auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 acquires Apility.io to integrate IP reputation in Anomaly Detection capabilities; and launches Auth0 IP Signals, a free standalone API

<div class="alert alert-info alert-icon">
 
 Important Information 
 The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>. 
</div>

**BELLEVUE, Wash. – March 12, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Auth0 Signals](http://auth0.com/blog/new-ways-to-combat-automated-attacks-auth0-signals), a collection of threat intelligence tools and product capabilities designed to protect customers from identity attacks. Auth0’s acquisition of Apility.io, an anti-abuse company, provides a crucial source of IP threat intelligence to Auth0’s Anomaly Detection engine, which detects malicious and risky login traffic to protect customers from automated attacks, such as credential stuffing and fake account creation. [Auth0 IP Signals](http://auth0.com/signals/ip) is a free tool available for anyone to use, and will be fully integrated into Auth0’s core authentication platform in Q2 2020. 

Auth0 Signals provide important new sources of threat intelligence to Auth0’s Anomaly Detection engine, which already thwarts attacks from more than [50,000 unique IP addresses](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) every day. The continual analysis of numerous risk signals – such as IP reputation, use of breached passwords, and failed authentication volume – assesses the risk of a transaction, login attempt, or session. The collective data gathered from Auth0 Signals produces a Confidence Score that Auth0’s platform then uses to prompt adaptive authentication, or intelligent and dynamic enforcement of controls, such as multi-factor authentication or blacklisting, based on risk. 

Auth0 IP Signals is a curated and constantly updated IP address reputation search engine and API. Its threat database is constantly maintained via a variety of data sources across the web and deep web, including Open Source Intelligence (OSINT). It provides security practitioners with a comprehensive way to proactively identify fraudulent IP addresses and verify IP and email reputation, which can be used to prevent credential stuffing attacks and synthetic account creation. These types of attacks result in an average of more than [$6 million a year in costs per company](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). Auth0 IP Signals is an extension of the company’s history of providing valuable resources for free to its loyal developer community.

“Security and availability are the top priority for our business. We integrated the Auth0 IP Signals API in just hours, and it started blocking abuse right away,” said Guillermo Rauch, CEO of Vercel. “Auth0 Signals helps us ensure a great service to our customers, and helps save money and resources. The best part is that it continues to improve behind-the-scenes on its own.” 

Gartner has introduced a Trusted Identity Corroboration Model (TICM) in its September 2019 Market Guide for Identity Proofing and Corroboration. According to Gartner, “TICM is a conceptual framework that assists SRM (Security & Risk Management) leaders to choose a set of tools and techniques that maximizes the collection of multiple risk indicators to identify fraudulent and malicious activity during account creation, access, and maintenance.” Further, “the continued reliance on static data, public records, or credit bureau data alone to either establish or substantiate trust in an identity is no longer simply unadvisable; it has become negligence. Likewise, a refusal to invest in the gathering and assessment of negative and positive signals puts the burden of security on customers, which is increasingly unacceptable in a world that demands frictionless and secure interactions with businesses and organizations.”

As a central authentication and security service securing more than 100 million logins every day for enterprises around the globe, Auth0 has a unique vantage point for observing trends, where they originate from, and more importantly, knowing how to identify and block them before any damage is done. Recent internal data from Auth0 revealed that up to 67% of traffic going through Auth0 at any given time is suspicious, and 6% of IPs sending traffic to Auth0 are known to be blacklisted on the web, yet they are sending 50% of the total traffic to Auth0. Auth0 Signals will help block that fraudulent traffic from breaking into user’s accounts.

“Credential stuffing, password spraying, phishing, and other malicious attempts are constantly multiplying, and customers need more risk signals than any one company can provide, which is why we’ve created Auth0 Signals,” said Matias Woloski, CTO and co-founder of Auth0. “We have always been a developer-centric company, and wanted to provide a free resource to the application builder community for added value and security. By inserting threat intelligence and risk analysis into the IAM system, we’re reducing identity attack opportunities, offering a frictionless experience, and saving critical time and money for our customers.”

