samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you.

Identity is the connective tissue between every person and technology in your ecosystem. This connective role also places Identity at the center of your risk profile. It’s no surprise that Identity remains the No. 1 attack vector in today’s threat landscape —  over 80% of data breaches involve some form of compromised Identity.

Properly addressing this fact means taking a serious and expansive look at your organization’s approach to Identity — because here’s the thing: Identity is more than just a login box. A rigorous, modern approach to Identity mitigates threats before, at, and after authentication.

Accordingly, technology leaders can’t limit themselves exclusively to Identity-related threats. They must also consider the impact their Identity solution has on core business priorities such as revenue, customer satisfaction, and growth goals.

This blog dives into how technology leaders can deliver Identity security solutions that also drive growth. If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you.

## It’s Time to Ditch Dated Identity and Excessive Friction

Protecting customers from account takeover and other malicious actions is crucial. But when that protection creates frustrating stumbling blocks for customers, like passwords, frequent CAPTCHAs, and multi-factor authentication (MFA) fatigue, your business is at risk. By introducing excessive friction into customer journeys, good-faith security efforts built on legacy Identity methods can lead to abandoned customer journeys, lower conversion rates, and lost business.

It’s a raw deal, and the worst part is that Identity security that burdens your customers doesn’t necessarily translate to better security. For example, traditional usernames and passwords with SMS as a second factor are vulnerable to social engineering and SIM-swapping attacks.

The clock has run out on legacy Identity. It’s time to embrace a modern approach that leverages Identity as more than a login box and, instead, drives better security and better business.

## Protect Every Stage of the Customer Journey

If the stats on pervasive Identity-related breaches teach us anything, it’s that legacy Identity simply isn’t enough in today’s threat landscape. Technology leaders need Identity security that can discover weaknesses, protect against vulnerabilities, and limit access if an adversary gets in.

In order to modernize security, you must modernize Identity. Auth0’s layered defense strategy improves security before, at, and after the login box alongside a SecOps dashboard, tools, and integrations. Here’s how our Auth0 Identity platform drives stronger security, privacy, and user experience (UX) across the customer journey.

### Before login

Bots make up 42% of all internet traffic today and 65% of these are bad bots.A versatile, scalable method for bad actors to carry out automated attacks, bots are also a major drain on your marketing budget. Whenever bots sign up for new accounts, they eat into your sign-up bonuses and block new connections with real customers.

Generative AI is poised to add gas to the bot fire: Between 2023 and 2030, AI adoption in cybercrime is expected to rise by 37%. Soon, businesses will be dealing with an even higher number of sophisticated bots capable of outsmarting simple bot-detection CAPTCHAs.

Modern Identity should stop bad bots in their tracks while maintaining customer-friendly experiences that protect revenue. Auth0 Bot Detection continuously monitors Identity threats across hundreds of millions of users, enabling us to detect bad bots and respond in real time with user-friendly challenges like the time-based authentication challenge. In addition, our Bot Detection solution now features a machine-learning model designed for signup attacks. Tailored models greatly improve detection and prevention of bots across the user journey, while reducing bot challenges presented to real customers.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection)

### At login

Ultimately, driving your business forward comes down to providing customers with a simple and seamless user experience without compromising on security. Customers want on-demand convenience — fast, easy access with flexible login options — which means digital teams need to design phishing-resistant authentication experiences that also deliver a quick and easy customer journey.

Modern Identity can provide that perfect balance with flexible, secure passwordless login options. Passkeys allow users to log in quickly and securely, similar to how they unlock their mobile devices. They are also a phishing-resistant alternative to less user-friendly login options like the commonly used username and password plus MFA combination. Adaptive MFA can also reduce MFA fatigue by assessing risk signals such as a new device, network, or location, impossible travel, and untrusted IP, only triggering a second challenge for higher-risk authentication attempts.

In addition to login options, Auth0 offers layered security features for login. Auth0 Breached Password Detection and Credential Guard screen for and block compromised credentials. Auth0’s Brute-Force Protection and Suspicious IP Throttling help prevent account takeover attacks that target single and multiple user accounts, respectively.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Single Sign-On](https://auth0.com/docs/authenticate/single-sign-on) 
* [Passwordless](https://auth0.com/docs/authenticate/passwordless),[ Passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) 
* [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication)
* [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa)
* [Suspicious IP Throttling](https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling)
* [Breached Password Detection and Credential Guard](https://auth0.com/docs/secure/attack-protection/breached-password-detection)
* [Brute Force Protection](https://auth0.com/docs/secure/attack-protection/brute-force-protection)

### After login

The ongoing rise in post-login threats also necessitates a defense-in-depth, layered security approach at every step of the user journey. The stakes are high, and the pain caused by breaches has the potential for extensive reach. Breaches not only incur painful financial losses but also lead to substantial brand and compliance-related effects that threaten the core business. Modern Identity can help avoid these outcomes.

Modern Identity elevates security, privacy, and experience post-login to protect sensitive customer interactions and user sessions. For example, with Auth0 Highly Regulated Identity, configure your organization to send financial-grade contextual approval requests to customers’ devices for sensitive interactions like account updates or money transfers. With Auth0 Continuous Session Protection, your organization can also continuously monitor user sessions to detect and prevent hijacking attempts, revoke suspicious sessions, and set custom timeouts.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity)
* [Continuous Session Protection](https://auth0.com/docs/secure/continuous-session-protection)

## SecOps

Security is a team sport, which is why Auth0 enables better collaboration between security, product teams, and developers with real-time insights and ready-made integrations that connect Auth0 functionality to a broader security apparatus.

For example, Auth0’s Security Center helps organizations detect and respond to attacks faster and fine-tune their security posture with intelligent insights and custom threshold alerting for Identity-related events, anomalies, and general efficacy. Security Log Streaming further supports faster event response by allowing the streaming of relevant Customer Identity Cloud activity to third-party SIEM tooling.

Auth0 SOLUTIONS TO EXPLORE FURTHER

* [Security Center](https://auth0.com/docs/secure/security-center)
* [Security Log Streaming](https://auth0.com/docs/secure/security-center/prioritized-log-streams)

## The Perfect Blend of Security and Usability

It’s tempting to think of Identity as a box to be checked. Equip your customer-facing applications with SSO and MFA–check. It's time to dust off your hands and declare victory, right? If only it was that easy.

To adapt to the ever-shifting risks of the business landscape with equal attention to security and revenue, technology leaders need an approach to Identity-based security that also functions as a business driver. That means integrating secure, seamless Identity functions into your security and revenue strategies at each customer touchpoint.

Legacy approaches to Identity fall far short of this goal. But, by entrusting your organization’s Identity with a leader in modern Identity, you can position your business to lead the pack in customer Identity security and core business KPIs.

## It All Starts with Auth0

[Thousands of customers](https://www.okta.com/customers/) worldwide trust Auth0 to strike the perfect balance of robust security and seamless customer experience across more than 10 billion monthly authentications.

We’ve invested in a layered defense strategy to improve security before, during, and after the login box — plus a dashboard and tools for SecOps that improve visibility and enable faster responses to potential and emerging threats.

Curious about how the Auth0 can help you build trust with your customers, secure your applications, and protect revenue?[ Reach out to our team](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) to schedule a demo.


Identity Security 101: How to Drive Trust and Loyalty across the User Journey

sofia-prosper

Sofía Prósper, a trained architect, is a passionate Developer Advocate and the current Partner Manager of Auth0 by Okta Marketplace. She has a diverse background focused on architecture, design, art, and verbal communication. Recipient of the Spanish Data Protection Agency Prize in 2018, in her spare time, she has worked since as an advocate defending Privacy, Digital Rights, and Digital Sovereignty in Spain. Outside her daily work, you can find her illustrating her travel journal, cooking for friends, collecting recipe books, and joining side projects in beautiful Galicia, Spain.

Senior Developer Advocate and Partner Manager of the Auth0 Marketplace

Sofía Prósper Díaz-Mor

Eutelo Pena

All my career I have been oriented to the creation of software products for mobile devices. Initially, as an Android & iOS developer, implementing biometric solutions in Gradiant / Alice Biometrics. Over the years, my role has been changing towards the management layer, the product and the leadership of teams, carrying it out in places like Bank Sabadell, InAuth (AMEX group), Verse (Square group) or Eccocar. Currently back home, where I am helping to make digital onboarding easier for people.

Head of Product at Alice Biometrics

Facial biometrics revolutionizes digital processes. Implemented thoughtfully, it provides businesses a competitive edge while safeguarding privacy.

## Introduction

In the era of digital transformation, businesses are constantly looking for ways to streamline their processes and enhance security. One technology that is rapidly gaining traction in this regard is facial biometrics, which includes face recognition and face liveness detection. This technology is revolutionizing processes such as the digital onboarding of new users and adding an extra layer of security to prevent AI bots and fraudsters from causing harm. Auth0 has included facial biometrics features at [Auth0 marketplace](https://marketplace.auth0.com/partners/alice-biometrics).

## The Power of Facial Biometrics

Facial biometrics technology uses unique features of a person’s face to verify their identity. It’s a powerful tool that can be used in a variety of applications, from unlocking smartphones to verifying identities at border controls.

### Face Recognition

Face recognition technology works by comparing selected facial features from a given image with the photo ID for the onboarding use case or with the facial template stored for authentication, password reset, or access control use cases. It’s a fast and accurate way to verify the identity of users, making it an excellent tool for digital onboarding and multiple account opening. 

### Face Liveness Detection

Face liveness detection is a technology that can determine whether the source of a biometric sample is a live human being or a representation of a human being. This technology is crucial in preventing fraudsters from using photos, videos, or masks to impersonate legitimate users.

![](https://images.ctfassets.net/23aumh6u8s0i/72e8GkU7K8cuSoxC8JrleF/c3d57801015e621f725020f2db951b8e/Biometric_3.jpg)

## How Facial Biometrics Enhance Businesses Processes

Facial biometrics can significantly enhance several aspects of digital security and user experience. Let’s delve into how this technology can improve authentication, bot prevention, account recovery, and password reset processes.

### Digital Onboarding

Digital onboarding is the process of integrating new users into a system. It’s a critical process for businesses, as it’s often the user’s first interaction with the company. Facial biometrics can streamline this process by quickly and accurately verifying the identity of the user.

For example, a bank can use facial biometrics to verify the identity of a new user opening an account. The user simply takes a selfie, which is then compared to a photo ID they provided. The process is quick, easy, and secure, providing a positive experience for the user while ensuring the bank is complying with KYC (Know Your Customer) regulations.

### Authentication

Facial biometrics provide a secure and user-friendly method for user authentication. Instead of remembering complex passwords, users can simply use their faces as a form of identity verification. This not only enhances security but also improves the user experience by offering a quick and convenient authentication method.

### Bot Prevention

Bots pose a significant threat to digital security. They can carry out a variety of malicious activities, from spamming to automated attacks. Facial biometrics, particularly face liveness detection, can help prevent bots by ensuring that a real, live person is behind each action.

### Account Recovery

Account recovery can be a complex process. Traditional methods often involve answering security questions or receiving a code via email or SMS. With facial biometrics, users can recover their accounts by simply verifying their identity with their face. This makes the account recovery process more secure and user-friendly.

### Password Reset

Resetting passwords can be a hassle for users. However, with facial biometrics, this process can be simplified. Users can verify their identity using their faces and then set a new password. This not only streamlines the password reset process but also adds an extra layer of security.

![](https://images.ctfassets.net/23aumh6u8s0i/1PBtpzTeahMOcqlpm1MoL3/09f0029a9c41c405493f0549b51a7397/Biometric_2.jpg)

## Adding Security to Business Processes

In addition to streamlining digital processes, facial biometrics can also add an extra layer of security. By verifying the identity of users at key points, businesses can prevent AI bots or fraudsters from gaining access to sensitive information or systems.

For instance, a business could use facial biometrics to verify the identity of users before they make a transaction. This could prevent a fraudster who has gained access to a user’s account from making unauthorized transactions.

## Conclusion

Facial biometrics offer a powerful tool for businesses undergoing digital transformation. By streamlining the digital processes and enhancing security, this technology can provide a competitive edge while protecting against AI bots and fraudsters. As with any technology, it’s important to implement it in a way that respects user privacy and security. With these considerations in mind, facial biometrics can play a key role in the digital transformation journey. If you want to try biometrics, please visit [Alice Biometrics](https://marketplace.auth0.com/partners/alice-biometrics) profile at Auth0 marketplace to learn more.

Facial Biometrics: The Key to Digital Transformation and Enhanced Security

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

How to authenticate and manage your business users in a multi-tenant app with Organizations.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>This tutorial uses the Auth0 Organizations feature, which is <a href="https://auth0.com/startups/vip"> available to early-stage startups </a>through our Auth0 for Startups program, free for one year.</b><br> 
</div>

## The Challenge

Developers on a tight schedule need to quickly implement a secure solution. You need to build a product with scalable infrastructure that can be iterated on weeks/months/years down the line. And you need to adhere to ever-changing industry standards and regulations.

<AmpContent>
<amp-youtube
    data-videoid="8s14Nhvgnb0"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/8s14Nhvgnb0' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Building B2B applications comes with many technical challenges, not least of which is how to set up [multi-tenancy](https://auth0.com/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices). [Multi-tenancy](https://auth0.com/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices) is when a single instance of software runs on a server that is accessible to multiple groups of users – managing this across various business communities can be broken down into three different considerations:

* Customizing the login experience for each business, from branding to SSO options,
* Managing users for each business with restricted access based on specific permissions,
* And giving businesses the ability to manage their own members.

## The Solution

Auth0 Organizations is our solution to multi-tenancy from an auth perspective – it’s a feature for developers to manage business users. **Simply put, each business is an Organization. Each Organization has members. Each member can have roles that define their permissions.**

When users log into your application, how they log in depends on the requirements defined by each business. For example, let’s say you have three customers with varying needs:

* Organization A is a small business, so they’re comfortable with letting their members log in with Google or another preferred[ Social identity provider (IdP)](https://marketplace.auth0.com/features/social-connections);
* Organization B is a larger corporation, so they’re expecting to leverage not only[ Enterprise IdPs](https://marketplace.auth0.com/features/enterprise-connections) but also multi-factor authentication (MFA) as an additional layer of security;
* Organization C is a brand new startup with only one employee – the founder – and all they want is a seamless experience.

The typical app user needs to be able to log in to the app and do some basic tasks. All of your business customers also want to distinguish a role for Admins who have additional permissions, like sending invites to cool new members or kicking problematic members out.

![Your App](https://images.ctfassets.net/23aumh6u8s0i/4y486Q5HiJbXmlVq5k71pc/57ab4fbab5c49c769a442b8e781d624e/shreyapost.jpg)

## The Process

Let’s explore what a potential solution with Organizations would look like. (Check out the video for a visual walkthrough.)

### Get Started

1. Open your [Auth0 Dashboard](https://manage.auth0.com/dashboard)
2. Select your Application (left menu) and [configure it for business users](https://auth0.com/docs/manage-users/organizations/configure-organizations/define-organization-behavior)
3. [Create Organizations](https://auth0.com/docs/manage-users/organizations/configure-organizations/create-organizations) for each business customer
4. Enable Social and Enterprise [Connections](https://auth0.com/docs/manage-users/organizations/configure-organizations/enable-connections) and [MFA](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa)
5. [Create roles](https://auth0.com/docs/manage-users/access-control/rbac), [invite members](https://auth0.com/docs/manage-users/organizations/configure-organizations/invite-members) and [assign roles](https://auth0.com/docs/manage-users/organizations/configure-organizations/add-member-roles)

### Get Technical

Integrate this login experience into your React app (or [explore other SDKs](https://auth0.com/docs/libraries)). Follow the[ React SDK quickstart](https://auth0.com/docs/quickstart/spa/react/interactive) for detailed instructions.


1. Install the Auth0 React SDK

```
cd <your-project-directory>
npm install @auth0/auth0-react
```

2. Configure the Auth0 provider component

```js
import React from 'react';
import { createRoot } from 'react-dom/client';
import { Auth0Provider } from '@auth0/auth0-react';
import App from './App';

const root = createRoot(document.getElementById('root'));

root.render(
<Auth0Provider
    domain="{yourDomain}"
    clientId="{yourClientId}"
    authorizationParams={{
      redirect_uri: window.location.origin
    }}
  >
    <App />
  </Auth0Provider>,
);

```

3. Add login to your Application

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const LoginButton = () => {
  const { loginWithRedirect } = useAuth0();

  return <button onClick={() => loginWithRedirect()}>Log In</button>;
};

export default LoginButton;
```

4. Add logout to your Application

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const LogoutButton = () => {
  const { logout } = useAuth0();

  return (
    <button onClick={() => logout({ logoutParams: { returnTo: window.location.origin } })}>
      Log Out
    </button>
  );
};

export default LogoutButton;
```

5. Show user profile information

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const Profile = () => {
  const { user, isAuthenticated, isLoading } = useAuth0();

  if (isLoading) {
    return <div>Loading ...</div>;
  }

  return (
    isAuthenticated && (
      <div>
        <img src={user.picture} alt={user.name} />
        <h2>{user.name}</h2>
        <p>{user.email}</p>
      </div>
    )
  );
};

export default Profile;
```

6. If you need to retrieve the organization the user belongs to, you can use the property [`org_id` in the user object](https://auth0.com/docs/manage-users/organizations/using-tokens), for example you can add the following line of code:

```
<p>{user.org_id}</p>
```

### Go Beyond

Eventually, you may want to do more. You could:

1. [Require multi-factor authentication for users outside their corporate network](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#enforce-custom-mfa-policy) to increase security,
2. [Assign default roles to users on sign-up](https://auth0.com/blog/assign-default-role-on-sign-up-with-actions/) or at another point in the identity flow,
3. And allow customers to self-manage their Organizations using an [admin portal](https://auth0.com/docs/get-started/architecture-scenarios/business-to-business/profile-management#admin-portal).

## The Next Step

Multi-tenancy is a common feature requirement for most B2B apps, but you shouldn’t have to spend all your time on building it. This is just the tip of the iceberg for what you can accomplish using Organizations. [Try it yourself for free](https://auth0.com/signup?utm_source=blog&utm_medium=auth0&utm_campaign=b2bsaas), and [let us know if you have any questions](https://community.auth0.com/)!

Are you an early-stage startup? [Apply now](https://auth0.com/startups/vip) to the Auth0 for Startups program, which is **free for one year** and supports 100 Organizations in prod (and much more).

## More Resources

* Get started with our [React quickstart](https://auth0.com/docs/quickstart/spa/react/interactive)
* Dive deep into the [Organizations docs](https://auth0.com/docs/manage-users/organizations)
* Read about [Solving Digital Identity Management for Your SaaS Application](https://auth0.com/blog/digital-identity-management/)
* Learn more about [Auth0 for Startups](https://auth0.com/startups)
* Ask questions in our [Community forum](https://community.auth0.com/)
* Don't have an app? Check out our [sample B2B app](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter/)

[Open a ticket](https://support.auth0.com/tickets/new) for technical support (available for customers in the Startup plan or other paid plans)


Build a Secure and Scalable B2B SaaS App in React

michael-swanson

I live in Austin, TX with my wife, Anneke, and our two kiddos, Ilya (5) and Everett (2). I am a native Texan but lived in multiple places across the southern US as a kid. I have family in Houston TX and Midland TX that we visit on a regular basis. Prior to joining Okta, I worked with early stage startups as a hands-on Product Manager, team lead, and product designer, while also writing (mostly frontend) code. 
<br>

When I am not working you can usually find me chasing my kids around, reading sci-fi or fantasy novels, or playing needlessly complex strategy board games with friends. I am also a huge Star Wars fan and am always down to talk about the latest Star Wars movies, TV, and/or books. Additionally, Anneke and I love to travel and have been all over the world together. Much of our travel focuses on getting out of the Texas heat, tasting and learning about wine, and sampling the amazing food we find along the way!


Senior Product Manager

Michael Swanson

Businesses using Auth0 by Okta’s Universal Login, can leverage a pro-code option to customize signup and login flows to address unique needs.

Every company has unique user registration and login requirements. For example, needing to capture a first and a last name during signup or requiring users to agree to terms and conditions before they can create an account. 

To meet those specific business needs and use cases, we have introduced pro-code customizations for signup and login to the Universal Login experience. This capability is available to customers on our Enterprise and Professional plans.

Using this capability, customers can insert additional form fields and custom content into the signup and login screens and include client and server-side validations to ensure that required data, such as TOS acceptance, are completed and validated before completing the authentication process. 

Use cases include:

* Adding new fields to collect necessary customer data (name, phone number, email, preferences, consent, etc.)
* Adding new form elements for presenting and capturing TOS/privacy policy and opt-in before signup
* Adding custom content such as URLs, images, or marketing information
* Localizing custom elements in different languages

### Getting started

The new [Partials API](https://auth0.com/docs/api/management/v2/prompts/get-partials) allow developers to insert custom HTML, CSS, and Javascript into the Signup and Login screens. Developers can insert new form elements and custom content, perform asynchronous client-side validation via Javascript, and leverage [Liquid syntax](https://github.com/Shopify/liquid/wiki/Liquid-for-Designers) to perform conditional logic and insert dynamic variables. Here is an example of inserting custom code into the Signup screen:

