://images.ctfassets.net/23aumh6u8s0i/6Hyhzu6s3D04GtZMZc5ZK7/17d1e4433a1f315cab6caaf49fff5ac6/https-check)

## Securing your email

Aside from having a strong, unique password, you should:

* **Use fake answers to security questions.** Instead of really using your dog's name or hometown, either make up answers that you can remember, or use answers that are close, but not quite — for example, your best friend's hometown instead of your own.
* **Take advantage of account security checkups.** Check to see if your email provider has a security checkup option, and set aside some time to run a checkup on a regular basis. For example, Gmail offers security and privacy checkups:

![Google Privacy Checkup](https://images.ctfassets.net/23aumh6u8s0i/3j8qZzvRrXK1hUeh5kmHAI/c6178ca33ee3fb94635c349a6e2045e5/privacy-check)

* **Keep your recovery information up to date.**
* **Log out.** If you log in to your email on a friend's or a communal computer, make sure you log out and remove your email from being an automatic option for sign in.

## Protecting your financial information

Financial information is always a target for theft. Follow your common sense:

* **Check your bank, credit, and debit card statements.** The more often you check, the more likely you are to notice a fraudulent charge. While it's probably best practice to look in on your accounts every day, aim for at least once a week.
* **Sign up for account alerts.** Most banks offer alerts via email, text, and push notifications. Depending on your banking provider, you should be able to trigger an alert when your account goes under a certain balance, when a payment is made, or even every time a purchase is charged to your account. 

![Account Alerts](https://images.ctfassets.net/23aumh6u8s0i/1pyuqlREl4blvsHy1786gm/4c2772b7d01e761f8adb584b278597bd/avail)

* **Check security settings on payment apps.** Most apps that allow you to easily transfer money from person to person, like Venmo, have more security available than what is set as default. Make sure you take advantage of all available security options.
* **Don't use a shared device to check accounts.** 
* **Don't save your cards on any websites.** Although the convenience of having a card available on your favorite websites is tempting, resist! If a hacker figures out your email and password on a shopping website, storing your card information only paves the way for people tapping into your bank.

## Avoiding skimmers

Another big piece of keeping your financial information safe and avoiding identity fraud is not getting your card information and PIN number “skimmed” at an ATM. Here are some ways to combat this particular issue:

* **Always cover your PIN number.** Some thieves will place cameras on ATMs to nab your PIN number. Cup your hand around the keypad to block your hand from view when you punch in your number.
* **Use ATMs in banks when possible.** Since bank ATMs are monitored with cameras, they are less likely to be the target of thieves using skimmers. Even if you have to pay a small transaction fee, it could be worth heading to the nearest bank to make a withdrawal. 
* **Give your ATM a jiggle.** Although it might look weird, trying to move the plastic around an ATM's card reader is a good habit to get into. ATMs that haven't been tampered with will not budge, but if you feel a wiggle, someone might have attached a skimmer to the card slot. 
* **Use a credit card instead of a debit card.** Debit cards are cash transfers that [require](http://www.pcmag.com/article2/0,2817,2469560,00.asp) a FDIC claim to reverse, which can take weeks. Credit card transactions, however, can be stopped or reversed almost immediately.

## Medical insurance

Although most of us do not store our own medical data in our houses or on our computers, one big target of identity theft and fraud is your medical insurance. 

While it's important to keep your insurance card handy, make sure that any copies or record of its data is secure. 

Most importantly, **check your explanation of benefits**, which shows services that your insurer helped cover. If you notice any procedures that you didn't get, contact your provider immediately. Aside from being a victim of fraud, having your medical insurance stolen can put you in the unfortunate position of having inaccurate medical data tied to your record if you don't deal with it swiftly.

## Device disposal 

When you're ready to move on from your old computer, phone or tablet, make sure to properly remove or destroy all information that you had on the device. This is an especially important step if you're passing your device along to be used by someone else.

**For computers**, wipe or destroy the hard drive prior to disposal. Accessible advice for wiping your computer can be found on the [FTC website](https://www.consumer.ftc.gov/articles/0010-disposing-old-computers).

**For phones**, wipe the memory and remove any SD cards, destroy them if you don't plan on putting them in another device. Accessible basics of wiping your phone can be found on the [FTC website](https://www.consumer.ftc.gov/articles/0200-disposing-your-mobile-device), and [CNET](https://www.cnet.com/how-to/how-to-wipe-your-phone-or-tablet-before-selling/).

## Get your setup running and then build good habits

If this list seems overwhelming, take a deep breath! It all boils down to two things: getting a good setup in place, and getting into good habits. 

Make sure your passwords are secure and update your social media privacy settings. 

Then, try to build good security habits into your everyday life, whether that's checking the charges on your credit card, or setting a calendar reminder to check in on your explanation of benefits every once in a while. 

Although we all want to think of identity theft as something that happens to someone else, it's not worth putting your identity at risk when there are relatively easy steps you can take to mitigate the risk. 