Apility.io is Auth0’s first acquisition, bolstering the company’s security strategy to protect against automated cyberattacks, and underscoring its focus on best security practices to keep customers’ information safe and their experiences seamless. 

Additional Auth0 Signals threat intelligence tools will be launched in 2020, and will be freely available to security practitioners for proactive abuse prevention and incident investigation. To learn more, please visit: [http://auth0.com/signals/ip](http://auth0.com/signals/ip).

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Hannah Carroll 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Signals: New Threat Intelligence to Protect Customers from Cyberattacks

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Savvy insurers are forging ahead with digital transformation. Don't let your team fall behind.



Many people believe the insurance industry is stagnant. However, in reality, insurance is constantly evolving.

As the world changes, insurance companies must provide new offerings to keep up. For example, insurance for driverless cars or rideshare services wasn't on the radar of most insurance companies until only a few decades ago. And, new technologies — such as drones and [IoT](https://auth0.com/blog/security-for-smart-home-devices/) — also challenge insurance companies to keep pace.

Add to that [increasing customer expectations](https://auth0.com/blog/how-to-keep-up-with-hyperconnected-consumers/), new threats to security, [the rise of insurtech](https://useindio.com/how-to-defend-insurance-agency-against-insurtech/), and ever-changing regulatory requirements, and the insurance industry is anything but dry.

However, despite these frequent shifts, too many insurance companies are resistant to digital transformation, and that resistance means they risk falling behind — or worse.

## What Exactly is Digital Transformation?

[Digital transformation](https://auth0.com/app-modernization) is more than just an oft-repeated buzzword. Put simply, digital transformation means leveraging technology. Digital transformation refines or even [automates existing business processes](https://auth0.com/blog/staying-safe-in-the-automated-workplace/) to ultimately improve the operation of your business and the experience of your customers.

“Insurers that digitize the enterprise in this way can automate slow, error-prone and expensive processes for increased speed, accuracy and cost efficiency,” explains a [whitepaper for EY](https://www.ey.com/Publication/vwLUAssets/ey-digital-transformation-in-insurance/$FILE/ey-digital-transformation-in-insurance.pdf).  

![Outdated infrasrtucture presents risks](https://images.ctfassets.net/23aumh6u8s0i/2tHULoDyNDOhrE58j4hLPJ/8bf6a6e1653a647f3e5c73c2e821aaa2/outdated-computer)

[Image via Pexels](https://www.pexels.com/photo/computer-computer-keyboard-contemporary-display-257881/)

When executed correctly, digital transformation will streamline and simplify company operations for both short-term and long-term gains.

## The Risks of Outdated Infrastructure in Insurance

Despite the numerous benefits of digital transformation, many people still bristle at the idea. Change is difficult, and in an industry like insurance — where established firms have succeeded with business-as-usual for decades — introducing new technologies can ruffle some feathers.

However, failing to keep up comes with numerous risks and consequences.

Of course, cybersecurity is top of mind for many companies. But, it’s become a major priority in the insurance industry.

Hackers are increasingly [targeting insurance companies](https://www.cio.com/article/2899488/data-breach/health-insurance-companies-prime-targets-for-hackers.html) because they deal with sensitive customer information for the claims and underwriting processes — such as healthcare and financial data — yet are notoriously slow to implement measures to protect themselves and their customers.

International business auditing firm KPMG [surveyed more than 100 insurance CEOs](https://home.kpmg/qm/en/home/insights/2017/01/facing-the-cyber-threat-in-the-insurance-sector.html). Less than one in five of them believed that their company was adequately prepared for a cybersecurity threat.