```js
# eg: PUT /api/v2/prompts/signup/partials

# Request Body
{
  "signup": {
    "form-content-start": "<div class='ulp-field'><label for='first-name'>Full Name</label><input type='text' name='ulp-full-name' id='full-name'></div>",
    "form-content-end": "<div class='ulp-field'><input type='checkbox' name='ulp-terms-of-service' id='terms-of-service'><label for='terms-of-service'>I agree to the <a href='https://my.app/terms' target='_blank'>Terms of service</a></label></div>",
  }
}

```

Once the user submits the Signup form customers will have access to the data via Actions. Here is an example of saving user provided custom data to the user_metada for the end user

```js
/**
* Given this code in the signup form:
* <div class="ulp-field">
*   <label for="full-name">Full Name</label>
*   <input type="text" name="ulp-full-name" id="full-name">
* </div>
* <div class="ulp-field">
*   <label for="terms-of-service">
*     I agree to the <a href='https://my.app/terms' target='_blank'>Terms of service</a>
*   </label>
*   <input type='checkbox' name='ulp-terms-of-service' id='terms-of-service'>
* </div>
**/

exports.onExecutePreUserRegistration = async (event, api) => {
  const fullName = event.request.body['ulp-full-name'];
  const terms = event.request.body['ulp-terms-of-service'];
  
  if(!fullName) {
    api.validation.error("invalid_payload", "Missing Name");
    return;
  }
  
  if(!terms) {
    api.validation.error("invalid_payload", "Acceptance is Required");
    return; 
  }