How to Not Get Your Identity Stolen

667b1c82b6cc2241ff176d50c65da603?s=200 avatar

667b1c82b6cc2241ff176d50c65da603?s=200

Guest Author

Eugene Kogan

Security is a challenge at most startups. Here's some advice on how to create a data breach response plan for the worst case scenario, a large-scale data breach.



A serious data breach can have massive negative repercussions for any organization, including the loss of customers, revenue, reputation, even intellectual property. For a startup, it can mean the end of your business. 

## Security for the Lean Startup

Unfortunately, startups are often completely unprepared to deal with a major security incident that involves a breach of sensitive data. Unlike larger, more mature organizations, startups have no choice but to be lean and spend their limited resources carefully. Startups are also worth much less than bigger companies, and all of their energy is focused on growth and proving a business model. So it’s no wonder that they tend to spend less time and money on issues like security, let alone data breach response.

On the other hand, no one wants to see their fledgling company go out of business because of a security breach. So how much time and money does it make sense for a startup to invest in preparing for a breach? I think of planning for the worst as somewhat of an insurance policy. You hope that a data breach doesn’t happen to your company. You put some effort into preventing one through reasonable security controls. But just in case something goes wrong (like if that small security incident suddenly becomes a breach of your credit card database) you want to be prepared.

Now that I’m responsible for security at Auth0, issues like this are increasingly on my mind. It’s my first time working at a startup, having spent the last 15 years working security at huge organizations like AT&T, Amazon.com, and the US Department of Defense. These folks are seriously prepared for anything, from a laptop with malware to a major natural disaster. But when you join a startup, you quickly learn how to pave the road as you’re driving it. Auth0 is a rare startup, since security has been a core part of our business from day one. But even for us, it can be hard to find enough time to plan for unlikely (yet potentially devastating) scenarios like a data breach.

## Data Breach Response Plan is sort of a Big Deal

Let’s assume your startup has enough valuable intellectual property, a growing user base, and increasing amounts of customer data. It’s likely that you’re already dealing with security incidents on a regular basis. You have a decent incident response plan that is sufficient for the common security issues that small companies face, and it’s probably not a big deal to quietly take care of these in-house.

A data breach is not a run of the mill security incident. What I’m talking about here is a major “oh crap” moment when you realize your entire user database was posted on Pastebin, along with those passwords you meant to [hash](https://crackstation.net/hashing-security.htm) with something better than SHA-1 but didn’t quite get around to doing. (It’s ok, we’re a startup, right? No! Bad startup! That’s what [Auth0](https://auth0.com) is for.)

## Planning for the Worst

So how would your company respond to such a breach? Do you know the legal requirements for notifying your customers? Should you contact law enforcement? Who do you call first and how long can you wait? Every data breach is different, so I’m not going to attempt to provide specific answers to these questions. A lot will depend on how big your business is, how many users were impacted, where they live, what kind of data was lost, and so on. 

** My goal is to help startups prepare for a data breach and to come up with a simple response plan without spending too much money. **

For a small company trying to respond to a major security incident like a data breach, the best thing to do is to ask for help. It’s just not practical or realistic to have all the necessary expertise in-house, at least not until your business can justify having a very large (and expensive) information security organization.

** I recommend having the following relationships in place _before_ you need them: **

* Cyber liability insurance
* Legal council with data breach experience
* Public relations (PR) firm with data breach experience
* Incident response (IR) and digital forensics consulting firm

Having these vendors under contract prior to an incident occurring is critical. I hope it’s obvious why you’d want cyber insurance in advance, just like you’d want car insurance before getting into an accident. But there are several good reasons for lining up the rest of your response network in advance. First is the issue of timeliness. It takes time to negotiate a contract with a new vendor, even at a startup. But when you’re responding to an incident, you don’t have any time to spare. You’re already late! Also, a lot of the best vendors will be booked up for weeks in advance, working for their current customers. If your plan is to call an IR firm and hope that they can come help you later today, you will be sorely disappointed (or shocked by how much they want to charge you).

## The Costs Involved

Speaking of cost, there are ways to help reduce the upfront expense of being prepared while simultaneously reducing the cost of an eventual response. Lawyers are expensive, and I don’t have any tips on fixing that problem just yet. So pick a good lawyer with a track record of working on major data breaches, and sign a contract to have him or her on a retainer. You should be able to do this without paying much (or anything) up front.

A public relations firm will be a major asset when it comes time to communicate with your customers. The way a company handles a data breach in the public eye can have a huge impact to how people react. You want to provide just enough details but no more, be accurate so you don’t have to issue a correction later, and take responsibility when appropriate. A PR firm with experience in dealing with data breaches will be able to help you get the right message across. That can go along way to mitigating the damage to your reputation and hopefully reducing the number of lost customers. Once you have a PR firm finalized, it may be worth paying them to draft up some boilerplate press releases for potential breach scenarios, just to save time later on.