Any sort of cyber event or data breach is undeniably bad for business. First, there’s the financial fallout. [Liberty Mutual’s shares dipped by 4%](https://www.businesslive.co.za/bd/companies/financial-services/2018-06-19-liberty-share-falls-after-data-breach/) in June of 2018 after the company disclosed a recent data breach.

In the well-known breach of the information of approximately [78 million policyholders at Anthem](https://www.insurancejournal.com/news/east/2017/10/10/466958.htm), the company agreed to pay $115 million to settle lawsuits resulting from the breach. The total amount that event cost them is more than triple that, once you include costs associated with incident response and resulting security enhancements.

Finances aside, a disregard for changing technologies and increased security threats can have dire effects on a business’ relationship with customers as well.

When customers feel that their private information isn’t treated with the care and consideration it deserves — such as in the case of a [State Farm customer](https://abc7news.com/technology/exclusive-sj-woman-discovers-security-breach-in-state-farm-app/775904/) who discovered a breach within the company’s app when she was able to access other policyholders’ information — all trust is lost.

"How can I not worry?” the customer said in an [interview with ABC7 News](https://abc7news.com/technology/exclusive-sj-woman-discovers-security-breach-in-state-farm-app/775904/). “Who has my information if I have their information?"

## What Insurance Companies Can Do to Step Into the Digital Age

Digital transformation is a must for insurance companies; however, the risks of botching an update that compromises vast sensitive data are real. How can insurers move forward without fear?

Here are three strategies insurance companies should use to protect themselves and their customers and improve their businesses in the process.

![Digital transformation is a must for insurance companies](https://images.ctfassets.net/23aumh6u8s0i/6vRX3OydveKV04LmxKKJF5/48b97c4270ecba8e0be7b1dedcaf9fc7/new-computer)

[Image via Pexels](https://www.pexels.com/photo/person-using-macbook-374720/)

### 1. Implement Better Customer Identity Management Measures

Nearly all insurance companies provide a portal for customers to log in and access their profiles, personal information, claim statuses, and more. But legacy systems for user registration and authentication are a barrier they need to move past.

Insurers need to establish better [customer identity management](https://auth0.com/b2c-customer-identity-management) to make it easy for customers to access their accounts— while making it simultaneously difficult for hackers.

### 2. Invest in advanced features like Anomaly Detection to Better Identify System-Wide Threats

Unfortunately, it’s far too easy for breaches and other malicious events to go undetected for a surprisingly long time.

As just one example, an [investigation into the well-known breach at Anthem](https://www.bankinfosecurity.com/new-in-depth-analysis-anthem-breach-a-9627) revealed that it all started with a lone phishing email that was opened by an employee in February 2014.

However, Anthem wasn’t able to [disclose the attack and notify customers](https://www.usatoday.com/story/tech/2015/02/05/anthem-health-care-computer-security-breach/22917635/) until February 4, 2015 — a year after it all began. By that point, the hacker had compromised at least 90 systems within the Anthem enterprise environment.

This speaks to the importance of having [anomaly detection](https://auth0.com/docs/anomaly-detection) in place that can alert you and your users of suspicious activity the moment it happens. Auth0 not only makes you aware of the attempts to access your application, but also blocks future login attempts—so you can catch the problem before it becomes even bigger.

### 3. Ensure You’re Up to Date With Changing Security Regulations

The increasing threats in the insurance industry haven’t gone unnoticed. That’s exactly why security regulations and requirements continue to be introduced to mitigate the potential of malicious activity.

[GDPR](https://auth0.com/gdpr/), which went into effect in May 2018, requires that organizations using data of EU citizens abide by a set of strict standards when collecting, processing, storing, and sharing personal information. Teams that fail to comply could be fined €20 Million or up to 4% of annual revenue.  The regulation has had a [ripple effect](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/) across the world, with states like California following suit.

And, the insurance industry itself has taken steps toward stricter regulations and protective measures. The [National Association of Insurance Commissioners](https://www.naic.org/cipr_topics/topic_cyber_risk.htm) formed the Cybersecurity (EX) Working Group in response to the increasing demands on insurance companies. (These charges now fall under the Innovation and Technology (EX) Task Force.)