  api.user.setUserMetadata("fullName", fullName);
  api.user.setUserMetadata("termsAcceptance", terms);
};

```

To learn more about how Signup and Login Prompt Customizations works and to view tutorials and examples, refer to the public documentation.

* Custom-facing Documentation: [Customize Signup and Login Prompts](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts)
* Management API Documentation: [Auth0 Management API v2: Manage Partials](https://auth0.com/docs/api/management/v2/prompts/get-partials)

Customizations for Signup and Login are Generally Available

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Your identity platform is critical to growing and scaling your SaaS application. Accelerate business growth and keep your users secured with Auth0 by Okta

For today’s SaaS builders, the pressure to rapidly innovate and seamlessly scale can be intense.

Evolving macroeconomic pressures mean companies building SaaS applications need to do more with less. And every B2C innovation amps SaaS customer expectations. AI has further transformed the competitive landscape, presenting both an opportunity for product differentiation and a threat. [There’s just more that attackers can do now](https://www.securitymagazine.com/articles/99832-study-finds-increase-in-cybersecurity-attacks-fueled-by-generative-ai) — and they can do it faster. 

SaaS companies also need to do more — and they need to see speed and security gains just so customers can keep up with the rate of change. And honestly, they need to deliver more than what’s expected in order to stay relevant in this fast-paced society. 

Since SaaS is in this ever-evolving space, companies must keep up at the business level to stay ahead of their competition. In turn, developers must continuously learn new back-end methods to keep up with the new SaaS technologies.

Let us show you how Auth0 by Okta keeps up and makes your life easier.

## How Auth0 by Okta can help your SaaS

Robust identity management is crucial for ensuring seamless user experiences, maintaining data security, and complying with regulatory requirements. Auth0, the leading identity and access management (IDaaS) platform, stands out as the ideal solution for SaaS applications due to its comprehensive features, ease of use, and robust security measures.

Auth0 simplifies the authentication and authorization process for SaaS applications, enabling developers to focus on building core functionalities rather than building their own identity solutions and managing identity infrastructure.

[Universal Login](https://auth0.com/features/universal-login) provides a centralized and unified login experience for users across all your applications, supporting a wide range of authentication flows, devices, and screen sizes. Universal Login enhances user experience and simplifies the integration process for developers. With Universal Login, users can sign in using [passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) or use their existing credentials from social media platforms, enterprise directories, or email addresses, eliminating the need to create separate accounts for each application.

In addition to Universal Login, Auth0 provides a comprehensive set of SDKs for various programming languages and frameworks, making it easy for developers to integrate Auth0 into their applications. These SDKs handle everyday authentication tasks, such as login forms and password resets, ensuring consistent and secure user experiences across applications. For more customized scenarios, Auth0's powerful APIs provide granular control over authentication and authorization flows, allowing developers to tailor them to specific requirements and integrate seamlessly with third-party services.

**Here are some specific benefits of using Auth0 for SaaS applications:**

* **Streamlined user onboarding**: Universal Login eliminates the need for users to create separate accounts for each application, making it easier for them to get started.
* **Improved user experience**: A seamless and consistent login experience across all applications enhances user satisfaction and reduces friction.
* **Customizability**: The Universal Login page can be customized to match your brand and needs. At the same time, [Auth0 Actions](https://auth0.com/features/actions) enable developers to extend Auth0 beyond its core functionality and incorporate custom logic such as integrations with APIs (CRMs, billing, email automation, marketing tools, etc) or write custom policies into the authentication and authorization flows.
* **Reduced development time**: Developers can save time and effort using pre-built Universal Login components and SDKs, simplifying the integration process.
* **Global or regional scalability**: Auth0's public and private cloud-based infrastructure scale seamlessly to accommodate user demand internationally and fluctuating traffic spikes.
* **Security Center and Log Streaming**: Auth0 provides robust security features to protect your SaaS application users and your business. With Attack protection features such as bot detection and breached password detection, you can offer comprehensive protection against credential-stuffing attacks. You can also offer streamlined security and follow compliance with MFA and RBAC. In addition, you can monitor your applications and detect identity-driven attacks with Security Center and integrate activity logs with your security toolkit with Log Streaming.
* **Expanded support for various platforms**: Universal Login and SDKs are available for various programming languages and frameworks, enabling developers to build secure and scalable SaaS applications across various platforms.
* **Future-Proof Features**: Auth0 continuously invests in innovation, incorporating the latest security and authentication technologies. By integrating with Auth0, SaaS applications can leverage these future-proof features, ensuring they remain secure and compliant with evolving industry standards.

## B2B Ready with Auth0 Organizations

For some SaaS applications, the B2B aspect is baked into the core design, with a clear understanding of the requirements for managing users from different organizations. However, for many SaaS applications, the need to support B2B scenarios may arise as a requirement that needs quick implementation. This can add complexity to development and require significant effort to integrate and maintain separate identity management systems for each organization.

Auth0 addresses this challenge with [Auth0 Organizations](https://auth0.com/organizations) by providing a unified platform for managing B2B relationships, enabling SaaS applications to efficiently onboard, manage, and secure user identities across multiple organizations.

Auth0 customers can use Organizations to:

* Represent their business customers and partners in Auth0 and manage their membership.
* Allow your business customers to securely manage and customize how their end-users access apps, with the ability to add as many organizations as they need to their Customer Identity Cloud (Private Cloud) tenant.
* Configure branded, federated login flows for each business.
* Build administration capabilities into their products, using Organizations APIs, so that those businesses can manage their own organizations.
* Supports your multi-tenant product out-of-the-box, conveniently serving from a single Customer Identity Cloud tenant.

![Organizations](https://images.ctfassets.net/23aumh6u8s0i/kZUAmaE3qFsxXaeTwxeOb/3dbe661afe612b1596fe4e990803d248/saas01.png)

## Enterprise Ready

In the realm of enterprise-grade SaaS applications, the need for comprehensive identity management extends far beyond traditional user authentication. Enterprises demand a robust solution that seamlessly integrates with existing IT infrastructure, manages complex access policies, and complies with stringent security standards.

Auth0 enables SaaS applications to connect seamlessly with enterprise systems without building custom integrations, eliminating the need for developers to maintain multiple integrations and reducing development time and effort by providing:

* **Seamless Integration with Enterprise Identity Systems**: Auth0 Organizations seamlessly integrate with existing [enterprise identity providers](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers), such as Active Directory, LDAP, and SAML IdPs.
* **Single Sign-On (SSO) for Enterprise Applications**: Auth0 Organizations supports SSO for enterprise applications, enabling employees to sign in to multiple applications using a single set of credentials. This streamlines the user experience and improves productivity.
* **Activity Auditing for Enterprise Compliance**: Auth0 provides detailed activity auditing for enterprise compliance, allowing organizations to track user activity and access patterns. This auditing functionality helps to identify suspicious activity, investigate potential security breaches, and ensure compliance with regulatory requirements.

## Built-in Security

With built-in security features and continuous innovation, Auth0 provides developers with the tools and expertise to build secure SaaS applications that safeguard user identities, sensitive data, and applications from a wide range of threats. Auth0's security features are not only beneficial to developers; they are also a key selling point for SaaS providers who want to ensure their customer’s data and applications are safe and secure.

Here are some of the built-in security features of the Auth0 platform:

### Attack Protection

Auth0's attack protection features can detect and stop malicious attempts to access your application by blocking traffic from specific IPs, displaying CAPTCHAs, and more.

Auth0 offers the following attack protection options:

* **[Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection)**: Bots, automated programs often employed by malicious actors performing credential-stuffing attacks, pose a significant threat to online applications and services. Auth0's bot detection capabilities utilize sophisticated techniques to identify and block these bots, preventing them from accessing your applications and disrupting user experiences.
* **[Suspicious IP Throttling](https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling)**: Blocks traffic from any IP address that rapidly attempts too many logins or signups. This helps protect your applications from high-velocity attacks that target multiple accounts.
* **[Brute Force Protection](https://auth0.com/docs/secure/attack-protection/brute-force-protection)**: Brute force attacks involve repeatedly attempting to guess user login credentials, often automated through scripts or botnets. To combat these attacks, Auth0's brute force protection feature limits the number of failed login attempts from a single IP address. Once a threshold of failed attempts is reached, the IP address is temporarily blocked, preventing further attempts and mitigating the risk of successful brute-force attacks.
* **[Breached Password Detection](https://auth0.com/docs/secure/attack-protection/breached-password-detection)**: Auth0 tracks large security breaches that occur on major third-party sites. If Auth0 identifies that any of your users’ credentials were part of a breach, the breached password detection security feature triggers keeping your accounts safe.

![attack protection](https://images.ctfassets.net/23aumh6u8s0i/6T8KTzpEpJ0YrNMX7qDIMM/a93051c4295c9fd66acbb752fcbdaa08/saas02.png)

Auth0's attack protection features are based on industry-standard security protocols, and they can help you protect your applications from a wide range of attack vectors. To implement Auth0's attack protection features, you can integrate Auth0 into your application. Once integrated, Auth0 will automatically protect your application from attacks.

## Extensibility

Auth0 goes beyond providing a robust authentication and authorization platform; it also offers a wide range of extensibility capabilities, enabling developers to tailor the platform to their specific application requirements and integrate it with their existing infrastructure.

### Auth0 Actions

[Auth0 Actions](https://auth0.com/features/actions) is a powerful extension mechanism that empowers developers to modify Auth0's authentication and authorization flows. These JavaScript functions can be executed at various points in the authentication process, allowing developers to:

* **Modify access tokens with custom claims**: Add, update, or remove custom claims to access tokens, enabling granular control over user permissions and data sharing.
* **Integrate with external services**: Connect to external services like CRM systems, customer data platforms, and payment gateways to enrich user profiles and facilitate seamless user journeys.
* **Enhance user experiences**: Personalize the login and registration experience, customize error messages, and provide user context-aware support.
* **Implement custom logic**: Add custom logic to handle specific scenarios, such as verifying two-factor authentication codes or managing user roles.

You can write your own custom Auth0 Actions writing JavaScript code or browse and install any Action from a curated collection at the [Auth0 Marketplace](https://marketplace.auth0.com/). In the marketplace, you can find Actions providing a wide range of functionalities, such as:

* **Social login integrations**: Connect with popular social networks like Facebook, Google, and LinkedIn to facilitate user authentication and signup.
* **Identity Proofing**: Identity proofing allows you to verify a user's real-world identity based on life history (a credit report), biometrics (a facial scan), and other factors before granting access.
* **Compliance and security solutions**: Implement compliance solutions like fraud detection and data privacy controls.

And much more...

## Get Started with Our SaaS Starter Kit

Embarking on developing a SaaS application can be an exciting yet challenging endeavor. To simplify the process and accelerate time to market, Auth0 offers a [SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) that provides a jumpstart for building secure and scalable SaaS applications.

The SaaS Starter Kit is a guide and boilerplate you can use to build a Next.js SaaS application tailored for the following use cases:

* SaaS Multi-tenancy with Auth0 Organizations in a single Auth0 tenant.
* A tiered pricing model using Auth0 Actions and User Profile[ App Metadata](https://auth0.com/docs/manage-users/user-accounts/metadata#metadata-types).
    * Support Trial, Personal, Teams, and Enterprise plans in a SaaS application.
* Trial plan expiration and user conversion using Auth0 Actions.
    * Use Actions to update user profile data, enrich an ID or Access Token with custom claims, or call 3rd-party APIs, such as the Stripe API, to manage user subscription status.
* Self-service SSO for business users using the Auth0 Management API and Enterprise connections with support for OIDC connections.
* Self-service User Management using the Auth0 Management API.

With the [Auth0 SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) as your foundation, you can build secure, scalable, and feature-rich SaaS applications that provide a seamless user experience while adhering to industry best practices for authentication and authorization.

## The Customer Identity Platform for Startups

[Auth0 for Startups](https://auth0.com/startups) is a program that provides the convenience and security of Auth0 by Okta to eligible startup customers FREE for a year, so you can get your SaaS application up and running quickly while keeping your users’ data secure.

Some of the benefits of the program are:

* Up to 100k Monthly Active Users
* Up to 5 Enterprise Connections
* All the B2B features you need to scale your business

> Learn more and apply for the program in[ the customer identity platform for startups](https://auth0.com/startups).

Solving Digital Identity Management for Your SaaS Application

Tailor registration flows to maximize conversion while meeting business requirements.

Sign-up and login are two critical entity points for your business. They not only provide a means for your company to collect customer data, present and collect consent, and authenticate and verify users and their data, but they also serve as moments to establish brand image and trust. Because of that, these experiences need to be localized, branded, and consistent for your customers and would-be customers.  

For each company, this will be different. This means that companies require the flexibility to modify sign-up and login forms with additional fields and elements to address their unique use cases, business needs, evolving regulatory requirements, and customer demands for transparent, convenient, and personalized experiences.  

And with that, **we’re excited to announce that new sign-up customization capabilities are now available in early access within our Universal Login experience!** This flexibility will ensure that our customers can tailor their sign-up flows to meet their specific use cases.

## How Does It Work?

Customers can customize existing signup prompts by adding custom content and form elements to meet diverse customer preferences, business, localization, and internationalization requirements. No need to host your own pages, which introduce different URLs and separate code bases that slow time to market and create an inconsistent customer experience. 

This includes client and server-side validation, leveraging the Pre User Registration trigger, to ensure that required data, such as Terms of Service acceptance, are completed and validated before completing the signup process.

![How Does It Work](https://images.ctfassets.net/23aumh6u8s0i/1ka3a5mkTZz8NLSNjO7HPW/acb847f03bc1854ddfe55b83f40be34b/New_Sign_Up_Customizations_Now_in_Early_Access.png)

## What Use Cases Are Supported?

The initial early access release will provide support for various use cases, including: 

* Collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
* Present Terms of Service/Privacy policy and opt-in before signing up
* Display marketing information and trust signals with URLs and/or images
* Add custom text, links, images, URLs, etc. 
* Localize or customize custom text in different languages (Note: EA release may not include a full scope of localization capabilities)
* Experiment with different designs, copies, and elements 

## How Can You Apply?

If you are interested in joining the early access program, please reach out to your account manager.  

_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


New Sign-Up Customizations Now in Early Access

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Compromised credentials are a threat to your business and customers. Here’s how to reduce the risk.

Credential stuffing is a type of cyberattack in which a cybercriminal uses stolen usernames and passwords from one organization (obtained in a breach or purchased off of the dark web) to access user accounts at another organization.

Credential stuffing attacks are one of the most common causes of data breaches because[ 64% of all people](https://f.hubspotusercontent20.net/hubfs/3791228/2022%20SpyCloud%20Annual%20Identity%20Exposure%20Report.pdf) reuse the same password on multiple (and sometimes all) accounts. In fact, on Auth0's platform alone,[ nearly half of all login requests](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) we receive each day are attempts at credential stuffing.

The opportunity for cybercriminals to use credential stuffing is only growing as more credentials are exposed through breaches; at present, literally billions of compromised credentials are circulating on the dark web. 

However, credential stuffing attacks are preventable if you implement the right cybersecurity measures. Below is what executives need to know about credential stuffing attacks and what can be done to reduce or prevent the likelihood that their organizations will be a victim of one.

> More in the following:
>
> - **[Credential stuffing whitepaper](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)**
> - **[What is broken authentication](https://auth0.com/blog/what-is-broken-authentication/)**

## How Credential Stuffing Works

To execute a credential stuffing attack, cybercriminals add a list of stolen username and password pairs to a botnet that automates the process of trying those credentials on multiple sites at once. Large-scale botnet attacks can overwhelm a business' IT infrastructure, with websites experiencing as much as[ 180 times](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) their typical traffic during an attack.

![Anatomy Credential Stuffing](https://images.ctfassets.net/23aumh6u8s0i/ohyMA4nbwQgkGF77RnSOs/b8997e017022790f156a985fb97c375d/anatomy-credential-stuffing.jpg)

Once cybercriminals find a site where a set of credentials works, they’ll have access to a user's account and personal data to do with as they please, which most commonly includes:

* **Selling access to compromised accounts:** This is particularly common for media streaming services. [Disney+](https://www.cpomagazine.com/cyber-security/new-disney-plus-streaming-service-hit-by-credential-stuffing-cyber-attack/),[ Netflix, and Spotify](https://www.engadget.com/2019/03/13/wickedgen-admin-arrested-stolen-passwords-netflix-spotif/) have all been victims of attacks in which hackers sold access to user accounts for less than the cost of a subscription.
* **E-commerce fraud:** Hackers can impersonate legitimate users at retailers' websites and order a high-value product, either for their own use or for reselling. This is a common (and for criminals, potentially lucrative) form of identity theft, which makes retail the most vulnerable vertical for credential stuffing, according to[ research from Akamai](https://www.akamai.com/newsroom/press-release/akamai-research-commerce-remains-top-target-with-over-14-billion-web-application-and-api-attacks).
* **Corporate/institutional espionage and theft:** While the above crimes have serious consequences for companies and their customers, this third form of attack has the potential to be most devastating for businesses. If an attacker successfully hijacks the account of an employee or admin, they could gain access to all sorts of sensitive personal information, like credit card numbers, social security numbers, addresses, and login credentials as well, all of which they can sell to the highest bidder.

## The Costs of Credential Stuffing Attacks

Although credential stuffing attacks often have a low success rate ([usually one to three percent](https://www.recordedfuture.com/credential-stuffing-attacks/)), their impact on organizations is often anything but small.

For example, the Ponemon Institute's ["Cost of Credential Stuffing" report](https://library.idgcommunications.net/idgcampaigns/documents/uploaded_data/d40/97b/1c-/original/the-cost-of-credential-stuffing_EN.pdf) found that businesses lose an average of $6 million per year to credential stuffing in the form of application downtime, lost customers, and increased IT costs.

Increasingly, regulators, as well as the public, are also holding companies accountable for credential stuffing attacks with stiff fines. Companies may be subject to legal action under data privacy laws such as [GDPR](https://auth0.com/docs/compliance/gdpr) if they fail to implement adequate security measures to prevent such attacks, fail to inform the public of a breach, or don't do enough to protect passwords.

For example, in 2018, the UK's [Information Commissioner's Office (ICO) fined Uber](https://www.computerweekly.com/news/252453244/ICO-fines-Uber-385000-for-data-protection-failings) £385,000 for "a series of avoidable data security flaws" that exposed the data of approximately 2.7 million UK customers. And in 2021, the French Data Protection Authority (CNIL) fined a data controller and its data processor €225,000 “for failure to implement adequate security measures to protect customers’ personal data against credential stuffing attacks on the website of the data controller.”

## Credential Stuffing Attacks vs. Brute Force Attacks

Credential stuffing is considered a type of brute force cyberattack. But in practice, the two are very different, as are the best ways to secure your systems against them.

Brute force attacks attempt to guess passwords by changing the characters and numbers (often in prescribed patterns or with commonly used base password phrases). To protect against them, you can limit the number of failed login attempts with[ brute force protection](https://auth0.com/docs/attack-protection/brute-force-protection), use a CAPTCHA, or require your users to use a stronger password.

However, a strong password won’t stop a cybercriminal from gaining access to an account via credential stuffing because the password is already known. Even CAPTCHA's or brute force protection’s ability to protect users is limited since users often[ change their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die) and cybercriminals have a breached password to iterate from.

## How to Prevent Credential Stuffing Attacks

Most people know password reuse is unsafe but choose to use the same password on multiple sites anyway because they have roughly[ 100 passwords to remember](https://tech.co/news/average-person-100-passwords). Password managers are an option, but [adoption rates are low](https://www.security.org/digital-safety/password-manager-annual-report/). So to prevent credential stuffing attacks, it’s up to organizations to take measures — such as removing passwords altogether — to ensure cybercriminals can’t use stolen credentials to access their users’ accounts. Based on [OWASP's Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), below are several methods for doing so.

### Credential hashing

Credential hashing is the first step to protecting your user's credentials from theft. [Hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) scrambles a user's password before you store it in your database so that in the event that it is stolen, a hacker won’t be able to use them (in theory, at least).

In practice, not all password hashing is uncrackable. As Rick Redman, a penetration tester at KoreLogic, [explains](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/), “The strength of the hash is the insurance policy. It tells you how much time users have to change their passwords after a data breach before they come to harm... If it’s just SHA1, there is no window... If it’s bcrypt, you have time to run away and change all your passwords.”

So although hashing user passwords won’t prevent a credential stuffing attack, it will limit what a cybercriminal can do with those passwords once they’ve stolen them.

### Breached password protection

Breached password protection compares the password a person uses to log in against databases of compromised credentials (like[ haveibeenpwned](https://haveibeenpwned.com/)) to prevent credential stuffing in real-time. 

For example,[ Auth0's breached password detection](https://auth0.com/docs/attack-protection/breached-password-detection) can be configured to notify a user, block them from logging in, or request an additional authentication factor (MFA) if it suspects their credentials were part of a published security breach or if a login attempt came from a suspicious IP address.

### Bot detection

As mentioned earlier, attackers use bots to execute a credential stuffing attack. [Auth0's bot detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature is able to identify a bot attempting to authenticate with [a high percentage of success](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/). It provides protection against credential stuffing attacks with very little friction to legitimate users. When a bot attack is detected, it displays a CAPTCHA step in the login experience to eliminate bot and scripted traffic.

### Anomaly detection

Monitoring what is happening is always a good approach to intervene earliest and stop an attack. If you have visibility of your traffic, you can understand when you are under attack, and you can take action to mitigate attacks. In Auth0, you can use [Log Streams](https://auth0.com/docs/customize/log-streams) to monitor your traffic in near real-time. After creating and configuring a Log Stream, you will start seeing Auth0 events being ingested into your chosen monitoring service. Based on your monitoring service, you can build your anomaly detection dashboard by anayzing the [Attack Protection Log Events](https://auth0.com/docs/secure/attack-protection/view-attack-protection-events).

### Multi-Factor Authentication (MFA)

[Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is a highly effective way to prevent credential stuffing because it requires users to log in with another form of authentication in addition to a username-password combination. For example, this could mean biometric authentication such as a fingerprint, a one-time code sent to a device associated with the user, or an email sent to a secured account — none of which a cybercriminal will have access to.

Although the adoption of MFA has been slow due to concerns about its impact on customer experience, the increase in sophistication and customizability of MFA are helping it catch on. For instance, in February 2020,[ Google announced](https://siliconangle.com/2020/02/12/google-require-nest-users-use-two-factor-authentication-enhanced-security/) it would require Nest smart home users to use two-factor authentication.

### Continuous authentication

Continuous authentication systems use factors like biometrics or behavioral patterns to verify a user’s identity in real-time (while they use an application) instead of a password. As a result, credential stuffing attacks (as well as a number of other cyberattacks) are no longer a viable method for cybercriminals to gain unauthorized access to a user’s account.

### Passwordless authentication

[Passwordless authentication](https://auth0.com/passwordless/) can prevent credential stuffing altogether because it verifies a user with something they have (a device or another account) or something they are (biometrics) instead of a password (something they know).[ Passwordless](https://auth0.com/passwordless/) also creates a better login experience for users and saves organizations time and money from dealing with password resets.

## Passwordless Authentication Is Better for Businesses and Users

Not only does passwordless authentication eliminate credential stuffing attacks, but numerous studies and reports show that it is a[ more secure](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/),[ more user-friendly](https://www.lastpass.com/solutions/passwordless-access/from-passwords-to-passwordless), and[ more cost-effective](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) solution overall than traditional username-password authentication for both businesses and their users.

“Relying on passwords as the primary means for authentication no longer provides the security or user experience that consumers demand,” Andrew Shikiar, Executive Director of the FIDO Alliance, [explains](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) in a joint report with the World Economic Forum. Adrien Ogee, Project Lead from the World Economic Forum, adds, “Better authentication practices are not just possible; they are a necessity.”

Auth0’s platform makes it easy to implement secure, user-friendly passwordless authentication using biometrics, social logins, and more. Learn how to eliminate the risks associated with traditional username and password authentication with Auth0’s Passwordless authentication platform[ here](https://auth0.com/passwordless/).

What Is Credential Stuffing? How To Prevent Credential Stuffing Attacks

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

Win business customers with enterprise-ready Identity

**TL;DR:** Okta has launched the [Auth0](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/), powered by Auth0, with support for two use cases: Consumer Apps and SaaS Apps. This article explores the SaaS Apps use case and capabilities, as well as how product and engineering leaders can accelerate growth with an identity solution built for business customers.

The Software as a Service (SaaS) market is booming, with new products coming online every day. The average number of apps companies use increased to 89 this year, with as many as 187 for larger companies, according to [Okta’s Businesses at Work 2022 report](https://www.okta.com/businesses-at-work/).

All of this growth has created intense competition in the SaaS space. The companies that will win are the ones who can successfully onboard business customers quickly and move upmarket while remaining hyper-focused on their core product. 

In identity and access management terms, this is called customer identity: Learning about your customers and securely building consent-based trust by understanding who they are and how they want to engage with you.

Historically, there have been very limited customer identity options on the market for the SaaS use case, and product and engineering leaders end up using some combination of consumer and workforce identity solutions.

What if you didn’t have to use baling wire and duct tape? Could identity help you capture your market opportunity–instead of slowing you down?

## Customer Identity for SaaS Apps, Simplified 

Auth0 for SaaS Apps enables every app builder to become enterprise-ready and accelerate growth without having to become an identity expert. SaaS-specific capabilities like Enterprise Federation, Delegated Administration, Multi-factor Authentication (MFA), custom branding, and security features are available out of the box. And our robust identity product roadmap means we’re constantly innovating for you, too.

“Kandji is committed to being a pioneer in the future of work by helping companies manage their Apple devices at scale,” said Weldon Dodd, senior vice president of Product Strategy at [Kandji](https://auth0.com/case-studies/kandji). “Delivering the best experience for our customers means making onboarding as slick as possible, managing and customizing workflows, and providing the most secure experience from both an administrator and end-user perspective. We did all of this with Auth0 four times as fast as our DIY solution. And it’s working–we’re already seeing customer revenue trending up.” 

Here are a few of the ways our customers, like Kandji, Blackboard, and TripActions, are using SaaS Apps today.

### Acquire and Onboard New Customers

As your business scales, you want to streamline the onboarding process to your applications, so business customers can start using your product quickly and collaborating with their coworkers. This increases your “stickiness.” With our APIs and SDKs, you can build **Self-Service Onboarding** directly into your application so that your customers can provision access control, set up Single Sign-On (SSO), and invite other members of their organization without burdening your engineering team.

### Personalize Experiences For Your Customers

Technical teams can spend weeks configuring identity manually for each new customer, with lots of back-and-forths to implement changes. **Organizations** is our toolset that helps SaaS companies manage and model identity for business customers as organizations (under a single tenant). It allows you to provide last-mile customization on a per-organization basis to ensure the authentication experience meets their needs, including enterprise federation with any source, account provisioning, onboarding and migration flows, customized branding, and security policies that meet the most stringent requirements.

### Achieve On-Demand Security

[Credential stuffing](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) accounts for 34% of overall login traffic and outpaces normal traffic in some countries (61%) in the U.S. and verticals (more than 80% in retail), according to Okta’s 2022 State of Secure Identity Report. **Attack protection with [Credential Guard](https://auth0.com/blog/auth0-credential-guard-detects-breached-passwords-faster-to-prevent-account-takeover/)** and **[Bot Detection](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/)** enables you to secure the data of your business customers, and help prevent the most common identity-based attacks. We take the burden of managing identity security off your internal teams, so they can focus on shipping new features for your product.