Something to keep in mind is that even if you already have a PR firm that your startup uses for standard PR needs, they might be totally clueless when it comes to security incidents. You need to ask them the right questions to find out. If your current firm isn’t up to speed, it’s worth having a second PR firm on board just for breach response. Remember, you want to take responsibility for what happened and be honest in your communications, so don't let anyone try to talk you into denying everything or shifting blame.

## Using an Incident Reponse Firm

Do you really need an external IR firm to help you respond to a data breach? If you’re a startup, the answer is almost definitely _yes_. First of all, it’s unlikely that you have a security team with deep technical expertise in digital forensics. You need that expertise to be certain that the cause and extent of the breach has been accurately identified. And if you can’t be sure of that, then you can’t be sure the breach has been fully contained. This is especially true if the cause is an intentional intrusion by an attacker, who may be actively evading your response efforts. For a serious breach that involves law enforcement, you’ll be grateful to have security consultants with LE backgrounds helping you out.

Even with a team of experts, there is never a 100% guarantee that everything has been found and cleaned up. But you stand a much better chance of doing this correctly if you engage an experienced IR firm. Also, when it comes time to do a press release, having a well-known firm on your side will help your users feel like you’re taking the incident seriously.

When choosing an incident response firm, reputation goes a long way. The firms with better reputations attract better talent, at least on average. As always, it pays to ask around for recommendations from people you trust. The bigger firms are generally all decent, and will have several advantages over the smaller firms. First, all major firms offer a zero cost retainer option, so you can sign a contract and have them ready to go without spending any money upfront. Second, they will probably be quicker to respond than a smaller firm, simply because they have more consultants available at any given time.

Another advantage bigger firms have (not just IR, this goes for PR and legal as well) is their breadth of experience. This can be especially important if your startup has customers in foreign countries with strict privacy laws or notification requirements, or if you’re using a complex or niche technology stack. Is your product built with OpenBSD, Scala, and Spark, hosted on Oracle’s cloud? You should probably make sure the IR firm has people with experience using those technologies. Startups tend to be on the bleeding edge and most security consultants simply can’t keep up.

## You Need Insurance

Up until now I’ve mostly avoided talking about cyber insurance, partially because I hate the word “cyber.” But the reality is that every significant business should have some cyber liability coverage to help absorb the financial burden of a large-scale data breach. You will need a policy that’s tailored to your company, its projected growth, and the risks associated with your industry.

The first step to getting cyber insurance is to find a knowledgeable broker. It pains me to say this, since we techies generally don’t enjoy dealing with middlemen like brokers, but that’s really the only way to go at this point (until a startup comes along and successfully disrupts this model). Again, ask your industry peers for recommendations on a cyber insurance broker, and don’t assume your regular business insurance guy will know anything about this stuff. If you start this process with the wrong broker, you may end up with an inappropriate policy that will fail you when it comes time to file a claim.

Selecting a cyber insurance policy should actually be one of your first steps, once you have a clueful broker and a basic incident response plan in place. The reason for this is that almost all agencies will have a list of approved vendors that you’re strongly suggested to use in the event of an incident. They have pre-negotiated rates with these vendors, and they are (allegedly) vetted and deemed competent. It’s usually possible to get an exception to use a vendor that’s not on your insurance agency’s list, but that means jumping through more hoops to get them approved. If you go down this road, your broker should help you out and provide advice. So if you have a particular PR or IR firm in mind that you really want to work with, you should let your broker know before you start shopping around for a policy. I don’t recommend signing any contracts until you are sure that your cyber insurance policy will allow you to work with the vendor in question. This includes legal council and other vendor categories that I haven’t even mentioned, such as credit monitoring and notification service providers.

## The 8-Step Plan

** Here’s my recommended action plan for getting your startup in a good place, ready to respond to a large-scale data breach: **

1. Think about security, work on improving it, and have a decent incident response plan.
1. Document some potential data breach scenarios that your company might face, including the kinds of data that might be impacted, the number of users you have, where they’re located, and so on.
1. Contact a few cyber insurance brokers, ideally from trusted recommendations. Pick one who is knowledgeable and willing to work with startups.
1. Work with your broker, CFO, and security team to find a policy that meets your requirements.
1. Be aware of the agency’s approved vendor list, and ask for exceptions (if you have any in mind) before buying a policy.
1. Carefully select vendors to help you in case of a breach. That includes at least legal, PR, and IR firms.
1. Sign a contract with these vendors so that they are ready to help you respond at a moment’s notice. Go for zero cost retainers if that makes financial sense for your business.
1. Review all of the above as your startup grows and changes over the year. If your revenue explodes, you will need to increase your insurance coverage sooner rather than later.

<include src="TweetQuote" quoteText="Think about security, work on improving it, and have a decent incident response plan."/>

You can never be too prepared when it comes to security. So what are you waiting for?


"advice"