Before disbanding, this group completed numerous cybersecurity activities. Most notably among these was the adoption of the new Insurance Data Security Model Law (#668), which requires insurers and other entities licensed by state insurance departments to develop, implement, and maintain an information security program, investigate any cybersecurity events, and notify the state insurance commissioner of such events.

Keeping up with these sorts of regulations can be challenging, but Auth0 makes it painless. The platform supports industry-wide authentication standards and ensures compliance with the growing requirements of numerous leading organizations. Plus, [Auth0’s extensibility features](https://auth0.com/app-modernization) ensure that your identity platform can grow and evolve along with your business and industry.

![Stay up to date with changing security regulations](https://images.ctfassets.net/23aumh6u8s0i/2FdDc3lTZZSe4yBmMKpWwP/0779ad8e95312299b7fafc971e57dc77/security)

[Image via Pexels](https://www.pexels.com/photo/internet-screen-security-protection-60504/)

## Updating Legacy Systems: Insurers Need to Keep Up

The above steps will help insurance companies protect their information as well as the information of their customers. However, there’s also no neglecting the importance of employee education and awareness.

The better trained and informed insurance teams are about suspicious activity, the less likely they are to fall for various phishing scams and attacks.

Combine thorough employee training with the above tips, and insurers will step into the digital age — while also improving their businesses and customer relationships.


How Insurance Teams Can Quickly Step Into the Digital Age

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Key solutions like anomaly detection, universal login, and custom security rules delivered by Auth0 helps its customers protect sensitive user data.

Tight infrastructure security is critical — but if you don't remember to secure your web applications, customer data remains exposed.

There are several [common threats to web-app security](https://auth0.com/blog/common-threats-in-web-app-security/):

- A lack of encryption between your web browser and their servers
- XSS (cross-site scripting) that occurs when malicious scripts are injected into web applications
- Clickjacking (when an attacker injects transparent or opaque objects into a web application)
- Cross-site request forgery (where the attacker impersonates an authorized user and requests sensitive information, such as passwords)

These threats are continuing to multiply and become more complex by the day. To mitigate breaches, particularly in a time of [heavy regulatory scrutiny](https://auth0.com/docs/compliance/gdpr), Auth0 offers three major strategies:

1. Anomaly Detection
2. Universal Login Support
3. Customizable Rules

Auth0 allows you to combine these features to further amplify protection for your app's end users. While you can always attempt to develop these and similar solutions in-house, outsourcing app security will give you access to a team of experts who work 24/7 to keep up with the latest trends in a constantly evolving space.

## Anomaly Detection

Auth0 provides three built-in shields that [detect anomalies](https://auth0.com/docs/anomaly-detection) among users in an app's system. Used separately or in combination, the shields have the ability to stop malicious access attempts before they occur. Administrators receive alerts of suspicious activity and can then block future login attempts by an aberrant user.

<include src="TweetQuote" quoteText="Learn more about how Auth0 provides three built-in shields that detect anomalies among users in an app's system."/>

### Brute-Force Protection

Within its [Brute-Force Protection](https://auth0.com/docs/anomaly-detection) feature, Auth0 has two distinct shields:

1. Shield 1 is triggered after 10 failed login attempts on a single account from the same IP address.
2. Shield 2 is triggered after 100 failed login attempts from a single IP address via different usernames in 24 hours or after 50 sign-up attempts in one minute from the same IP address.

When Shield 1's threshold is reached, an email is automatically sent to the user, which an administrator can edit however he or she wishes. This initial email looks like:

![Affected user email](https://images.ctfassets.net/23aumh6u8s0i/7Hf4QzvX6IDVi6gl4hGRp4/8fc62d71de2ae3698d64c087b89c730c/affected-user-email)

An administrator can easily edit the template by accessing the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and following Emails > Templates.