### Customize Authentication For Complex Use Cases

No two business customers are the same, and there will be frequent requests to customize your platform for complex use cases. **Extensibility**–custom code blocks and extensibility points that allow for secure customization at any point in the authentication pipeline–has long been an Auth0 differentiator and is now available through Auth0. And because we maintain the extensibility framework, you can meet unique authentication needs and confidently check off RFP requirements today, with adaptability for tomorrow.

### Become Enterprise Ready and Scale

Your customer identity platform should help you grow and land larger customers more often. With SaaS Apps, customer requirements around **SSO and MFA** are available out of the box. Coupled with cloud choice across AWS and Azure, regional infrastructure for data residency, and our 99.99% SLA, you can grow your business anywhere in the world, one login at a time–without needing to host, manage, or scale an identity solution yourself.

## What’s New for SaaS Apps?

New product innovations for SaaS Apps, announced at Oktane22, are now available for all Okta customers:

* **Okta Workforce Enterprise Connection:** Okta Workforce Enterprise Connection makes it easy for SaaS app builders to offer out-of-the-box integrations to Okta Workforce Identity Cloud, providing end-users with a seamless and trustworthy login experience. This enterprise connection is included on all Enterprise and B2B self-service plans for no additional charge and is now easier to discover and configure for SaaS Apps use cases.
* **Organizations Enhancements:** To support our customer's business growth, Organizations now support greater scalability with up to two million organizations per user (tenant) and two million members per organization. We have also made it easier to search for organizations within the Manage Dashboard, making it even easier to find and administer those millions of business customers in your multi-tenant application.

Ready to accelerate your business with identity? Learn more about Auth0 for SaaS Apps at [https://www.okta.com/customer-identity](https://www.okta.com/customer-identity/).

Auth0 for SaaS Apps Explained

Anne Ellegood

Anne is our Social Impact Product Marketer with extensive experience developing & delivering marketing programs for products, services, and partners that enable sales and build brands. In addition to being an amateur archaeologist, Anne is a self-professed data-hoarder fueled by curiosity & the quest for inbox zero zen.

Product Marketing Director

Nonprofit staff are the first line of defense you have, so here's what they need to know

As a leader of a mission-driven organization, you know that all nonprofit, non-governmental, and charitable organizations count on every stakeholder to help bring their mission and programming to life. The one tool they all have in common?

**Data.**

It doesn't matter if this data is being actively used or waiting for its turn to influence a crucial decision; it's always of measurable value.

It powers nearly all of a nonprofit's business functions; and contains critical information from organization programs and finances to the financials, identities, and personal information of every person in the organization's ecosystem. In ill-equipped, improper, untrained, or ill-intended hands, mishandling of this data can cause unpredictable damage to an organization and its stakeholders. 

## Data Protection – the Fundamentals

Although the responsibility of a nonprofit's data protection and security may fall to a designated individual person or team, even they can't monitor the thousands of actions stakeholders take with their data every day across the organization.

When it comes to keeping data safe, the best defensive measure is an educated and security-aware workforce. However, this is not always the case with nonprofit employees, who can often lack the general awareness and ongoing involvement necessary to play a more active role in safeguarding data. It is essential to include everyone in building an environment where personal responsibility contributes to the organization's cyber well-being.

So what are three fundamentals that can empower your people?

## Fundamental 1: Communicate Policies & Procedures Regularly

As part of staff onboarding, review any data protection and security policies and procedures in place across your organization. All contributors should know what is expected of them. Leaders should make sure this information is kept current and that all staff, and any non-internal parties, are informed and provide an acknowledgment that they've reviewed your policies and procedures as they're made available and updated.

> ⇒ Unsure of where to start with creating policies and procedures for data protection and security, or looking to review what your org has in place?

   

> Check out [Cyber Essentials from CISA](https://www.cisa.gov/cyber-essentials), which is an excellent resource for building a culture of cyber readiness within your organization and CISA's [Cybersecurity Framework](https://www.nist.gov/cyberframework); a gold-standard in helping org's understand and improve their management of cybersecurity risk.

Individual contributors should expect to review this information upon onboarding and throughout their tenure with your organization. If this hasn't been the case, then just ask. Everyone plays a part in keeping data protected and secured. If you're an individual contributor on some (or every) level of the organization, YOU are the best line of defense. Review security policies and procedures and frequently refresh, at a minimum, twice annually.

## Fundamental 2: Ensure Compliance

PII (Personal Identifiable Information), GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Accountability Act), CCPA (California Consumer Privacy Act), and PCI DSS (Payment Card Industry Data Security Standards) — are just a few of the many regulations and standards regarding data usage, protection, and security compliance a nonprofit may encounter and be responsible for adhering to. And what's more, these rules and regulations vary greatly. 

To give you an idea of just how vast protection and privacy laws are around the world, check out this [interactive map](https://www.dlapiperdataprotection.com/) from the global law firm, DLA Piper.

All staff and vendors supporting your organization's mission should understand the compliance regulations and standards regarding the data they have access to and work with. Staying up-to-date on changes in regulations is paramount. Failure to remain current and comply with these regulations and laws may result in heavy fines and/or legal action being taken against a nonprofit.

If your organization relies on vendors who have access to your organization's data, request their most current privacy and security policies and audit reports. Review them and ask for clarifications on anything that may be unclear. It's important to understand the measures they're taking to protect and secure _your_ potentially sensitive data. 

For example, visitors to Auth0, a product unit within Okta's online properties, can learn more about our trust and compliance policies through the information we've provided here:[ https://www.okta.com/trustandcompliance](https://www.okta.com/trustandcompliance)

## Fundamental 3:  Access Accountability

Working remote, working from work, or some variation of the two? In order to access data needed for work, connectivity to a network and login credentials are needed. No matter what your role is at a nonprofit organization, there are some basic measures you can take to safeguard access to the nonprofit's data:

* When connecting, ensure the network is PRIVATE and SECURED. (Public wifi isn't recommended)
* Using unique, random passwords preferably created by a password manager with the longest character count possible (ideally at least 16 characters at the minimum) will help ensure your login credentials are not easily guessed
* Enable [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication) on all your important work and personal accounts. Multi-Factor Authentication, MFA for short, can reduce the likelihood of cyberattacks from stolen credentials. MFA works by requiring additional verification information (known as factors) when they log in using a username and password, providing further proof of identity
* Avoid sharing your account credentials information with anyone in any format (written, electronic, verbal, etc.) 
* Leaders should enforce the _principle of least privilege_ when it comes to who has access to the organization's data at all levels based on their individual role and need. This should be reviewed often and updated whenever there are changes in people or technology 

> **_⇒  The principle of least privilege is a concept in security limiting a user's access rights to only that which is required to do their job_**

These are just the three basic fundamentals for mitigating data risk in a nonprofit at the staff level across the organization. **All staff could benefit from the helpful information we've compiled to create Auth0's resource, [Your Personal Cybersecurity Checklist: Workplace Edition](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist-workplace-auth0dotorg).** The checklist covers basic workplace cyber hygiene, personal cybersecurity, and advanced workplace cybersecurity actions every staff member can follow. It's a great place to start your organization's journey to being more secure and assured in 2022 and beyond. 

<include src="asides/AboutAuth0" />

3 Fundamentals in Data Risk Mitigation for Nonprofit Staff

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Cosmetics firm replaces home-built authentication with Auth0 to optimise developers’ time and simplify security for customers and staff throughout the business

**LONDON. – 9th November, 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta, has been selected by [Lush](https://www.lush.com/uk/en), the global cosmetics retailer, to provide a superior login experience for customers and staff interacting with the online brand. Auth0 will initially power the login experience for Lush’s new chat function and add website authentication, along with centralising its point-of-sale (PoS) system to simplify access to information throughout the organisation, while helping to ensure privacy.

When it comes to pursuing more [ethical ways of doing business](https://weare.lush.com/lush-life/our-ethics/digital-ethics/), Lush is no stranger to pushing the limits. Founded in the 1990s, its commitment to sustainable, cruelty-free production was initially an outlier in cosmetics, but the brand has influenced the direction of the industry as a whole. In the process, it has grown into a successful multinational business and operates in 47 countries with 937 global Lush shops. The latest business numbers can be found on [Lush’s company information website](https://weare.lush.com/numbers).

Traditionally, Lush preferred to build its digital services in-house following its digital ethics code. However, when it restructured its digital business using a microservices architecture, the company found that its approach to authentication complicated its ability to protect customer data, which raised security concerns within the company. What’s more, the time taken for developers to maintain its internally-built authentication system strained innovation across other parts of the business.

“While we didn't experience any major data leaks, our home-baked solution raised red flags for our internal data privacy team, and that posed a huge risk for us since we are a business built on ethics,” said Simon Ince, Lush’s creative technology and innovation lead. “During the development of a new customer chat function, we hit a roadblock with our existing authentication system. Time was not on our side, so we evaluated open standards as an alternative to building in-house. That’s when we discovered Auth0, and the problem was solved in thirty minutes.”

Following the success of the chat system, Lush evaluated Auth0’s solution for use across other parts of the business — including its website redesign and centralizing its global POS system — to create a more seamless, secure, and personalized end-user experience. With Auth0, just two developers were able to add authentication to Lush's website without impacting Lush's existing timeline or roadmap.

“When business and consumer needs rapidly evolve, and the security landscape becomes even more complex, maintaining in-house systems can be a difficult and time-consuming process — one that takes developers away from other, more pressing tasks,” said Steven Rees-Pullman, SVP International at Auth0. “Auth0’s identity platform enables Lush to refocus its development teams where they can bring the most value, while meeting the company’s ethical standards for data privacy and customer security.”

Learn more about [Lush’s implementation](https://auth0.com/case-studies/lush-cs/) on Auth0.com.

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />


Lush Transforms its Login Experience with Auth0

navrup

I am a product marketing manager leading the Digital Experience domains, working to maximize the user experience in everything we do. I bring years of experience taking products to market in the retail, cloud infrastructure, developer language, and SaaS spaces.

Product Marketing Manager

Navrup Tom

Gating your content can be something of a gamble. On the one hand, allowing users to prematurely access your product means that you might wind up serving a lot of users who you never truly monetize. On the other hand, putting a login wall between potential users and content could lead to slower growth and a smaller user base.

According to Blue Research, [54% of users will abandon a website](http://www.prweb.com/releases/2012/1/prweb9086226.htm) if the registration process is too cumbersome. Good product designers know all too well that interrupting a user in their intended path can be a great way to lose them.

Over and over again, the data shows that the more cumbersome a signup process is, the less likely a user is to bother with it at all. [Eighty-six percent of users](http://unbounce.com/conversion-rate-optimization/how-to-optimize-contact-forms/) say lengthy forms make them quit registrations, and 88% will simply [enter incomplete or false information](https://web.archive.org/web/20171209150724/http://www1.janrain.com/rs/janrain/images/Industry-Research-Value-of-Social-Login-2013.pdf) if the signup process is too exhaustive or intrusive.

But how do you solve for registration drop off when your signup process _does_ follow best practices? Lazy registration could be the solution.

## What is Lazy Registration?

Lazy registration allows users to access content _before_ they register as a user. This allows users to experience the product without inputting any of their information and can increase the loyalty and lifetime value (LTV) of a registered user base by building a relationship with the user ahead of account creation.

Where you put the login wall is a conversation similar to deciding where to put a paywall within an app. Ultimately, you’ll have to look at what’s within your user experience that users are going to want to see and use for themselves before deciding the app has value.

Lazy registration has the potential to mitigate some install-to-signup dropoff by giving users time to explore the app, and then prompting them to set up an account when they want to save the information or personalize their experience.

### How progressive profiling fits in

Lazy registration doesn’t just benefit the users of an application. By collecting data from your users as they interact with the application, you’ll be able to tailor their experience to their needs, without bombarding them with questions.

This process is known as progressive profiling, and it means that your users get the content that’s most relevant to them, without being inundated with requests for more information. Examples of progressive profiling include incentivizing certain behaviors with points or rewards, collecting data from pop-ups as the user progresses through the application, or even prompting users to add more data via email or push notification.

Progressive profiling used in tandem with lazy registration allows you to collect a rich store of data on your users, without putting the burden on them. You’re able to build a relationship with them and establish trust ahead of asking for their personal information and use their behavioral data to serve them with more relevant information and experiences.

## Using Social Logins to Avoid Long Signup Forms

If your motivation for implementing lazy registration is for the purposes of progressively profiling your users, it might make sense to also look at incorporating some form of single sign on, or SSO, into your user signup experience.

SSO allows you to build a [richer user profile](https://auth0.com/learn/social-login/), without asking your users manually for a lot of information. Implementing SSO can also have a dramatic impact on your install-to-signup conversion rate. Slowly learning about your consumers also aids in serving more targeted information to them. In the case of Moogsoft, their team found [after implementing SSO](https://auth0.com/case-studies/moogsoft/) with Auth0, that 60% of their users were signing up using Google.

## Lazy Registration Doesn’t Have to Mean Zero Data Collection

In the age-old tug of war between user experience and data collection, it’s the product designer’s job to ensure that the former isn’t being compromised too much for the latter. Often it’s inevitable that there will be some form of the tradeoff between an easy user experience and a richer user profile, but technology is rapidly accelerating to close in on this gap.

Apps can use lazy registration to encourage brand engagement ahead of the acquisition, much like an eCommerce store allows users to browse products without an account, right up until they want to favorite an item or complete a checkout. Lazy registration coupled with SSO and progressive profiling can reduce the burden of effort on the user to register for use while allowing for richer data collection, and an all around more customizable user experience. If you’d like to learn how lazy registration can benefit your business and your customers, please [reach out to the team at Auth0](https://auth0.com/contact-us).

Should You Give Users Access Before They Register

MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

Security leaders will increase visibility and diversity of thought to meet consumer (and business) expectations

From the Colonial Pipeline attack, which resulted in fuel shortages across much of the East Coast, to the devastating breach on Microsoft Exchange, it’s safe to say 2021 was a tumultuous year for cybersecurity. But what will the next year look like?

I reached out to Auth0’s leading security and privacy experts to hear their predictions for 2022, and to learn how organizations will grapple with a changing threat landscape and the ongoing pandemic.

![Predictions](https://images.ctfassets.net/23aumh6u8s0i/e8LLSbz9kUTIssTNzD33k/1c58e52ea17e0bf67b104322e8ade137/cybersecurity-prediction-sep1)

## 1. The Visibility Challenge

It’s been almost eighteen months since the Covid-19 pandemic forced us to rethink everyday life. The workplace was no exception. States ordered tens of millions to work from home, as they sought to limit the virus’ spread. To accommodate this flood of remote working, IT departments raced against the clock to build the necessary technology infrastructure.

Now, the dust has settled. The pressure has eased slightly. It’s time to take a breath. But don’t get too comfortable.

The next challenge for IT leaders — and CISOs in particular — is in securing the newly acquired devices and services underpinning remote working. Monitoring and threat detection will likely prove to be the biggest headache.

> “Visibility is fundamental to security,” explained Cassio Sampaio, Senior Vice President of Product at Auth0. “You can’t stop attacks you don’t see. It’s always better to see attacks in progress, rather than after they’ve occurred.”

Many workplaces deployed new hardware and software in record time to ensure the continuity of the business, leaving little time to integrate them into existing security workflows. Sampaio says the big priority for 2022 will be to bring this infrastructure into view.

> “With teams working remotely for the foreseeable future, now’s the time for IT teams to start focusing on security, with monitoring and threat detection both high priorities,” Sampaio added. “Hybrid working, as well as the growth of BYOD and cloud computing, has shifted the definition of a security perimeter. It now includes identity systems, as well as firewalls and IPS tools. It’s critical organizations extend their visibility to include these.”

## 2. Secure by Default Becomes the Norm

Security breaches can occur because of simple user errors. In some cases, vendors inadvertently facilitate that by issuing products with insecure default configurations, putting the onus on the customer to harden them.

> “Far too often, security is treated as the user’s responsibility. This approach has arguably contributed to several high-profile incidents,” said Shiven Ramji, Chief Product Officer at Auth0.

In August, researchers at Upguard learned some apps running on a popular infrastructure provider were leaking sensitive customer and business data totaling 39m records. This included Covid-19 contact tracing details, payroll records, and biographical customer data.

UpGuard attributed the issue to a default configuration that allowed unauthorized third parties to remotely query the underlying data source. But instead of considering it a bug, the provider described the issue as a well-documented feature.

In the face of massive data breaches and other unwelcome security lapses, we expect vendors will take a more proactive approach in creating guardrails for their customers. A Secure by Design approach will become the default. This philosophy sees products shipped with the most cautious settings by default, accompanied by other vital protective features, including Multi-Factor Authentication (MFA) and Privileged Access Management (PAM)

## 3. Malicious Actors Will Exploit Supply Chain Woes

Global supply chains are in disarray. The cost of shipping products between continents spiked during the pandemic, with ships and containers both in short supply. Meanwhile, soaring demand for semiconductors has resulted in widespread shortages of graphics cards, games consoles, and cars, with the “chip drought” expected to last until 2023.

Amid this turmoil, we can expect to see malicious actors take advantage of the situation, exploiting the widespread sense of desperation among businesses and consumers. There is evidence this has already started to occur, with the FBI reporting an increase in Business Email Compromise (BEC) attacks at the start of the year.

> “If you’re a school awaiting a shipment of Chromebooks for remote learning, or a retailer expecting stock from overseas, you might not question an unexpected invoice, especially if it comes from someone you know. The urgency may override your skepticism,” said Annybell Villaroel, Security Awareness and Culture Manager at Auth0.

## 4. Diversity of Thought and Skill Becomes Regarded as an Asset

The security landscape continuously evolves. In the past decade alone, we’ve witnessed the emergence of malware-as-a-service (MaaS), threat actors expanding by franchising their brand and technology to others, and attacks upon national infrastructure. Deepfake technology and bulk SMS messaging have been used to devastating effect.  

IT teams now face increasingly sophisticated opponents, with attacks delivered in greater volume over a variety of mediums. Combatting this will require organizations to draw from a wider range of skills when filling cybersecurity roles.

> “Bad actors have already diversified their thinking. Businesses must do the same,” said Jameeka Aaron, CISO at Auth0. <br>
> “I’ve always argued for a holistic approach to information security,” she added. “Technical skills are important, but so are the soft skills.”

To find candidates with these skills, organizations will have to broaden their hiring criteria and recruit from places they didn’t previously.

> “To respond to this new threat landscape, businesses will have to shift their focus away from GPAs and certifications. You need people who can build bridges within the organization and evangelize good security practices. And going forward, I can imagine hiring managers will recognize communication and language skills as assets, too,” said Aaron.

## 5. Consumer patience wanes over privacy breaches

Five years ago, Have I Been Pwned — a service that allows members of the public to check whether their personal credentials have been leaked — held records on 1.4 billion accounts. Today, that figure is almost 11.5 billion.

Coinciding with that almost tenfold rise is a greater awareness of security breaches among the general public, and signs their patience has begun to wane. According to Auth0’s latest CIAM survey, 92% of consumers expect businesses to keep their personal information safe.

> “A decade ago, security breaches were smaller and less likely to be headline news,” said Sampaio. “Now, they’re front-page news, and they’ve ensnared some of the largest brands in the world. People are tired and scared, and they want businesses to raise their game.”

Perhaps surprisingly, the survey showed that a larger percentage of businesses, 97%, believe they are obligated to protect their customers’ personal information.

> “This figure likely has its roots in many places. Security breaches are bad PR and are hugely costly for the company involved,” said Sampaio.
> “Recent legislation, most notably GDPR, LGPD, and APPI, introduces significant monetary penalties for organizations that experience a security breach. That raises the pressure further.”

## 6. Consumers Begin Expecting Data Portability & Interoperability

From healthcare and financial services to social networks, consumers increasingly recognize the value of data interoperability and portability. It allows you to seamlessly share medical records between practitioners, to see your banking and credit card information from a single central hub, and port your playlist between streaming services.

> “One of the most popular apps in the App Store is Mint, which lets users track spending across their accounts. In the US, FHIR (Fast Healthcare Interoperability Resources) is making it easier for doctors to see the information held on their patients by other medical professionals. From a consumer’s perspective, interoperability is something that makes their lives easier, and data portability allows them to make real choices about who they do business with,” said Lucy McGrath, VP of Privacy at Auth0.

![Interoperability](https://images.ctfassets.net/23aumh6u8s0i/11v4gylcGVWijlKWnhibFw/f7e091c1883197d00af99737574c649d/cybersecurity-prediction-sep2)

Data portability is already a consumer right in Europe thanks in part to GDPR and a number of global sectoral laws - particularly in finance and banking. McGrath expects demand for both portability and interoperability to increase in 2021 and beyond. The OECD has outlined the detailed benefits and challenges in its report _Data portability, interoperability and digital platform competition, OECD Competition Committee Discussion Paper,_ [here](https://www.oecd.org/daf/competition/data-portability-interoperability-and-digital-platform-competition-2021.pdf).

> “It’s likely that we’ll see consumers’ expectation for choice - data portability and interoperability - enshrined in more global laws. It’s an exciting space that is spurring innovation - it’s essential the technology supporting the choice continues to protect the privacy of consumers and security of their data in these complex ecosystems” McGrath said.

Top 6 Cybersecurity Predictions for 2022

tyler-clark

Tyler works as a developer advocate engineer at Auth0. He's worked as an engineer at small to enterprise level companies and loves everything about tech. You'll frequently find him ether out with his family, playing sports, or coding something. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>, and his profile is online at <a target='_blank' rel='noopener noreferrer' href='https://tylerclark.dev'><strong><b>tylerclark.dev</b></strong></a>.

Senior Developer Advocate Engineer

Tyler Clark

Easily manage the business customers that access your applications



We're very excited to announce a new way to enable businesses and teams to access your applications: **Auth0 Organizations!**

Auth0 is a software-as-a-service product. Like many SaaS platforms, Auth0 can be used by individuals, but more often than not, it is used by teams. When building SaaS, or any B2B application, developers need a way to represent and manage those teams.

Often, SaaS products will have dashboards that allow each of their customers’ administrators to manage their organizations:

- Manage membership and access levels of their team members
- Invite new members with predefined roles
- Connect their identity provider for single sign-on
- Define authentication factors and security policies

We’re forced to build this all from scratch each time we create an application, which cuts into the time we have to build the app itself. We’ve struggled with this at Auth0 when building our applications, like [our Dashboard](https://manage.auth0.com/), and when we speak with engineers and architects that work at our customers’ companies, we’ve heard similar stories.

These problems are common enough to deserve a purpose-built solution, and that is why we built Organizations.

## How Does it Work?

We’re introducing a new “organization” entity that will live in your Auth0 tenant. You can create organizations representing teams, business customers, partner companies, or any logical grouping of users who should have different access to your applications.

![Screenshot of a list of organizations within the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/62tk5hrj3iPvHwgckwvkDJ/3b549543665a5ec999533d4da0ad52a5/approved-asset-three.jpeg.png)

Using Organizations and New Universal Login, you can configure and customize the log-in experience that end users in these organizations have when accessing your product. You can mix and match your branding with your customers in the login experience and email communications and easily configure federation for your larger customers and partners that need it.

![Side by side view of universal logins](https://images.ctfassets.net/23aumh6u8s0i/2UBgf6RIt2WX6kbToKKzg6/28717eead2542bdd0f7c463f030a72ab/asset-blog-2-APPROVED.png)

You can choose from various methods for membership and access management of the different organizations that access your product:

- Define roles for your applications, then invite users to organizations with those roles predefined. Also, the same user can have different roles in different organizations, so you can model user isolation or cross-organizational access as needed for your app.
- Turn on just-in-time membership so that anyone logging in from a specific federated connection becomes a member of the organization.
- Add members via the Manage Dashboard or API, or expose all of this functionality in your application so that your customers can manage their membership!

![Invite members to organizations and edit authentication of organizations](https://images.ctfassets.net/23aumh6u8s0i/12YZpXmHDIoEGhgHuESANn/3c834b9cee90b16711809f80f45b971b/asset-blog-3-APPROVED.png)

## Let’s Build a SaaS App with Organizations!

<AmpContent>
<amp-youtube
    data-videoid="BcUxeThMq74"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<iframe width="560" height="315" src="https://www.youtube.com/embed/BcUxeThMq74" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</NonAmpContent>

Before we walk through a demo application utilizing organizations, let’s chat briefly about who the target audience is again. As the title suggests, SaaS (Software as a service) companies provide cloud-based applications that typically charge on a subscription model. Their platforms help other businesses focus on their core product by relieving stress on other business needs. Think about products like Slack or DataDog. When you log in to these platforms, they need to know what company or workspace you belong to before getting you to the correct login flow and, ultimately, the appropriate tenant in their platform.

With businesses as the target customer for SaaS and B2B companies, handling authentication of users within these businesses can be complicated. How are users organized within a specific target business? What about separate branding, access control, and SSO for each business?

Let’s answer these questions with a demo application and Auth0 Organizations!

### Chat0

Introducing our demo app: Chat0, the demo SaaS company that provides state-of-the-art communication services 😀!

![Screenshot of Chat0 dummy app](https://images.ctfassets.net/23aumh6u8s0i/NlvSED8ZuEQz9KtKjMQ1D/134de05a845d028a5696c84b9e0e9332/orgs-overview-2.jpeg.png)

You can try Chat0 yourself by cloning and installing the repo found [here](https://github.com/twclark0/orgs-sample-app).

Once you have this repo cloned to your local machine, navigate into its directory and then run the following commands:

`npm install`

And then

`npm start`

After running this last command, open Chat0 on your browser of choice at `http://localhost:3000/`.

Chat0 is a React single-page web application for this demo, which means that it doesn’t have a back end. With our artificial SaaS company, we invite businesses to sign up for our communication services.

Once businesses have created an account with Chat0, they can send messages (not included in the demo app code) and view stats of their company’s communications.

![Screenshot of the Chat0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/2Ck8zg899VCR0VrTcJBDiR/e15c935d7db75b7d0ff9260b32efb811/chat0-dashboard.jpeg.png)

As you can see above, we want users of a business to see the data after authenticating. However, we want this page to be branded and have data specific to the user’s business/organization. Again, this is similar to the flow you see when you try logging into Slack and DataDog. The result is your company’s or workspace’s brand and data.

So let’s work with a SaaS company (Chat0), add authentication with organization capabilities, brand those two Universal Login experiences, set up individual connections, and invite new users to an organization.

### Set up Auth0 and Configure the React SDK

![Screenshot of Auth0 applications dashboard](https://images.ctfassets.net/23aumh6u8s0i/ECqJSSY7cAaG82huQqHGc/5b064214fb171f3bbf1a3112cd335d92/applictions.png)

You will first need to [sign up for an Auth0](https://a0.to/blog_signup) account if you do not already have one.

Once you’ve signed up for or logged into your account, you’ll land on the dashboard.

Within the left navbar, click on _Applications_ and then _Applications_ again. Press the _Create Application_ button in the top right corner. Choose the Single Page Web Applications option and give it a good name.

After the application is created, the only configuration you need to do is to update three text boxes:

- _Allowed Callback URLs_
- _Allowed Logout URLs_
- _Allowed Web Origins_

We will update these text boxes with `localhost` for local development.

![Screenshot of Auth0 magic mirror application](https://images.ctfassets.net/23aumh6u8s0i/4HphywO1Dwx0bLISHm8kYc/72cc3194241080779688cf8932013621/applicationsettings.jpeg.png)

I filled out those text boxes as follows:

_Allowed Callback URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they successfully log in.

_Allowed Logout URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they log out.

_Allowed Web Origins_

`http://localhost:3000/`

Now inside Chat0’s code, we need to update the React SDK provider values with the ones created when we created the new application within Auth0.

On the `AuthWrapper.js` page, we need to update the props provided to the `Auth0Provider` component. We need to update the `domain` and the `clientId` with the _domain_ and _clientId_ shown within the Auth0 Application page we just created.

```javascript
export const AuthWrapper = ({ children }) => {
const currentOrganization = localStorage.getItem("organization_id");
const options = {
domain: "dev-rm3u1yq4.auth0.com",
clientId: "OgdvG5snvJGpeIrW9FKXbB5D9UmSQufP",
redirectUri: window.location.origin,
...(currentOrganization ? { organization: currentOrganization } : null)
};
return <Auth0Provider {...options}>{children}</Auth0Provider>;
};
```

The `redirectUri` value is where you want your application to redirect to when logging out.

The `organization` prop is being conditionally passed depending on if we've stored an organization id within the browser yet. We'll talk more about this after we configure Organizations within this application. So hang tight!

If you want to learn more about the Auth0 React SDK, check out this [video](https://www.youtube.com/watch?v=1rgeO_EbSGg)!

### Brand Your Auth0 Application

Auth0 provides easy customization of your Universal Login. Back within your Auth0 account dashboard, click on _Branding_ and then _Universal Login_. This is the login page that Chat0’s business customers will see when they want to authenticate.

If you scroll down to the bottom of the page, you can provide a link to your SaaS company’s logo and colors. As you can see, these are the values I provided for Chat0.

![Screenshot of Auth0 Universal Login customization](https://images.ctfassets.net/23aumh6u8s0i/5TM8XsJKpyfPoSHrmAJjW4/452f8f2acd81876fb20e9502979448b9/universal-login-custom.jpeg.png)

### Configure and Set Up Organizations

At this point, we have a functioning application, complete with simple Auth0 powered authentication. Now, let’s enable organization support and add an organization to our Auth0 application.

Back within our Auth0 dashboard and Chat0 application, notice there is a tab called _Organizations_. Go ahead and click on that tab.

![Screenshot of Auth0 organization settings page](https://images.ctfassets.net/23aumh6u8s0i/2sEk40iRY0ADpuIxlm3WbO/f9c7befb5c3435147a65bfb2261c1210/enable.jpeg)

Go ahead and toggle the green _Display Organization Prompt_ button. As it states below, this will prompt users to enter their organization name before logging in.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/2fDmJPNHNWzbE2RAZBtN3d/69e8dcbc8fce760e5727e8f60822251c/universal-login-2.jpeg)

With the Universal Login ready to accept a user’s input for their organization, let’s now create an organization within our tenant.

On the left-hand sidebar, click on _Organizations_. Then on this page, click on the button that says _CREATE ORGANIZATION_.

![Screenshot of organizations tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/6Z3aYFlcAnFRQMXeG5VXQk/dc050e0f0d41dd03f2e5b044bc42ccaf/dashboardorganization.jpeg)

After clicking on the _CREATE ORGANIZATION_ button, we are directed to this page to add basic information about our new organization.

![Screenshot of how to add an organization](https://images.ctfassets.net/23aumh6u8s0i/2848XRMQCXWk7HWSw2S229/3e49ae7ede2ed1ab7d2481aac6159c73/addorganization.jpeg)

As the text on this page states, the name is a human-readable identifier for the organization. Also, the display name is a friendly name for the organization. For example, I choose `acme` for the name and then `Acme` for the display name.

Once you are satisfied with the new organization, click on _ADD ORGANIZATION_.

You will then see your newly created organization.

Within this screen, you have the power to do a lot of customization. As you can see in the picture below, I have branded my new organization with some colors and a logo.

![Screenshot of an individual organization view](https://images.ctfassets.net/23aumh6u8s0i/39FS8nQYPsJoCSuumYfLfH/fda0ecc4622cbe9952fb33bd8a94026f/individualorg.jpeg)

At the bottom of this page, you can add custom metadata about your organization for extensibility purposes.

The _Members_ tab shows all of the current members within the organization. The _ADD MEMBERS_ button allows you to add a member to this specific organization.

Let’s create a new user and add them to this organization. So on the left-hand side of the page, click on _User Management_ and then _Users_. Here we can click on the _CREATE USER_ button and enter information about a new user. Once this is saved, back in our organization, we can click on the _ADD MEMBERS_ and add this new user to the organization.

The _Invitations_ tab provides the functionality to invite users to this specific organization.

![Screenshot of the members’ tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/3YCjKOoeqzlgNV0Uwy6xnL/0b5d9be884e2813d6f1f182e954df635/invite.jpeg)

After clicking on the _INVITE MEMBERS_ button, you can choose your application from the initial dropdown (only ones with organizations enabled will show in the list).

Then you can add email addresses, determine which connections can be used and what role to assign them as a member of that organization (if there are any roles defined within your tenant).

Finally, on the _Connections_ tab, you can choose which connections you want to enable for this specific organization. Instead of enforcing the same connections to all applications within your tenant, you can control how each organization’s members can log in.

![Screenshot of the connections tab within organizations](https://images.ctfassets.net/23aumh6u8s0i/1kUkcgHRQYH7MrdIAviGLq/7cc069d1394cedade92f597ad6e9053d/connections.jpeg)

And that’s it!

When you go back to Chat0, which is running locally, click on the _login_ button in the header. It will show you the Chat0 Universal Login prompt asking for an organization.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/34QV5KntgVMfvl5m54Gh7l/1df56e270aa9144b368ef0e7f6c8166f/universal-login-2.jpeg)

After entering _acme_ (the name of the newly created organization), it’ll open up the Acme-specific login.

![Authentication prompt for the acme organization](https://images.ctfassets.net/23aumh6u8s0i/3R0aMeqwdCOzTq5I8MKMtH/8eba028a984741815073a7aeaabe06f2/acme.jpeg)

Login with the user you created earlier, and then you will be redirected to the Chat0 dashboard for Acme users.

![Screenshot of a dashboard branded with the acme logo](https://images.ctfassets.net/23aumh6u8s0i/3SLUeDBuqPkcMceXiPZZEi/198df05368106dbf4482cf1a41e7d2c9/acmedashboard.jpeg)

Remember when we discussed conditionally setting the `organization` prop on the `Auth0Provider` component above? Within the `Sidebar.js` component, we set this `id` within `localStorage` when we get it.