When Shield 2 is triggered, dashboard administrators are notified. Brute-Force Protection will also block the suspicious IP address. When the issue is resolved, an administrator simply locates the user in the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and files an action to unblock. A user can also click on the "unblock" link provided in the email above or change their password.

### Breached-Password Detection

The third shield is breached-password detection. This is easy to turn on and customize in the Anomaly Detection section of the Auth0 dashboard.

![Breached-password anomaly detection with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3Oe0VufANczOhCpPtuL8iV/99ffa473077e16cd7733334c25a9c73d/breached-password-shield)

Breached-password detection is useful in instances where Auth0 suspects that a user's email has been compromised in a major security breach. (Auth0 consistently tracks these on third-party sites.) If this occurs, Auth0 will trigger the shield, notify the user, and block them from logging in until they reset their information. Breached-password detection is becoming increasingly helpful as many individuals use the same or similar iterations of the same password on multiple sites.

<include src="TweetQuote" quoteText="When Auth0 suspects that a user's email has been compromised in a security breach, Auth0 will trigger a protective shield, notify the user, and block them from logging in until they reset their information"/>

## Universal Login

Auth0 supports [universal login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) on customer apps. In contrast to embedded login, this offers increased security and a shorter setup time.

![Auth0 Universal Login offerings](https://images.ctfassets.net/23aumh6u8s0i/21BR2xIUfU721nga9W1FqO/184597f0a961d89938bb9923b08e6a73/centralized-embedded-diagram)

Universal login is a more seamless experience for the user. On the front end he or she sees a simple authentication request; on the back end, credentials remain within the same domain instead of being sent across origins. This makes it a far more secure method than exposing the information to outside sources. When personal data moves from one origin to another, [phishing attacks](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) and [man-in-the-middle attacks](https://auth0.com/docs/security/common-threats#man-in-the-middle-mitm-attacks) become common.

In addition to an enhanced customer experience, universal login is simpler for administrators to maintain and provides the benefits of single sign-on (SSO).

## Auth0 Security Rules

Auth0 has developed customizable [Rules](https://auth0.com/docs/rules/current) for its app-security features. Rules are JavaScript functions that execute when a user authenticates to your application. Rules can be helpful when customizing and extending Auth0's existing capabilities. For example, the [Force Email Verification](https://auth0.com/rules/email-verified) and [User Fraud Score](https://auth0.com/rules/socure_fraudscore) Rules can be incorporated into Auth0's existing tools like Anomaly Detection to better determine if a user truly is who they say they are.

### Force Email Verification

Force Email Verification only allows app access to users who have verified their emails. Incorporating Force Email Verification into an app instead of a browser version is a good UX practice with powerful back end capabilities.

![Force Email Verification code](https://images.ctfassets.net/23aumh6u8s0i/6MhbfE6DYpGdnku3wGI9Rn/4dd87042b24817242ccde8b52d16c781/verify-email-code)

[[Source](https://auth0.com/rules/email-verified)]

For example, if you are working with a large set of emails that belong to a network, e.g., `@university.edu` or `@company.edu`, Force Email Verification can help parse individuals in a group to make sure that a fake user hasn't set up an account to blend in with the others. Force Email Verification requests that users cross-check their information; anyone who returns information that doesn't match or does not return additional information at all will be blocked from logging in.

### User Fraud Score

Like Force Email Verification, you can tack on the User Fraud Score to a variety of features. If you've built an online marketplace — like Etsy, for example — you can use this rule to cross-check everyone conducting business and thus add an extra layer of protection to purchases. The Rule calculates a fraud score for every user, based on their email address and IP address.

```javascript
function (user, context, callback) {
 // score fraudscore once (if it's already set, skip this)
 user.app_metadata = user.app_metadata || {};
 if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

 if(!user.email) {
 // the profile doesn't have email so we can't query their api.
 return callback(null, user, context);
 }

 const request = require('request');

 // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
 request({
 url: 'https://service.socure.com/api/1/EmailAuthScore',
 qs: {
 email: user.email,
 socurekey: configuration.SOCURE_KEY,
 ipaddress: context.request.ip
 }
 }, function (err, resp, body) {
 if (err) return callback(null, user, context);
 if (resp.statusCode !== 200) return callback(null, user, context);
 const socure_response = JSON.parse(body);
 if (socure_response.status !== 'Ok') return callback(null, user, context);

 user.app_metadata = user.app_metadata || {};
 user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
 user.app_metadata.socure_confidence = socure_response.data.confidence;
 // "details":[
 // "blacklisted":{
 // "industry":"Banking and Finance",
 // "reporteddate":"2014-07-02",
 // "reason":"ChargeBack Fraud"
 // }
 // ]
 user.app_metadata.socure_details = socure_response.data.details;

 auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
 .then(function(){
 context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
 context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
 context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
 callback(null, user, context);
 })
 .catch(function(err){
 callback(null, user, context);
 });
 });
}
```

In the Auth0 Dashboard, copy the code block above, and replace placeholders with the appropriate values. The rule will pull the fraud score from socure.com and store it on app_metadata. A full set of Auth0 Rules can be found [here](https://auth0.com/docs/rules/current).

For fraud detection, Auth0 partners with [ThisData](https://auth0.com/blog/anomaly-detection-safer-login-with-thisdata-and-auth0/). ThisData allows real-time detection of any account takeovers across both web and mobile apps.

## No Better Time To Secure Your Apps

Securing your app with the best tools is always a good decision — but it is especially timely, given the slew of new regulations: GDPR deadline has passed, but [it's not too late to comply](https://auth0.com/blog/your-quick-gdpr-compliance-checklist/), and several countries and states in the U.S. have followed the EU with [similar privacy initiatives](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/). In line with these events, Auth0 has developed additional [strategies](https://auth0.com/gdpr-assessment/) for getting your team into alignment quickly, including [customer identity and access management (CIAM) protocol](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/).

While it might be easy to forget your apps in the swirl of demands around your core operations — making sure you plug any holes here is key to ensuring that you don't become another [data-breach statistic](https://consequenceofsound.net/2018/06/ticketfly-hacker-data-breach/).

How Auth0 Makes Your Apps More Secure

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Anomaly Detection can protect your users from password reuse attacks

Just last week, [GitHub](https://github.com/blog/2190-github-security-update-reused-password-attack) reported that there were several unauthorized attempts—some of them successful—to access a large number of accounts. A thorough investigation revealed that it was an attacker using lists of email addresses and passwords from other online services that have been compromised in the past. As many people use the same password on multiple online services, attackers were able to log in to a number of GitHub accounts. Thankfully, GitHub was not compromised, but some of the accounts were due to this reason.
At **Auth0**, we are aware of this problem and we can help you deal effectively with cases like this. Let's take a deeper look at what Auth0 can do for this kind of situations. 

## How Auth0 Can Help Protecting Your Users' Accounts

Auth0 provides an awesome security feature called **Anomaly Detection**. It comprises in-built tools that help you detect suspicious activities on your users' accounts, alert them of these activities, and it can also stop malicious attempts to access your application. **Anomaly Detection** provides the following benefits:

- **Breached Password Detections**: Auth0 tracks large security breaches that are happening on major third-party sites to help keep your users and systems secure. By enabling Breached Password Detection, your users can be notified and/or blocked from logging in if we suspect that their credentials were part of a published security breach. The best part? It is enabled just by flipping a switch.