```javascript
const { user } = useAuth0();
useEffect(() => {
if (user.org_id) {
localStorage.setItem("organization_id", String(user.org_id));
}
}, [user.org_id]);
```

The Auth0 React SDK provides the `user` object. This includes basic information about the user after successful authentication.

Setting and retrieving the authenticated organization id is what keeps the user authenticated when refreshing the page.

## Taking It Further

This article barely scratches the surface of the full functionality of Organizations. Using these new features, you can:

- Represent the teams, business customers, and partners that use your applications as organizations in Auth0.
- Set up branded, federated login flows for each organization.
- Manage organization members in a variety of ways, including just-in-time membership and email invitations.
- Define roles to represent what end users can do in your applications and assign those roles to organization members to have different roles in different organizations.
- Build administration capabilities into your products so that administrators in those organizations can manage their membership and access levels.

## What’s Next

As of today, Organizations is available for Auth0 subscribers on our Enterprise and Startup plans. You can find [technical documentation here](https://www.auth0.com/docs/organizations). We’ll be introducing new capabilities to improve organizations. We’d love to hear your thoughts about what we should focus on next; just comment below or send us questions [in the community forum](https://community.auth0.com/).

Introducing Auth0 Organizations

Desire for ease and security driving consumers to seek out modern identity technology


> Editor's Note: The Login Experience Customers Want study has been expanded to include 12 markets and is now available as part of The Log Inn campaign. To learn more about the campaign and read the full study please visit: https://info.auth0.com/expectation-vs-reality

**LONDON – June 1, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced findings from its international research into Customer Identity and Access Management (CIAM), ‘[The Login Experience Customers Want](https://info.auth0.com/expectation-vs-reality).’ The study, conducted by Auth0 and YouGov, reveals that most organizations fail to meet consumer expectations around login technology, highlighting how a login box can impact the user experience of a brand.

The study found that consumers around the world want greater choice in login technologies, and actively seek them out. Half (47%) of consumers surveyed say they are more likely to sign up to an app or online service if a company offers Multi-factor Authentication (MFA). More than four in ten (44%) are also more likely to sign up if they can log in with [Single Sign-On (SSO)](https://auth0.com/case-studies/siteminder/) – using a single ID and password for multiple related services, followed closely by demand for biometrics (42%), [social logins](https://auth0.com/case-studies/flo-health/) (34%), and passwordless (32%). 

Most businesses don’t offer these login options, despite the demand, and general [frustration with using traditional passwords](https://info.auth0.com/expectation-vs-reality). While 45% of businesses surveyed do offer SSO capabilities, less than [one-third offer MFA](https://auth0.com/case-studies/siemens/) (28%), biometrics (21%), social logins (31%), or passwordless (20%). Across the six markets surveyed, 11% of the IT and marketing decision makers said they don’t offer any of these login technologies.

“Clearly, there’s a gap between consumer and business expectations, but it really comes down to convenience. Consumers want to use digital services, but if the login process is clunky or frustrating, they will take their businesses elsewhere,” said Steven Rees-Pullman, SVP, International at Auth0. “With the proliferation of online threats, organizations are challenged to find the right balance between ease and security, and it’s really an ‘aha moment’ when they realize how identity management can help.”

Comparing the results internationally, European organizations are on par with their Asia-Pacific counterparts in offering SSO for their customers; however, they’re well behind the curve when it comes to biometric login adoption vs. consumer expectations. UK businesses are falling especially short when it comes to biometrics, where only 14% of businesses offer biometrics, MFA (28%), and passwordless (13%). 

APAC organizations are ahead of their European counterparts in offering technology such as social logins, biometrics, and MFA. Australian and Singaporean businesses are twice as likely to use biometric login, with 34% of IT and marketing decision-makers surveyed saying their companies currently offer customers the ability to log in with the use of biometrics, compared to Germany (17%), Japan (15%), France (14%), and the UK (14%).

“MFA and SSO are still relatively new technologies for the vast majority of organizations, and developing biometrics or passwordless is a heavy lift,” adds Rees-Pullman. “With a modern identity platform, businesses can not only offer the easiest and most secure user experience possible, but they can also experiment with different login options to find what works best for their audience.”

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

## Methodology

‘The Login Experience Customers Want’ study was conducted online by Auth0 and YouGov between 23 February and 1 March 2021. The research consisted of two surveys, questioning more than 8,000 consumers and 1,200 IT and marketing decision-makers who work for businesses that offer an app/online service to customers (excluding sole-traders) across six global markets: the UK, France, Germany, Australia, Singapore, and Japan. The data for the consumer study was post-weighted by age, gender, and region to reflect the latest population estimates in each market.

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Businesses Fall Short of Consumer Expectations for Login Experiences, Auth0 Survey Reveals

Lucy McGrath

Lucy is VP, Privacy at Auth0. She's a lawyer and global data privacy expert with diverse experience working with some of the world's leading media and technology companies. As Auth0’s VP, Privacy, she leads global data privacy strategy and is driven by a passion for further embedding privacy-by-design and continuing to shape our culture of privacy that starts with finding the humans that we impact every day.

VP, Privacy

LGPD carries implications for businesses beyond Brazil’s borders. Here’s what execs need to know.

Lei Geral de Proteção de Dados Pessoais (LGPD or General Personal Data Protection Law) is Brazil’s data protection and privacy law that is closely modeled on the General Data Protection Regulation (GDPR) in the European Union. LGPD was passed by the National Congress of Brazil on July 10, 2018, in an effort to unify and enhance 40+ data privacy instruments within the country into a single piece of legislation. LGPD went into effect on September 18, 2020. Like the GDPR, the law impacts global organizations beyond Brazil’s borders.

The extent to which LGPD applies to your organization will depend on the specific nature of your business, so you should always seek skilled legal counsel to help you navigate compliance requirements. However, if your organization does business in Brazil or collects/processes the data of any individual within Brazil, you should familiarize yourself with LGPD’s requirements (summarized below) to understand what impact these regulations may have on you.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Important Information</strong><br> 
  <b>The following information is not intended as legal advice, and readers should consult with their attorneys about matters of compliance.<br> 
</div>

## Why LGPD Was Passed

LGPD was passed to demonstrate and protect individuals’ right to privacy. Despite Brazil being [Latin America’s technology leader](https://www.launchwaymedia.com/blog/brazil-latin-americas-technology-leader) and [one of the top 10 tech markets](https://www.zdnet.com/article/it-investments-in-brazil-surpass-world-average/) in the world, its data protection laws have failed to keep pace with this technological growth. As a side-effect of that rapid growth, Brazil has experienced a number of recent [high-profile data breaches](https://portswigger.net/daily-swig/brazil-reaches-towards-cybersecurity-maturity). LGPD establishes a clear requirement for organizations to implement controls that protect individuals’ personal data, with the end goal of reducing the impact of breaches on individuals.

### LGPD Establishes the National Data Protection Authority

In addition to introducing privacy regulations, the LGPD also established a separate national authority, the Autoridade Nacional de Proteção de Dados (ANPD or National Data Protection Authority in English), which is responsible for enforcing the law, including issuing penalties and fines. The creation of the ANPD was originally vetoed by President Jair Bolsonaro but later reinstated via [executive order](https://www.mondaq.com/brazil/data-protection/818496/provisional-measure-no-86918-creates-the-brazilian-data-protection-authority-and-amends-several-articles-of-the-brazilian-general-data-protection-law) in August of 2020.

## Who LGPD Applies To

LGPD applies to any organization (or individual) regardless of size, industry, public or private status, or country of residence.

Any legal entity or natural person processing data collected from persons in Brazil (“data controller”) is subject to LGPD if:

- The data collected/processed is about people in Brazil.
- The processing is carried out **inside Brazil;** or
- The processing is for the purposes of offering and selling goods or services to individuals in Brazil.
- The processing is of personal data collected within Brazil.

### Exceptions

There are some limited exceptions to the applicability of LGPD. Exceptions include situations where the data is being collected and/or processed:

- By a natural person for private and non-commercial purposes.
- For journalistic, artistic, or academic purposes, regardless of who does the collecting.
- For the purposes of national security, defense, or public safety.
- For investigating and prosecuting criminal offenses.
- If the personal data originates in other countries and only passes through Brazil without any processing being carried out.

## LGPD Includes a Broad Definition of Personal Data

[LGPD defines](https://iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/) personal data broadly as any information that could be used to identify an individual. This includes any information that could be combined with other information to identify an individual. That means information such as email, IP addresses, phone numbers, geolocation, and credit card numbers can all be considered personal information under LGPD.

### Sensitive Personal Data

Brazil has a culturally and racially diverse population. Like Europe’s GDPR, LGPD recognizes that additional protections are sometimes needed to protect individuals against discrimination. These potentially higher-risk attributes are defined as “sensitive personal data” under LGPD and include:

- Health information
- Genetic information
- Sexual information
- Medical information
- Biometric characteristics
- Racial or ethnic origin information
- Political affiliations
- Religious affiliations

## LGPD Compliance Obligations

LGPD is a significant enhancement and consolidation of Brazil’s previous data privacy laws, and the changes will affect organizations in every industry. Below are some of the key compliance considerations businesses will need to consider.

### 1. Define and Document Lawful Basis for Processing Personal Data

LGPD requires every organization that collects or processes personal data to have at least one of the following legally acceptable reasons for doing so, as well as to document those reasons for auditing purposes.

- **Consent from an individual to process their data.** Any individual over the age of 18 can consent to the processing of their personal data.
- **To follow applicable regulatory requirements and public policies.** Organizations can collect and process data if it is required in order to follow laws and regulations that apply to them.
- **For the purpose of conducting a study or research.** Research is a legal basis for personal data processing, as long as organizations take reasonable steps to anonymize that data.
- **To fulfill a contractual agreement.** Processing an individual's personal data is acceptable if you’ve signed a contract with that individual to deliver goods or services and need to process their data to provide it to them.
- **Legal proceedings.** Personal data may be processed for the sake of a court case, arbitration, or other legal proceedings.
- **To protect the life or physical safety of an individual or a third party.** For example, national security is a legally acceptable reason to process personal data.
- **To protect an individual’s health in healthcare procedures.** For example, it’s acceptable to process personal data to ensure you’re not putting a patient at risk during surgery.
- **For the legitimate interests of your organization or a third party.** Your organization’s interests are a legal basis for processing personal data, as long as those interests do not conflict with the rights, freedoms, or interests of an individual.
- **For the sake of protecting an individual’s credit.** Protecting an individual’s credit is an acceptable basis for processing data, as long as that processing is done in accordance with the provisions laid out in other relevant legislation in addition to LGPD.

### 2. Honor the Privacy Rights of Individuals

Like GDPR, LGPD provides individuals with several rights that they can request organizations to recognize and uphold at any time. Organizations must have internal procedures and processes in place to respond to requests from individuals who exercise these rights, which include:

- **Confirmation of processing.** Individuals have the right to confirm whether their personal data has been or is being processed.
- **Access to personal data.** Individuals may request access to any of their personal data that an organization processes.
- **Data portability.** Individuals may request that their personal data be transferred to another service or product provider, as long as that request is in accordance with other national regulations, doesn’t compromise any commercial or industrial secrets, and the data hasn’t already been anonymized.
- **Rectification of inaccurate information.** Individuals may request that inaccurate, outdated, or incomplete personal data be corrected or updated.
- **Anonymization, blocking, or deletion of data.** Individuals can request that unnecessary or excessive personal data, or personal data processed in a non-compliant manner, be anonymized, blocked, or deleted.
- **Deletion of data.** Individuals may request to have their personal data deleted at any time where processing is based on consent.
- **Right to be informed.** Individuals have the right to be informed about third parties granted access to their personal data. Individuals also have the right to be informed regarding their right to refuse consent.
- **Withdrawal of consent.** Individuals have the right to revoke their consent to process or collect data at any time.
- **Review of automated decisions.** Individuals have the right to request the review of decisions solely based on automated processing that affects their interests, including profiling.
- **Filing complaints.** Individuals may file a complaint against an organization with the ANPD if they feel that any of these rights have been violated.

### 3. Appoint a Data Protection Officer (DPO)

The LGPD requires every organization under its jurisdiction to appoint a data protection officer (DPO) to be their point person for data protection efforts. The DPO does not have to be an individual person; a committee can provide this service, as can an outside consultant. The DPO is responsible for ensuring that the organization takes appropriate action to protect personal data and for communicating with end-users and government authorities on matters related to data privacy. The identity and contact information of the DPO must be available to the public (preferably on your website).

### 4. Prepare, Inventory, and Conduct Data Protection Impact Assessments (DPIA)

To comply with LGPD, you must document the types of data you’re collecting, the methods used, along the steps taken to secure that data. You must also identify potential risks and document what you’ve done to mitigate them. Every organization that falls under LGPD’s jurisdiction should have these records on hand to show to a regulator upon request.

### 5. Follow Data Security Requirements and Data Breach Notification Protocols

Organizations must implement adequate organizational and technical controls in order to secure personal data from unauthorized access, deletion, alteration, sharing, or processing. In the event that a breach occurs that presents a risk or causes damage to individuals, organizations must notify the ANPD and individuals affected by the breach within a reasonable time period and include the following information:

- The type of personal data that was exposed and the individuals affected
- The risks associated with the exposure of that data
- The security measures in place to protect personal data (unless sharing this information would disclose industrial or commercial secrets)
- What your organization is doing to mitigate the effects of the breach on the individuals at risk

The ANPD may require an organization to take further steps, such as alerting the media about the breach or taking specific steps to mitigate the effects of the breach on affected individuals. These actions are assessed on a case-by-case basis.

### 6. Implement Privacy by Design

Like GDPR, LGPD requires organizations under its jurisdiction to design their data processing systems and procedures so that privacy is the default setting (the approach known as privacy by design) rather than adding privacy controls to those systems as an afterthought. Organizations should also be prepared to demonstrate the effectiveness of their data protection measures to the ANPD, as an audit could be conducted at any time.

### 7. Comply with Cross-Border Data Transfer Requirements

LGPD allows organizations to transfer protected personal data outside of Brazil if the laws of the country the data is transferred to provide adequate protection for that data. Adequacy of protection is determined by the ANPD. In the event that the protections offered by the receiving country are deemed inadequate by the ANPD, transfers may still be allowed if [certain conditions](https://iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/) are met.

## Penalties for Non-Compliance

Under LGPD, penalties for non-compliance are assessed by the ANPD and can include fines of up to 2% of a company’s annual revenue to a maximum of 50 million Brazilian reais per violation (approximately €7.5 million or $9M USD at the time of writing). The ANPD also has the authority to block access to or delete personal data from related databases and to partially or fully prohibit data processing activities in the event that a violation occurs. Additionally, the LGPD provides individuals with the right to seek civil damages for violations of their privacy, meaning organizations could face legal action from consumers in addition to fines assessed by regulators.

## Go Beyond Compliance

Regulations like LGPD and GDPR are landmark steps toward the protection of individuals’ right to privacy. But their similarities should also serve as a wake-up call to organizations everywhere that data privacy will require a lot more than plugging in a new set of controls for their existing systems in the future.

Instead, businesses should look to build privacy functionality into their systems from the outset, considering the well-being of the end-user rather than just the legal requirements. Not only will this help them earn the [trust of consumers](https://hbr.org/2020/01/do-you-care-about-privacy-as-much-as-your-customers-do), but it will also likely simplify the process of complying with new regulations as they emerge.

What Is LGPD? A Business Guide To Brazil's Data Protection Law

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

With an identity clearinghouse, you can stay focused on your business, not figuring out who your users are.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>


## What Is Federated Identity Management?

In the early days of the web, your digital identities were dispersed across all the different sites and applications that you used:

* Each time you went to a new site, you made up a username and password.
* They were then stored on that site.
* Every time you returned, you had to re-enter your credentials, and so on and so forth for each site you visited.

This was an unwieldy system. Users would never stay logged in across sites, even when those sites were managed by the same organization. It was like an amusement park where you had to identify yourself as a paying visitor at each ride.

![Non Single Sign On scenario](https://images.ctfassets.net/23aumh6u8s0i/3pAEBDQyBT2dAsPrW5xepc/0a232360554394e039154ff96d1855b3/non-sso-scenario)

The problem was that if an organization wanted to have user credentials carry over from one domain to another, then there would have to be a new system for authentication. As the internet grew more complex and more interconnected, developers started to realize that siloing authentication on individual domains was not a scalable system.

## How Federated Identity Management Works

[The web's early infrastructure was not built to permit federated identity management](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/)—it worked against it. In fact, it was one of the earliest and most crucial principles, the same origin policy, that made the idea very difficult to implement:

* The same origin policy states that no cookies or other information stored on an end-user's computer can be accessed except by the original *creator *of that information.
* This is fundamental—it means that domain Y can't rifle through your data and find your username and password to domain X. Without this policy, the whole idea of internet security would be moot.
* What this meant was that companies with multiple domains, if they wanted users to have a seamless, fluid experience navigating between them, had to find another way to securely transfer information.

![Same Origin Policy Forbid this](https://images.ctfassets.net/23aumh6u8s0i/Y4uwUUFRMNldhozrmwmBI/38d2f66d0e665259c3019bf48c38df01/same-origin-policy-forbids-this)

All federated identity management systems are, in some way, methods of transferring data without violating the same origin policy. Here's how it generally works:

* You (the user) try to log into the client (an app)
* A request for authentication is sent from the client to an authorization server
* Authentication is returned from the authorization server to the client
* You (the user) are permitted to access the client (or not)

This way, if domain X and Y are related, and their owners want users to move freely between the two, they can simply triangulate around an external authorization server. This benefits overall security (by exposing the client to less overall log-in attempts, and therefore less risk) but the clearest result is a unified, smooth user experience.

## The Single Sign On Era

Today, we see federated identity everywhere, most noticeably in what we call “single sign on.” With single sign on, you can log into your GMail and then open up YouTube in a different tab, for instance, and you'll stay logged in. It all hinges on a central domain verifying the status of each user as they move across sub-domains:

* You log in once
* Authentication is done through a central domain
* A token or cookie is generated to authenticate you across other domains

![Typical Single Sign On](https://images.ctfassets.net/23aumh6u8s0i/4hakDPwQtaPfcDNwkd4C9x/e54ee76304953540b4b71fcccbaf690a/typical-sso-v2)

[Dozens upon dozens](https://auth0.com/docs/identityproviders#enterprise) of different SSO identity providers have cropped up to provide this kind of service to webmasters, each with its unique requirements, uses, strengths and weaknesses:

* SAML
* OpenID Connect
* Facebook Connect
* Microsoft Active Directory
* Twitter

Some are more enterprise-focused, while some authenticate through social media and are better for personal use. Some use a decentralized system—with SAML, for instance, any node in the SAML network is capable of accepting the authentication done by another node. Some don't—when you log in through Facebook Connect, all authentication is done by Facebook.

Emerging in popularity now are passwordless systems, where your access does not hinge upon a set of credentials but your possession of some other factor, like your cell phone or unique fingerprint:

![Passwordless Connections](https://images.ctfassets.net/23aumh6u8s0i/To08k5ZER7MI9Iv5VcODK/1a512270d5e87fce8ccd47043c412529/passwordless-connections)

When you're choosing an identity provider and means of authentication, you need to take into account each provider's limitations and benefits and choose the one that's best for your users and your needs.

[Learn how to evaluate a modern identity management solution that fits your needs in this free eBook, Build vs Buy: Guide to Evaluating IAM.](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/)

## The Problem With Decentralization

Of course, the profusion of different SSO services presents a dilemma. If you're running a site, you usually choose one. That means other authentication services won't work. And the problem just gets worse the bigger your organization gets. Today, you might have:

* A dozen internal tools and third-party tools rotating in and out of use just at your own company.
* Each tool is built on a different stack and speaks to the others with a different protocol.
* Customers with tens of thousands of employees, each with their own arsenal of third-party tools.

In the old days, all corporate software was stored on massive internal server racks. There was no need to worry about integration because everything you needed was stored in one place—everything was already integrated. Now there are endless different social and enterprise options just for logging into an app:

![Social Providers](https://images.ctfassets.net/23aumh6u8s0i/13Ied0gAWBe6wLbuCrXP6R/b82464213f04accf721fcd0422e7bff5/social-providers)

![Enterprise Providers](https://images.ctfassets.net/23aumh6u8s0i/4fvVxxcQm5nkKxe9GzfgaY/6c0a42804631b8de96c08a56e67a3145/enterprise-options)

Now, providing that kind of integrated experience means negotiating between all the different identity providers that your users authenticate with, but it also means dealing with different:

* **Authorization practices:** delineating specific access restrictions, i.e. “Can user X access Y section of the site?” and keeping those consistent.
* **Attributes exchange practices**: avoiding the duplication of user data created by the interactions between different identity providers.
* **User management practices**: being able to access, create, update, and delete user accounts.

All SSO can do is authorize different kinds of people when they come to use a service—it's just one aspect of a federated identity management system.

## Auth0 and Federated Identity Management  

Auth0 is both a classic identity provider and a federated identity management system. This means that you can set it up so that:

* Users see an Auth0 log-in box when they visit your site
* When they sign up, their credentials are stored with Auth0
* When they log in, their credentials are authenticated with Auth0

<include src="TweetQuote" quoteText="Auth0 is both a classic identity provider and a federated identity management system."/>

![Auth0's solution](https://images.ctfassets.net/23aumh6u8s0i/7yX585bQJMurpZkF2cg1Oq/a56b325dc9ce56f4dc5a5847eaf92622/auth0)

With this arrangement, Auth0 behaves as a normal single sign on app. You can then go to any other app or site that uses Auth0 and you will remain logged in if an administrator has enabled that option.

But with just a few lines of code, you can also

* Integrate with virtually any protocol you want to make available to your users: SAML, OpenID Connect, Facebook Connect, Microsoft Active Directory, Twitter, and more.
* Manage user accounts and check out your identity-based analytics right in the Auth0 dashboard.
* Leverage your users' social data to provide a personalized onboarding experience

Auth0 is a true federated identity manager in the sense that it doesn't *just *allow for you to stay signed in across domains. Auth0 also gives you access to the user accounts of everyone on your system, allows you to set specific access restrictions across identity providers, and keep all of this data consistent.

Auth0 can be a clearinghouse for the identities of all your users whether you're running a consumer-facing mobile app or an enterprise system with a SAML-based identity provider. One click is all it takes to turn integrations on and off, and to secure them with Auth0's [full lineup of security features](https://auth0.com/security).

[Learn how to evaluate a modern identity management solution that fits your needs in this free eBook, Build vs Buy: Guide to Evaluating IAM.](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/)


Why Federated Identity Management Matters

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

If your organization stores customer data in the cloud, SOC 2 compliance is table stakes.

In the last two years alone, cloud-based cyberattacks[ more than doubled](https://www.trustwave.com/en-us/resources/library/documents/2020-trustwave-global-security-report/) — even though SaaS spending[ grew just 18%](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/). 

While these numbers are merely a correlation from a statistical standpoint, it does indicate that if your business stores customer data in the cloud, it’s more important than ever for your business to take measures to secure that data. Especially given SaaS spending is[ expected to increase an additional 36%](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/) between 2020 and 2022. 

A SOC 2 certification from the AICPA is a foundational step that will help every service provider reduce security risks. Below is a guide to SOC 2 compliance requirements and certification.

## What Is SOC 2?

SOC 2 is an independent audit report that evaluates the security controls a tech service business uses to protect the data they process in the cloud. Possession of a SOC 2 report is considered table stakes in the SaaS industry, as the answers to most security questions a customer may have about their business’s security posture can usually be pulled from this report.

### SOC 1 vs. SOC 2 vs. SOC 3

“SOC” stands for “System and Organization Controls” and was created by the American Institute of Certified Public Accountants (AICPA). SOC 2 is one of three SOC reports, each with different purposes and/or levels of transparency:

1. **SOC 1.** Used to audit internal controls relevant to a customer’s financial systems. Report usage is “restricted,” meaning its use is limited to auditors, the service organization, and authorized users.