 Enable **Breached Password Detection** using the toggle in your dashboard as shown in the following image:
 <img src="https://images.ctfassets.net/23aumh6u8s0i/43BF3OgSXUqVoBn0SZ7fop/9916b382c30bd69182b207a3c2e86f76/breached-pass-dashboard" alt="Breached Password Dashboard"/>

 When the feature is enabled and a user attempts to login with credentials that were leaked in a security breach, the lock will show an alert:
 <img src="https://images.ctfassets.net/23aumh6u8s0i/g0CUWmcjtMvutd9IFkPRj/500a7928488a5f3c999d82a612c2ec23/breached-pass-lock" alt="Breached Password Lock Error"/>

 Lastly, the user will get the following notification email:
 <img src="https://images.ctfassets.net/23aumh6u8s0i/odAiw5zXCkpup1vmD6rSX/a25932c84e93ea2e200ae83de9e305f1/breached-pass-email3" alt="Breached Password Email" />


- **Brute Force Protection**: Using Auth0, you can easily set a certain number of failed login attempts on your account. If it exceeds that set number, you can block the user, send him an email, and also notify dashboard owners.

Using Auth0, you can easily set up **Anomaly Detection** on your dashboard to protect your users.

<img src="https://images.ctfassets.net/23aumh6u8s0i/3xVVU5KBTl65p3oUrnUWcT/f4808a3c935fb93bf1afd19ae4b328a0/anomaly-detection-overview" alt="Anomaly Detection Overview"/>

You can use the switches to enable/disable all the actions of a certain shield.

<img src="https://images.ctfassets.net/23aumh6u8s0i/3ynZza97bo7fRaaS4etSVe/e942552d16cbdd327d1c961dae6101e6/changing-actions" alt="Changing Actions" />

> Read more about Auth0's Anomaly Detection [here](https://auth0.com/docs/anomaly-detection)

## 5 tips for protecting your passwords

Anomaly Detection is a great tool for protecting your users' accounts, but security should be a concern for all parties. Here are 5 tips that users can take into account to protect their passwords.

### 1 - Don't use the same password across multiple online services

If hackers get hold of your Github password, it shouldn't be an automatic entry visa to your Facebook, Twitter, Instagram, and Snapchat accounts. Having to remember several passwords involves a strong muscle memory, so you can decide to use a password manager to take care of that, but ensure it's a really trusted and secured one.

### 2 - Guard your password

Your password is valuable. Don't share it with anyone, even friends or family. Don't store it in your mail inbox. Make sure it is confidential. If you use someone else's system to log in and perform a certain activity on an online service, don't forget to log out!

### 3 - Change passwords frequently

As bigger companies get hacked, the likelihood that your password is leaked increases. Make a habit of frequently changing your passwords.

### 4 - Two-factor Authentication

**Two-factor Authentication (TFA)** is a method of authenticating users by adding a second factor to validate the user's identity. Typically, it involves entering a one-time token that is dynamically generated and delivered through a method that only the user has access to.

> Learn more about Multifactor Authentication, in the [Get Started with MFA landing page](https://auth0.com/learn/get-started-with-mfa).

With TFA, a hacker must have access to your mobile phone or second factor to be able to gain access to your account.

### 5 - Passwordless Login via SMS and email

With Passwordless Login you can use one-time codes or “magic links” delivered via SMS or email. In this way, only users who have access to the registered email account or registered phone will be able to login.

> Read more about Passwordless [here](https://auth0.com/blog/2015/09/30/auth0-passwordless-email-authentication-and-sms-login-without-passwords/).

![Passwordless Login](https://images.ctfassets.net/23aumh6u8s0i/3QYNw3edBKso3qNe2A6djc/d8449a97f4bb29e325c3459fa495fa99/pwdless-locks)

## Conclusion

Online services are getting hacked on a daily basis, and hackers are also getting smarter every day. We have seen several big companies like Slack, Paypal and LinkedIn experience data breaches. It is never too late to start guarding your users, data, money, and your precious reputation more seriously; until it is too late.

<include src="TweetQuote" quoteText="Online services are getting hacked on a daily basis, and hackers are also getting smarter every day."/>

"anomaly detection"