2. **SOC 2.** Used to audit the overall management of customer data. Report usage is also “restricted” the same way SOC 1 is.
3. **SOC 3.** The same as SOC 2, but the report is simplified and publicly available to increase transparency.

![What Is SOC 2](https://images.ctfassets.net/23aumh6u8s0i/5LsphelbdnIZtLBd7NOrZQ/3e05f625deb2ff6588f9bffbf2dc3449/sep_compliance_02.jpg)

## Why SOC 2 Compliance Matters

SOC 2 compliance isn’t a legal requirement for a tech business. However, having a SOC 2 report is a common compliance objective for service providers that store their customers’ data in the cloud because it’s a necessity from an assurance (and therefore[ competitive](https://www.forbes.com/sites/forbesbusinesscouncil/2019/10/09/using-cyber-security-as-a-competitive-advantage/?sh=260c85237ff7)) perspective.

For many small to medium-sized operations that store marginally-sensitive data (for example, information that’s already publicly available), a SOC 2 report usually provides enough assurance of their controls and procedures to their customers. 

However, for businesses whose data is considered[ sensitive](https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en) (health data, for example), a SOC 2 report is the minimum a business should have in order to assure their customers they’ve taken steps to protect their data.

![Why SOC 2 Compliance Matters](https://images.ctfassets.net/23aumh6u8s0i/2gAtMudqliW2LiC3h7imD9/db7be0b8025f315b137a7744e7d5d469/sep_compliance_03.jpg)

## The SOC 2 Certification Process

SOC 2 certification is completed by a third-party auditor who assesses the extent in which service provider’s controls comply with one or more of SOC’s five Trust Services Criteria (TSC): Security, Privacy, Confidentiality, Processing Integrity, and Availability.

SOC 2 is different from other security certifications because it lets each business decide how best to implement the SOC 2 framework. The auditor evaluates how well the business has implemented controls relative to each of the TSC and its operations and gives their opinion of overall effectiveness.

The auditor then compiles their opinion and findings into a report (the SOC 2 Report) you can then use to assure your customers of the steps you’ve taken to manage their data.

The SOC 2 Report comes in two different types (Type 1 and Type 2), and each has an impact on how the certification process proceeds. However, since each requires an evaluation of your practices against the five Trust Services Criteria (TSC), we’ll address those first and explain how each of the report types affects certification in more detail afterward.

### SOC 2 Trust Services Criteria

Tech service businesses can choose to certify in as many or as few of the TSC as they like. Most businesses choose to earn a certification for one to three of the criteria. However, businesses that process sensitive data will benefit from earning certification in all five.

Below is what earning certification in each of the SOC 2 Trust Services Criteria entails:

1. **Security.** An evaluation of both the electronic and physical controls a business uses to protect the customer data they process. Auditors will examine security measures, like, network security, vulnerability management, and security monitoring, as well as the steps you’ve taken to secure any access to the physical devices and locations your customers’ data, is stored on in order to prevent unauthorized access.
2. **Privacy.** An evaluation of how a service business collects and uses customer data. Auditors will compare a company’s privacy policy(ies) to the actual operational procedure(s) to ensure they’re in alignment with the AICPA’s Privacy Management Framework ([PMF](https://www.aicpa.org/interestareas/informationtechnology/privacy-management-framework.html)).
3. **Confidentiality.** An evaluation of how data is stored, accessed and shared. Auditors will examine the procedures and access controls you have in place to restrict who has access to customer data, as well as any technical measures, like encryption, you’ve implemented to keep data safe.
4. **Processing Integrity.** An evaluation of your quality assurance and processing-monitoring practices. Auditors will examine whether data is called from your servers in the same state it was stored — and that it’s only called for the people who are authorized to access it.
5. **Availability.** An evaluation of whether your customers have access to your system as outlined in their contractual agreement(s). Auditors will examine controls and procedures-performance monitoring, business continuity, disaster recovery, and incident management to ensure they match what was promised.

![SOC 2 Certification Process](https://images.ctfassets.net/23aumh6u8s0i/3lefYYa9FsqqIVecGGpIlV/88a934fa5d9dbb876787096be7536747/sep_compliance_04.jpg)

## The SOC 2 Report

Once an auditor completes their evaluation of the security measures you’ve implemented, you’ll receive either a SOC 2 Type 1 Report or a SOC 2 Type 2 Report (depending on which you chose to certify for). Both reports contain an explanation of everything you’ve done to keep your customers’ data safe:

1. The controls you’ve implemented
2. How they align with the Trust Services Criteria
3. An explanation of your company’s operations
4. How the auditing process was conducted
5. How you’ve implemented controls to secure the user environment

However, the differences between each report type mean that obtaining a SOC 2 Report can create a substantial increase in the effort and work required to comply.

### SOC 2 Type 1 Report

A SOC 2 Type 1 Report is an evaluation of the design of your controls at a specific moment in time. This means the certification process required for a Type 1 Report can occur relatively quickly (in the time it takes for an auditor to evaluate your systems and procedures).

### SOC 2 Type 2 Report

A SOC 2 Type 2 Report is an assessment of the operational effectiveness of your controls. The evaluation is done over a period of time to observe how effective those controls are in practice instead of just at one specific moment, as in a Type I Report.

A SOC 2 Type 2 Report typically requires months of auditing to obtain. But the increase in assurance it provides is often worth it for service organizations that process sensitive data. Traditionally a SOC-2 Type 2 covers a 6-12 month period. 

![Additional Security Certifications That Are Worth Pursuing](https://images.ctfassets.net/23aumh6u8s0i/Xb8Z3o1JWLQE9ZlM2vcQw/303397e92ee5a143b23112d7f055e4cb/sep_compliance_01.jpg)

## Additional Security Certifications That Are Worth Pursuing

A SOC 2 Report helps you demonstrate a baseline of security to your customers, and the more Trust Service Criteria you certify for, the more assurance you can provide (it’s why Auth0 meets all 5). 

But given[ the rate](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cloud-adoption-and-risk-report-work-from-home-edition.pdf) at which cloud-based cyberattacks are increasing in the wake of the pandemic (and[ the average cost of a data breach](https://auth0.com/blog/what-is-data-security/) across most industries), doing more than the minimum to secure your customers’ data is in your best interest.

Auth0 has earned certifications in several additional information security frameworks for this reason. We’ve created guides to earning certification with the ones we’re experienced with via the links below:

* **[ISO/IEC 27001](https://auth0.com/blog/auth0-achieves-iso-27001-certification/).** The International Organization for Standardization’s framework for building an information security management system (ISMS).
* **[ISO/IEC 27018](https://auth0.com/blog/what-is-iso-27018-2019-everything-executives-need-to-know/).** The International Organization for Standardization’s cloud-specific controls that cloud-based businesses should follow when certifying for ISO 27001.
* **[CSA STAR](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/).** The Cloud Security Alliance (CSA) offers some of the most relevant and cutting-edge controls for cloud security in the industry.

Learn more about how Auth0’s IDaaS platform can help you better secure and scale your authentication process[ here](https://info.auth0.com/video-platform-overview.html?_ga=2.10769394.753376883.1611345990-439625938.1611345989).

SOC 2 Compliance and Certification: What SaaS Businesses Need to Know

The HITECH Act changed who is required to comply with HIPAA and how they’re required to do so.

If your business processes protected health information (PHI) in the United States, you’ll need to familiarize yourself with both the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Both pieces of legislation provide legal guidelines for managing PHI in the United States and come with strict penalties for violations. For example, two health care networks were fined $5.5M each in two of the [worst violations in recent history](https://www.beckershospitalreview.com/cybersecurity/hipaa-through-the-years-5-biggest-fines-since-2008.html).

However, each law manages and protects health data in different ways (and for different reasons). Below is a summary of what each law could mean for your business if it processes PHI in any format.

![HIPAA vs. HITECH](https://images.ctfassets.net/23aumh6u8s0i/5LsphelbdnIZtLBd7NOrZQ/3e05f625deb2ff6588f9bffbf2dc3449/sep_compliance_02.jpg)

## HIPAA vs. HITECH: What Are the Differences?

HIPAA and HITECH are two separate laws with two different goals:

* **HIPAA** was passed in 1996 and was the first U.S. law to regulate how protected health information was managed. It introduced a set of security controls and privacy rights aimed at reducing fraud and waste in health care. HIPAA defined who was required to comply with its regulations (which HIPAA called “covered entities”) and how they were required to do so in order to protect health data.
* **The HITECH Act** was passed in 2009 as part of the American Recovery and Reinvestment Act (ARRA) to encourage HIPAA-covered entities to adopt electronic health records (EHRs) for managing PHI. It offered financial incentives from 2011 to 2015 to transition to EHRs and to improve the delivery of healthcare. The HITECH Act also introduced new technical security standards (in addition to a few other things below) that complement and enhance HIPAA as well.

![HITECH Changed HIPAA](https://images.ctfassets.net/23aumh6u8s0i/2gAtMudqliW2LiC3h7imD9/db7be0b8025f315b137a7744e7d5d469/sep_compliance_03.jpg)

## How HITECH Changed HIPAA Compliance for Businesses

The HITECH Act enhances HIPAA in several critical areas that affect compliance. In order to help you better understand how those enhancements may affect your business, we’ve summarized the most critical changes and enhancements below.

> For specific information on how both laws pertain to your business, always work with legal counsel skilled in navigating those laws.

### HITECH Upgraded HIPAA’s Security Standards For ePHI

HIPAA was passed when [most protected health information](https://www.healthaffairs.org/doi/full/10.1377/hlthaff.2015.0992) was still managed on paper, and it did not provide comprehensive standards for securing and managing it in electronic form. The HITECH Act introduced specific technical standards for implementing HIPAA’s Security Rule when processing protected health information electronically.

Some of the parts of HIPAA’s Security Rule that were enhanced include:

* **Access Control:** Access to electronic health data must be controlled with [authentication procedures](https://auth0.com/blog/username-password-authentication/).
* **Encryption:** The devices that store digital health information must be secured with [encryption](https://auth0.com/blog/how-secure-are-encryption-hashing-encoding-and-obfuscation/).
* **Access Log Usage:** There must be a way to see who has accessed and/or modified protected data.
* **Audit Monitoring:** Audit procedures must be in place to monitor compliance.
* **Risk Assessments:** Data loss risk assessments must be conducted to monitor vulnerabilities and threats.

### HITECH Extended HIPAA’s Privacy Rights To Electronic Health Records

The HITECH Act extended the privacy and access rights granted to individuals via HIPAA to electronic health records ([a loophole prior to 2009](https://www.cio.com/article/2444006/hipaa-may-have-a-privacy-loophole.html)). For businesses that process PHI electronically, this means:

* You must provide individuals with a copy of their health records in electronic form if they request it, and you have the means to share it with them electronically.
* The sale of electronic protected health information (ePHI) is now expressly prohibited.

Under the HITECH Act, PHI now includes any medical records, billing records, or conversations about personal health (emails, notes, recorded phone calls, etc.) stored physically or electronically.

### HITECH Expanded Which Businesses Must Comply With HIPAA

[HIPAA defines](https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards.) covered entities as health plans, healthcare providers, or healthcare clearinghouses (auxiliary healthcare services). These include organizations such as doctors, their offices, hospitals, insurance companies, medical researchers.

The HITECH Act expanded the definition of a covered entity to include all “business associates” (and their subcontractors) who process PHI on behalf of covered entities. For example, a SaaS business that provides cloud services to doctors or hospitals could be considered a business associate and would be responsible for complying with both HIPAA and HITECH just as any covered entity would, including:

* **Follow HIPAA/HITECH privacy provisions** and not sharing PHI unless permitted to do so under HIPAA’s Privacy Rule.
* **Adhere to HIPAA/HITECH security provisions**, including standards for data access control, auditing procedures, and more.
* **Pay HIPAA/HITECH fines and penalties** if they share PHI with unauthorized parties (a breach, for instance).

> To manage the relationship between covered entities and their business associates, the HITECH Act requires that all business associates and covered entities enter into a business associate agreement (BAA).

### HITECH Introduced A New Breach Notification Rule

Under the HITECH Act, any business that qualifies as a covered entity, business associate, or subcontractor of a business associate[ is now required](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) to notify affected individuals and the Secretary of the U.S. Department of Health and Human Services (HHS) within 60 days, in the event that a breach of _unsecured_ data occurs. For instances where the breach affects over 500 records, you’re also “required to provide notice to prominent media outlets serving the State or jurisdiction.”

[According to the HITECH Act](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/coveredentities/federalregisterbreachrfi.pdf) (and an [interim final rule](https://www.govinfo.gov/content/pkg/FR-2009-08-24/pdf/E9-20169.pdf) released after an initial request for public feedback), your data is considered “unsecured” if it’s unencrypted or improperly destroyed. For businesses, this means if an attacker (or any other unauthorized party) obtains access to your data and can use it, you’ll need to follow the breach notification procedures outlined in the HITECH Act (and summarized above).

The HITECH Act [also now requires](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) that covered entities and business associates, rather than the HHS (the required party under HIPAA), prove that their data is secured. This means in the event of a breach; you’ll be responsible for showing the HHS that your data is encrypted and unable to be used by the unauthorized party who accessed it.

### HITECH Increased The Severity of Penalties for NonCompliance

Many of the penalties under HIPAA were often borderline inconsequential for covered entities. So the HITECH Act introduced [a new four-tiered penalty system](https://www.natlawreview.com/article/hipaa-penalties-change-under-hhs-notice-enforcement-discretion) based on the level of fault for a breach and upped the penalties and annual limits for violation.

However, in response to public criticism that the initial annual limits were an inaccurate interpretation of HITECH’s tiered system, the annual limits for penalties [were reduced in 2019](https://www.federalregister.gov/documents/2019/04/30/2019-08530/notification-of-enforcement-discretion-regarding-hipaa-civil-money-penalties).

The current penalty tiers and structure are as follows:

<table style="width:100%">
  <tr style="background-color:#26BADB">
   <td><b><span style="color:white"> Culpability </span></b></td>
   <td><b><span style="color:white"> Minimum penalty/violation</span></b></td>
   <td><b><span style="color:white"> Maximum penalty/violation</span></b></td>
   <td><b><span style="color:white"> Annual limit</span></b></td>
  </tr>
  <tr>
   <td>No Knowledge</td>
   <td>$100</td>
   <td>$50,000</td>
   <td>$25,000</td>
  </tr>
  <tr>
   <td>Reasonable Cause</td>
   <td>$1,000</td>
   <td>$50,000</td>
   <td>$100,000</td>
  </tr>
  <tr>
   <td>Willful Neglect—Corrected</td>
   <td>$10,000</td>
   <td>$50,000</td>
   <td>$250,000</td>
  </tr>
  <tr>
   <td>Willful Neglect—Not Corrected</td>
   <td>$50,000</td>
   <td>$50,000</td>
   <td>$1,500,000</td>
  </tr>
</table>
<br>

### HITECH Introduced New Information For Training Compliance

Training is a requirement of both the HIPAA [Security Rule](https://www.law.cornell.edu/cfr/text/45/164.308) and the HIPAA [Privacy Rule](https://www.law.cornell.edu/cfr/text/45/164.530) and is loosely defined as whatever is “necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.”

The HITECH Act did not change the requirement for training or the specificity of the language used to explain what it should contain. But because it enhances HIPAA, it does mean that any additional information introduced under HITECH should be included in your employees’ training program(s) in order to ensure compliance.

For example, because the HITECH Act introduced new technical standards, you will need to make sure your cybersecurity and development teams’ HIPAA training (and the training for anyone else who is responsible for ensuring the technical security of PHI within your business) includes these new standards.

Each business is different. Consider the roles and responsibilities of your employees, and make sure they have the training needed to ensure that your business complies with both laws.

![Two Critical Ways to Better Secure ePHI](https://images.ctfassets.net/23aumh6u8s0i/3lefYYa9FsqqIVecGGpIlV/88a934fa5d9dbb876787096be7536747/sep_compliance_04.jpg)

## Two Critical Ways to Better Secure ePHI

According to the [HHS’s “wall of shame”](https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf), most HIPAA violations occur as a result of an [external attack](https://auth0.com/blog/developers-guide-to-common-vulnerabilities-and-how-to-prevent-them/) or unauthorized access/disclosure. This indicates that two types of data security technologies will have a big impact on ensuring any ePHI you process is secure:

1. **Data encryption:** Encrypting ePHI renders it useless if a hacker obtains it, protecting individuals from public exposure even in the event of a breach.
2. **Access control:** The better you’re able to control who has access to sensitive health data, the more you reduce the chances of unauthorized access in the first place (including a hack).

Auth0’s [Identity as a service (IDaaS)](https://auth0.com/blog/what-is-idaas/) platform offers features to easily control who has access to sensitive health data within your organization, thereby allowing you to configure Auth0 to meet your HIPAA/HITECH needs.

![Conclusion](https://images.ctfassets.net/23aumh6u8s0i/Xb8Z3o1JWLQE9ZlM2vcQw/303397e92ee5a143b23112d7f055e4cb/sep_compliance_01.jpg)

<include src="asides/AboutAuth0" /> <p> <br>


<div class="alert alert-info alert-icon">
These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at <a href="https://www.okta.com/agreements/">okta.com/agreements</a>.<br> 
</div>


HIPAA/HITECH: A Compliance Guide For Businesses

Hear from Auth0 customers how CIAM supports scalability and drives transformation

With people not only working but also shopping, banking, socializing, and receiving healthcare via digital platforms, identity management has become not just [a competitive advantage](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/) but a requirement. Organizations across industries need to manage identity in a secure, scalable, and seamless way. Part of the challenge is that identity is disseminated across multiple applications and devices, effectively making [identity itself the perimeter](https://auth0.com/resources/whitepapers/identity-perimeter). To satisfy user expectations and meet business needs in this new ecosystem, organizations are embracing third-party [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) solutions like Auth0.

At the core of the IDaaS space is [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/), which involves authenticating users’ identities and controlling their access to online resources. A key enabler for organizations undergoing digital transformation, IAM encompasses:

* **Authentication**, or how you determine whether someone’s claimed identity matches their actual identity. [Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is increasingly recognized as the standard method of authenticating identity.
* **Authorization**, or the allocation of permissions to individual users or types of users. For instance, if an administrator leaves your organization, you can revoke their permissions; you can also add users or expand permissions according to your needs.

Typically, organizations have to manage identity for different types of users: customers, employees, and enterprise partners. Because each type of user has different priorities and expectations of your platform, each type demands its own carefully calibrated balance of convenience, privacy, and security. For example, your employees and contractors will probably put up with time-consuming, headache-inducing processes to get paid and access other benefits because they have few alternatives. Customers, on the other hand, have lots of choices, and if you can’t deliver a swift, effortless login experience, they’ll find one of your competitors who can.

[Customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) platforms are built to optimize the balance between convenience, privacy, and security for each type of user. With the right CIAM platform, you can:

* Deliver a secure and frictionless login experience
* Guide compliance with data privacy laws
* Protect data assets against malicious intrusion
* Derive more specific, meaningful insights from customer data

Using four Auth0 customers as examples, let’s explore how CIAM can help you allocate resources more effectively, secure identity across your entire infrastructure, and deliver more value to your users. 

In [our new whitepaper](https://auth0.com/resources/whitepapers/ciam-transformation), we delve more deeply into each of these customer stories and suggest strategies for choosing and implementing the right CIAM platform. If you find this content useful, be sure to [download the full whitepaper](https://auth0.com/resources/) or check out some of our other [identity resources](https://auth0.com/resources/).

## Enable Expanding Use Cases

With 170 superstores across the UK, furniture retailer [Dunelm](https://auth0.com/case-studies/dunelm/) describes themselves as “product-obsessed.” In 2018, they began a massive digital overhaul of their existing internal infrastructure in favor of a modern, flexible cloud data platform that would transform the digital experience for their customers, employees, and external vendors.

> A key aspect of Dunelm’s [buy-rather-than-build](https://auth0.com/resources/whitepapers/build-vs-buy-for-b2b-evaluating-identity-management) approach to their digital infrastructure was replacing their in-house identity system with Auth0. This move has saved them significant time, effort, and staffing costs.

Initially, Dunelm planned to use Auth0 for straightforward customer authentication, but they soon incorporated the service into multiple business operations serving customers, employees, and partners.

From here, Dunelm plans to further expand its Auth0 use case and add more customer value through personalized, frictionless shopping experiences.

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/5rQhP0U1KzmX0aJfsAuZh3/dbc28afb39fa3f557119114372a086bc/CIAM_ecommer_e_recorte1.png)

## Centralize Identity across Platforms

UK-based conditioning brand [Gymshark](https://auth0.com/case-studies/gymshark/) is one of the most recognizable functional training apparel brands in the world, with a social media following of 10+ million and customers in over 170 countries. During the development process for their conditioning app, Gymshark realized they needed a centralized authentication solution that worked across both their online and mobile applications. They had one major priority: a seamless customer experience.

While they briefly considered building their own solution, Gymshark ultimately decided to entrust Auth0 with their CIAM needs. With Auth0 handing IAM for customers and employees, Gymshark can focus on creating apps and other technology that advances their core mission. Auth0 is a critical enabler for Gymshark’s tech-powered, user-centric future. 

## Replatform and Eliminate Legacy Code

[Kiva](https://auth0.com/case-studies/kiva-implements-auth0-rules-mfa/) is an international crowdfunding nonprofit focused on expanding financial access to help underserved communities around the world thrive. Kiva had built their own authentication solution in-house over time, adding functionality when they needed it to meet business requirements, but they knew they needed to replatform to a microservice architecture with a dedicated identity service to support future growth.

With Auth0, Kiva was able to eliminate more than 22,000 lines of legacy code, freeing up engineering resources considerably and allowing the company to focus its efforts on core business functions rather than on managing identity. Investing in CIAM now also prepares Kiva for successful mobile implementation, which is key to their growth strategy. The bottom line: CIAM enables Kiva to shift and scale securely and with minimal friction. 

## Achieve Smooth Scalability

[TVNZ](https://auth0.com/case-studies/tvnz-cs/), New Zealand’s state-owned, commercially funded broadcaster, reaches more than two million New Zealanders every day. TVNZ also offers OnDemand streaming services that reach up to half of the country’s five million citizens with 2.5 million registered accounts. At a moment in history when a trustworthy news source is more important than ever, the broadcaster needed a CIAM partner who could help them rapidly scale, migrate users, and maintain their reputation.

When they signed on with Auth0 to handle authentication for their OnDemand streaming web and mobile platforms, TVNZ was faced with the task of migrating data for 2.5 million accounts. To avoid forcing all of their customers into a password reset, TVNZ opted for an automatic migration in which customer data was migrated only when a person logged in.

But another challenge lay ahead. TVNZ’s digital platforms faced unprecedented demand during the pandemic lockdown, with weekly streaming rates jumped by 50% and tens of thousands of users logging in more or less simultaneously to watch Prime Minister Jacinda Ardern’s daily addresses. With Auth0 handling their identity needs, TVNZ experienced “no real issues,” reported [Michael Robinson](https://www.linkedin.com/in/faceleg/?originalSubdomain=nz), Head of Digital Capability at TVNZ. Entrusting CIAM to Auth0 allows TVNZ to stay on mission and maximize the value of their development resources.

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/1fjzGfRtdlHhMCsxgeDZdp/86223bf45b185cfa9ddee428eefa28b6/CIAM_ecommerce_recorte2.png)

## What Challenges Could CIAM Solve for You?

Is your login process so painless that customers barely register it? Do your customers trust you to handle their personal information? Do you have all the insights into customer behavior you need? Are you confident that your customer identity solution can scale in response to escalating demand without lags or outages? Unless the answer to all of these questions is an unambiguous “Yes!” (in which case, nice work!), investing in CIAM is a sound decision.

Ask yourself what your team could accomplish if they didn’t have to worry about managing customer identity and access. For a closer look at the customer stories we’ve summarized here, and to learn more about how CIAM can enable digital transformation at your organization, [download the whitepaper](https://auth0.com/resources/whitepapers/ciam-transformation).

<include src="asides/AboutAuth0" />

Four Ways CIAM Empowers Your Business

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

From scalability to CX, CIAM unlocks business-wide benefits

Customer experiences happen primarily online. If this wasn’t completely true for your business before 2020, it’s probably true now. Companies have come to understand that a seamless digital experience is no longer a competitive differentiator; it’s a baseline requirement.

Moreover, pressure-cooker economic conditions during the pandemic have shown that [companies that understand their customers’ needs on a deep level](https://digitally.cognizant.com/customer-identity-and-access-management-in-the-age-of-covid-19-codex5721/) are better-positioned to succeed. One way organizations are trying to do this is [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/).

CIAM refers to a set of solutions intended to create the optimal balance between convenience, privacy, and security for each type of user. While [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/) is focused on managing identity and access for employees and partners, CIAM centers on customers.

CIAM exists at the intersection of customer experience, security, and analytics. It enables a smooth onboarding/login experience to build customer loyalty and increase conversion rates, guides compliance with data privacy laws and empowers companies to prevent data breaches. Crucially, CIAM encompasses not only how companies control end-users’ access to digital assets but also how they collect, analyze, and store data related to those users.

## A Centralized Source of Truth

CIAM enables companies to compile siloed user data into a single source of truth that helps you make better strategic decisions. If your user data is disorganized, siloed, and inaccurate, you can’t generate a clear picture of your customers. Without clear insight into your users, you can’t offer highly personalized offers and product recommendations that drive additional revenue and create more value for your customers.

> Duplicate and siloed data also create barriers to compliance with data privacy laws. A centralized view of your customers gives you the tools you need to meet the requirements of laws like [GDPR](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) and [CPRA](https://auth0.com/blog/cpra-passed-what-s-changing-in-ccpa-2-0/).

### Can’t we build it ourselves?

Some organizations manage part or all of CIAM themselves, but that’s a big challenge, and it gets bigger as you scale. Given the complexity and dynamism of CIAM, forward-thinking companies are entrusting CIAM to one or more third-party [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) experts. Outsourcing CIAM to a third party is a wiser use of your resources than asking your developers to manage customer identity in-house. [Buying rather than building your CIAM solution](https://auth0.com/resources/whitepapers/ciam-buyers-guide) saves time and money, and it gives you the agility and expertise you need to respond to evolving use cases, new or updated privacy laws, and other variables that can make identity management more complicated.

## Business Benefits of CIAM

Centralizing user data on one platform unlocks company-wide benefits even beyond creating a single source of truth. Here’s an overview of the organizational rewards you can realize with CIAM.

### Scalability

On the list of advantages of CIAM, scalability is near the top. Unlike B2B and workforce identity solutions that support users with static access to preassigned applications, CIAM platforms must be able to support millions, even billions, of users. In addition, CIAM solutions must be able to scale in response to not only anticipated events (like the holiday shopping season or the World Cup) but also to unanticipated events that can dramatically increase demand (like [viewers eager for official updates during the pandemic](https://auth0.com/case-studies/tvnz-cs/)).

### Customer experience

When customer experience is a priority, features like [single sign-on (SSO)](https://auth0.com/docs/sso) and adaptive [multi-factor authentication (MFA)](https://auth0.com/learn/social-login/) help you deliver the frictionless CIAM experience your customers expect.

CIAM platforms also enable event-driven personalization tactics, such as progressive profiling, in which user data is collected incrementally in a series of interactions over time. The goal is to build a trusting, mutually beneficial relationship between the company and customers. Users recognize that by providing more information (such as rating a purchase or filling out demographic information), they can get more value in the form of personalized offers and relevant recommendations. And by cultivating the trust of their customers, companies ultimately realize more value in terms of both reputation and revenue.

### Security

Customer data is among your organization’s most prized assets. In the wrong hands, however, data becomes a liability. That’s why the best CIAM solutions have robust security features built to defend against malicious attacks on any front.

For many organizations, the login box is the front line of defense against [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) like [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). A CIAM solution with MFA and brute force protection is an important part of your defense strategy. MFA ensures that one stolen credential won’t allow automatic access to your users’ other accounts, while brute force protection keeps attackers from barraging your application with fraudulent login attempts that can crash your site.

### Privacy and compliance

Centralized user management is necessary to meet the reporting and erasure requirements of data privacy laws like [GDPR](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), [CPRA](https://auth0.com/blog/cpra-passed-what-s-changing-in-ccpa-2-0/), APPI, and LGPD. These laws are literally rewriting the rules for how organizations are permitted to collect, store, and leverage user data. CIAM helps you meet these legal requirements by enabling the encryption of sensitive data, controlling access to digital resources, and collecting data, and [managing consent](https://auth0.com/blog/what-you-need-to-understand-about-consent-management/) in compliance with applicable laws.

## Create More Value with CIAM

As organizations initiate and accelerate digital transformation projects to meet sky-high demand for digital services, CIAM is becoming indispensable across industries, from [retail](https://auth0.com/case-studies/dunelm/) to [tech-powered fitness](https://auth0.com/case-studies/gymshark/). 

In our whitepaper, we explore in depth the capabilities you should look for in a CIAM platform, from scalability and agility to personalization and compliance. You can also [reach out to the Auth0 team](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us) to learn more about how CIAM could benefit your organization.

<include src="asides/AboutAuth0" />

Why do you need CIAM?

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Enhanced identity management for builders and providers of B2B SaaS applications enables faster implementation and best-in-class security, branding, and administration

**BELLEVUE, Wash. – April 26, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Organizations](https://auth0.com/organizations), a purpose-built feature enabling providers of B2B SaaS applications to seamlessly manage their business customers—a use case Auth0 defines as Business Customer Identity. Organizations is Auth0’s enhanced way for enterprise app teams to manage customers and partners in any multi-tenant, B2B, or SaaS application. With Organizations, B2B implementations are less complex, enabling faster speed-to-market and a better overall experience for business customers and partners. 

Business Customer Identity remains largely unaddressed by today’s Workforce Identity and Customer Identity Access Management (CIAM) solutions, forcing those who build and deliver B2B SaaS applications to cobble together features to address their unique use case. This requires significant customized configuration leading to high ongoing maintenance and configuration costs, slower time to market, and more difficult use case expansion and new app development.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5AGLt3QorElIYSuC43J2TE/c3db1cfffa3649353fab74e01dcdd511/approved-asset-three.jpg)

Business apps are not just used by individuals but by teams and entire companies, all of which need easy and secure onboarding, flexible membership provisioning, access control, and SSO setup. Convenience for B2B users is also increasingly in demand, prompting enterprises to provide similar seamless experiences to business partners as they do for consumers. Auth0 Organizations solves all of these issues and more, offering customizable identity management of any business customer or partner.   

Key benefits of Auth0 Organizations include: 

* **Simple Business Customer Onboarding:** Auth0’s APIs and SDKs can easily model entire business organizations, and rapidly-implemented admin dashboards manage SSO, Role-Based Access Control, and flexible user management workflows.
* **Custom-Branded Federations:** The ability to customize the login experience with branded login and registration flows ensures that business customers feel at home. 
* **Faster, Easier Deployment:** Less complex implementations shorten time to market, and integrations are accelerated as new products are built or acquired. 
* **Identity Engineering & Maintenance Costs Reduction:** Engineering resources can shift to work on core product innovation instead of focusing on complex identity issues.

“We were initially looking for a platform solely to handle SSO for our enterprise customers. Organizations is a great fit and offers enough flexibility to replace authentication for our 300+ non-enterprise customers, too,” said Steven Easton, Lead Engineer at Amiqus. “We’ve been really impressed with how powerful Auth0 is and yet have barely scratched the surface. We are excited to roll out Organizations as an improvement to our business customers’ experience and value how easy Auth0 makes it to do so.”

“We see Business Customer Identity as a standalone use case, one that our customers have increasingly been confronted with and had trouble fully addressing—until now,” said Shiv Ramji, Chief Product Officer at Auth0. “B2B identity management represents a sizable portion of our business and is consistently growing, demonstrating the need that Business Customer Identity addresses. We are thrilled to launch Auth0 Organizations as our next-generation offering for easy onboarding, authentication, and administration of business customers.”

More information can be found at [Auth0 Organizations](https://auth0.com/organizations).

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Launches Organizations, Transforming the Way Enterprises Manage Business Customer Identity

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Find out how business leaders are using identity to accelerate their business strategy



In response to COVID-19, 75% of CEOs have accelerated digital transformation, a recent [Zscaler study](https://www.zscaler.com/resources/white-papers/securing-remote-work.pdf) found. 

While the study specifically focused on work from anywhere (WFA) solutions, the need for digital change isn't critical just for employee access. As nearly every customer experience is driven online, your customers' digital experience is the major way they experience your brand.

[Fortune](https://fortune.com/2020/06/26/coronavirus-accenture-ceo-digital-transformation/) noted that the crisis has quickly widened the performance gap between companies investing in digital innovations and those who weren't into a "chasm," saying "digital leaders were performing better through crisis." Companies need new technologies that allow them to activate new business models fully. In this environment, digital transformation initiatives may still be scoped over multiple years, but CIOs need to demonstrate value on a much faster timeframe. 

And the need for rapid digital adaptability is surfacing as an even stronger driver amongst Auth0 customers, especially for those seeking [B2B](https://auth0.com/b2b-enterprise-identity-management) and [Customer and Identity Access Management (CIAM)](https://auth0.com/b2c-customer-identity-management) solutions.

<include src="ebook-ads/DigitalTransformationBook" />

For many business leaders, the question is not just about how to add artificial intelligence and machine learning to new products, but how to keep their companies moving forward, given unpredictable global conditions. Others are wondering if it's too late to catch up &mdash; or even run ahead.

If you're willing to treat Identity Access Management (IAM) as a reusable service as part of your digital transformation strategy, it's not.

## Reusable Services Speed Digital Transformation Success

Many digital transformation projects are executed over the course of several years, while everyone works through "rigid" monolithic I.T. infrastructures and apps created for specific moments in time. Replacing legacy technology with "[componentized](https://auth0.com/resources/whitepapers/state-app-assembly-2020)" digital technologies (think building blocks) that can be more easily reassembled and re-architected allows companies to adapt more rapidly to changing business needs.
 
Reusable services like online payments, communications capabilities, and identity management allow companies to speed their digital transformations and deliver scalable value to customers. Basically, these services give you the power to do what you need to do, when and how you need to do it.

As Pierre Alvear Foxler, Service Manager, IAM, for Northern Europe's leading farming cooperative, [Lantmännen](https://auth0.com/case-studies/lantmannen/), points out, shifting from on-premises to services-based solutions like Auth0 have financial benefits as well as usability benefits. "We went from an on-premise solution that was capable, but complex and costly, to one that saves us money on infrastructure, IAM delivery, and application management," he says.

Strongly designed services can also make it easier to manage the complexity of the fragmented healthcare system, says Chris Carruthers, Principal Technical Program Manager, [Providence](https://auth0.com/case-studies/providence/), a nonprofit healthcare organization based in the U.S. "The healthcare industry is a complex landscape. Many customers have legacy applications and require highly secure vendor systems that meet patient data privacy requirements. Auth0's adherence to top compliance frameworks makes them a valuable identity partner for us."

## Reduce Time to Implementation

The most effective business strategy in the world, expressed through well-planned business models, can easily stall (or die) due during change management. IAM can be a powerful tool for business leaders to speed implementation. Resolving IAM challenges with the help of a vendor focused on not only current, but potential business possibilities means that you can use the IAM discussion as a framework to drive consensus and momentum for their evolving digital transformation strategy.

### Lifen: Contact Tracing in 5 Days

AI-powered [Lifen](https://auth0.com/case-studies/lifen-cs/), a solution that facilitates the secure transfer of medical documents between patients, private practitioners, and hospitals, came to Auth0 early in the pandemic with the goal of replacing their existing identity infrastructure &mdash; and rapidly spinning up a contact tracing solution. We delivered in five days.

You read that right &mdash; five days.

"It was in record time," says Lifen CTO Dali Kilani. "We've put it in the hands of multiple healthcare institutions."

But speed wasn't Lifen's only goal. 

Especially in a global environment with an increasing number of [data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/), fast means nothing if your new solution isn't also more secure. Despite the rapid turnaround, Kilani is more than comfortable. "Auth0 maintains the highest level of security that is possible at this point. Every single doctor and patient that accesses our solution performs their authentication through Auth0. We've put Auth0 at the heart of our service."

### Gymshark: Headless Commerce + Credential Stuffing Protection

For Auth0 customer [Gymshark](https://auth0.com/case-studies/gymshark/), a conditioning brand dedicated to fitness apparel, digital adaptability means making major shifts away from siloed logins that were spoiling their user experience. "We're going down a headless commerce route, doing much of our ops and infrastructure through serverless technologies with cloud partners such as AWS. We're kind of rebuilding the whole back office of the company from the ground up," says Dan Lake, Gymshark Engineering Director.

The complexity of managing a digital transformation alongside a social media following of 10+ million and customers in over 170 countries could have made customer identity and access management (CIAM) changes extremely challenging. 

Instead, Auth0 saved time and effort.

"The ease of implementing Auth0 was brilliant. It saved us months of time, salaries, effort in finding the right engineers, obviously ongoing support, and also probably given us back a few years in our lives as well through stress," says Lake.

Lake also points out that Auth0 has added benefits. "Auth0 protects us against credential stuffing. You don't realize how valuable [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) features are until it happens. Those are the kind of features that we relish at the moment, things we see that our customers don't."

### Scale Quickly Across Multiple Applications 

Global technology powerhouse [Siemens AG](https://auth0.com/case-studies/siemens/) plays a pivotal role in everything from digital enterprise to energy to financial services and operates in nearly every country in the world. Performing on a global scale can get extremely expensive when apps are measured across multiple divisions. Creating a uniform login experience for customers and partners allows Siemens to sustain a focus that benefits their business. 

"It was of the utmost importance to have a secured, stable and reliable authentication platform, [so that] our clients and partners can focus on their business instead of focusing on how to log into hundreds of Siemens' applications available in the market," says Hugo Francisco, Service Owner of Siemens ID, Siemens.

## Make Sure Your UX Keeps Pace With Your Business Innovation

With 170 superstores across the U.K., Dunelm prides itself on style and affordability &mdash; and is transforming their digital experience to keep pace with their tangible one.

Moving to a modern, flexible cloud platform is a critical part of that business strategy.

"One of the key things we wanted to do was move over to a cloud platform, AWS, where we could scale up and down and build the best in class for our online customers," says Antony Sohal, Head of Data Platforms for Dunelm.

But instead of building that digital experience in-house, Dunelm created the customer experience using a componentized approach. "One of the key decisions was to focus on what we're good at and single out what we're not good at. We built a product service, a pricing service, we bought authentication, we even bought search as a service. We bought the infrastructure we needed," explains Sohal.

Buying identity-as-a-service means that the effort that would be spent on authentication can instead be spent on core functions and, with the right identity partner, used to customize the user experience. This means there's no need to sacrifice digital innovation for time-to-market. A flexible, extensible identity platform means you can get to market faster and ensure future adaptability.

Treating identity as a reusable service can help your new products get to market faster — and strengthen your ability to adapt once you're there. As Lake explains, "The largest shift and growth at Gymshark is we've become a tech company through our aim to unite the conditioning community. We're building the foundation for where we're headed, and it's just going to get bigger and bigger."

Carruthers says [Providence](https://www.providence.org/en) turned to Auth0 for help creating a seamless, consumer-facing digital experience for patients. "We're years ahead of where we would be if we were to build identity ourselves," says Carruthers.

If you'd like to learn more about how Auth0 could help your company continue to adapt and grow, please reach out to an [Auth0 resource](https://auth0.com/contact-us).

<include src="asides/AboutAuth0" />

How Digital Transformation Enables Business Adaptability

Learn how to accelerate your sales cycle through the CSA STAR Program.



The pandemic [accelerated the adoption of cloud-based technology](https://www.pwc.com/us/en/industries/tmt/library/covid19-cloud-infrastructure.html) and brought a sharp increase in cloud-based cyberattacks with it &mdash; 630% between January and April of 2020 alone, according to [a report by McAfee](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cloud-adoption-and-risk-report-work-from-home-edition.pdf). And since cloud usage is expected [to continue to increase](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/) well beyond the pandemic, taking additional steps to reduce security risks will be essential to protect the data you process in the future.

Earning a certification from the Cloud Security Alliance (CSA) STAR Program is an effective way for cloud service providers to reduce the [security risks](https://www.mcafee.com/blogs/enterprise/cloud-security/9-cloud-computing-security-risks-every-company-faces/) that cloud computing often introduces because few organizations offer more relevant or powerful controls than the CSA.

As a cloud service provider, Auth0 has been through the STAR certification process and [earned a certification](https://auth0.com/blog/auth0-achieves-gold-csa-star-certification/). Below is what you need to know about the STAR Program and how to earn a certification.

## What Is a CSA STAR Certification?

A CSA Security, Trust, Assurance, and Risk (STAR) certification is a powerful third-party attestation of a cloud service provider’s security practices. A cloud service provider that earns a STAR certification can assure their customers that they’re using industry-leading best practices to secure data in cloud applications.

The CSA’s STAR Program combines the controls and best practices laid out in other information security standards (ISO/IEC 27001:2013, for example) with the CSA’s own [Cloud Controls Matrix](https://cloudsecurityalliance.org/research/cloud-controls-matrix/) (or CCM, their proprietary cybersecurity control framework that covers all aspects of cloud technology) to create one of the most comprehensive cloud security control sets in the industry.

Being STAR-certified is not as important as being [GDPR-compliant](https://auth0.com/docs/compliance/gdpr), for instance (or being compliant with other data privacy regulations like GDPR). However, since its controls map back to global information security standards and regulations, being STAR-certified does help reduce audit complexity for many organizations, in addition to helping them better secure their data.

## The Benefits of a CSA STAR Certification

A CSA STAR Certification means the data you process is protected using a security framework designed specifically for cloud computing. Simply put, this reduces security risks for everyone involved &mdash; cloud service providers (CSPs), their customers, and the owners of the data.

Below are specific benefits that both CSPs and their customers will also gain through certification (or working with a STAR-certified provider).

### Benefits For Cloud Service Providers

For cloud service providers, earning a STAR certification demonstrates to your customers that your business is a mature security organization. [This is a competitive advantage](https://home.kpmg/xx/en/blogs/home/posts/2019/09/cyber-as-a-competitive-advantage.html) for you within your market and helps you grow your business in two main ways:

1. **It helps accelerate your sales cycle**. A rigorous third-party assessment of your security practices by the CSA or certified third-party auditors helps reduce the work corporate security teams need to do in order to sign off on a new partnership.
2. **It helps you find new business faster**. Once your business is certified, it is included in the [STAR Registry](https://cloudsecurityalliance.org/star/registry/), where potential customers can quickly find cloud service providers that adhere to the STAR Program’s controls (more on the registry here).

### Benefits For Cloud Service Customers

Since the STAR Program increases transparency into the security practices of any business that has earned certification, it helps would-be CSP customers quickly find a provider that offers the level of security assurance their business needs.

It also helps existing CSP customers ensure better alignment on security practices between them and their CSPs, simplifying the process of building an effective Governance, Risk, and Compliance ([GRC](https://www.cio.com/article/3206607/what-is-grc-and-why-do-you-need-it.html)) program.

## CSA STAR Certification Levels

The CSA STAR certification is [divided into three levels](https://cloudsecurityalliance.org/star/levels/), each providing CSPs with the ability to offer a greater degree of transparency and assurance than the level before it.

Levels 1 and 2 also offer a continuous certification that organizations can obtain, as well (Level 3 is a continuous certification), in order to provide additional transparency to their customers through periodic self-assessment.

### CSA STAR Level 1

A Level 1 certification is a freeway for any CSP to provide their customers with the security assurances that a STAR certification offers. To earn a Level 1 certification, cloud service providers must self-assess their security practices and controls against the CSA’s best practices (using either the Consensus Assessments Initiative Questionnaire [[CAIQ](https://cloudsecurityalliance.org/artifacts/consensus-assessments-initiative-questionnaire-v3-1/)] or the Cloud Controls Matrix) and send their assessment to the CSA for verification.

According to the CSA, a Level 1 STAR certification is best for CSPs that are “operating in a low-risk environment” and need a cost-effective way to document their security controls for their customers.

Certification is an annual process. However, businesses that update their self-assessment every 30 days are eligible for a STAR Continuous Level 1 Certification, which helps them assure their customers that CSA controls are always being followed (not just when it’s time for certification).

### CSA STAR Level 2

CSA STAR Level 2 helps cloud service providers offer more transparency and assurance than Level 1 in two ways. First, it requires an assessment of a CSP’s security controls to be completed by a CSA-certified third party ([a list of which they maintain on their website](https://cloudsecurityalliance.org/star/certified-star-auditors/)).

Second, it’s designed to enhance the security controls of other standards and certifications that a CSP might follow (ones that are industry or geographically specific to their business) for the cloud. This means there are a number of ways a cloud service provider could earn a “certification” for Level 2, depending on the other standards they already follow:

1. **AICPA SOC 2 → CSA STAR Attestation**. Adding the CSA’s Cloud Controls Matrix to those you’ve implemented for the American Institute of Certified Public Accountants’ (AICPA) SOC 2 Report helps you make SOC 2 controls more robust and earns your business a CSA STAR Attestation.
2. **ISO/IEC 27001 → CSA STAR Certification**. If you follow the controls laid out in ISO 27001, adding the controls from the CSA’s Cloud Controls Matrix helps you make your information security management system cloud-specific and earns your business a CSA STAR Certification.
3. **GB/T 22080-2008 → CSA C-STAR Assessment**. For businesses that operate in China, adding the controls from the CSA’s Cloud Controls Matrix to the controls laid out in the GB/T 22080-2008 management system, as well as 29 additional controls from both GB/T 22239-2008 and GB/Z 28828-2012 standards earn your business a CSA C-STAR Certification.
4. **GDPR → GDPR Code of Conduct Certification**. If you’re complying with GDPR, adding the controls from the CSA’s Cloud Controls Matrix helps you offer cloud-specific security assurance in addition to those required by the GDPR and earns your business the GDPR Code of Conduct Certification.

A **CSA Level 2 Continuous Certification** is also available for businesses that have earned either an Attestation or Certification and complete a self-assessment every 30 days in the same way that is required for a Level 1 Certification.

CSA Level 2 is best for organizations that are already following one of the standards or regulations listed above or operate in a risk environment where the independent assurance that a third-party assessment offers would be beneficial.

### CSA STAR Level 3

Where STAR Levels 1 and 2 offer a continuous option to increase transparency and assurance through periodic self-assessment, CSA STAR Level 3 takes “continuous” one step further by automating the process of validating security control effectiveness in real-time.

According to the CSA’s website, STAR Level 3 is listed as “Coming Soon,” which indicates that it’s not officially available for certification at the moment. However, the CSA explains that continuous assessment will be achieved through real-time data collection from “monitoring tools like log analytics, network statistics, and monitoring, process statistics or resource utilization.”

Given the complexity of continuous monitoring, STAR Level 3 certification will be best for businesses that operate in high-risk environments.

## The CSA STAR Registry

The STAR Registry is a public record of cloud service providers that use the STAR Program’s controls and have earned certification. The registry [is located on the CSA’s website](https://cloudsecurityalliance.org/star/registry/) and allows anyone to download a copy of a certification that a cloud service provider has achieved:
 
![Cloud Services by Auth0](https://images.ctfassets.net/23aumh6u8s0i/6kS2dCnNm1lGATz3WDCDZQ/932b562fd88832b074048c21ff5c978a/cloud-services-by-auth0)

From a business perspective, the STAR Registry helps cloud service providers market themselves directly to customers that need the type of assurance and transparency that the STAR Program offers. The registry also provides CSP customers with the ability to submit a request for the CSA to [verify a specific provider’s certification](https://cloudsecurityalliance.org/artifacts/star-provider-verification-template/) if they do not see them on the registry.

## How Much Is Data Security Worth to Your Business?

The average [data breach costs $3.86M](https://www.ibm.com/security/data-breach), and the damage to your brand often lasts [for years to come](https://auth0.com/blog/what-is-data-security/). So the more you can do to reduce the security risks associated with cloud computing, the better off your business will be.

Following the CSA’s STAR Program (or working with a STAR-certified service provider) is [an effective way](https://www.bsigroup.com/en-IN/CSA-STAR-Certification/CSA-STAR-Certification-Case-Studies/) to reduce the risk of a data breach for both cloud service providers and their customers. And the transparency a STAR certification offers makes it easier for CSPs and their customers to keep data safe together.

Auth0’s [IDaaS](https://auth0.com/blog/what-is-idaas/) platform is [STAR Level 2 certified](https://cloudsecurityalliance.org/star/registry/auth0/) and can help you simplify the controls you need to implement to improve both the security and user experience of the authentication process. [Learn more about Auth0 here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />


The CSA STAR Program: A Business Guide to Certification

dave-wilner

Dave Wilner is the Chief Revenue Officer for Auth0, responsible for all field teams including Sales, Marketing, Professional Services, Support and Customer Success.<br /> Dave has spent the last two+ decades in executive roles at high growth, highly successful software companies.<br /> In another life, Dave was also a litigation partner at AmLaw 100 international firm Cozen O’Connor. In this life, Dave lives in Issaquah, WA with his wife Brenda and their two sons, and their adopted pit bulls Bo and Mona.

Chief Revenue Officer

Dave Wilner

Turning away business that conflicts with company values



I’ve worn my politics on my sleeve at work for the last few years. I’ve made countless snide comments about the Trump administration around the water cooler, sent hysterical (to me) Mitch McConnell memes to team members, and proudly worn my _Fuck the NRA_ t-shirt to work at least a half dozen times. But as our little-engine-that-could company grew to nine-figure revenue, and my own team grew to 400+ folks, I made a conscious effort to dial it back. One recent area where I needed to speak with a more neutral, empathetic voice was around deciding with whom the company chooses to do business. 

We live in a world where consumers increasingly make their voices heard and spend their money with brands that share their values. Over the last few years, we’ve also seen corporations &mdash; particularly in tech &mdash; begin taking stands on social issues. One early example was Marc Benioff of Salesforce speaking out strongly against the state of Indiana after it passed its so-called “religious freedom” law and North Carolina following the passage of its “bathroom law.” Since that time, we’ve seen stands taken by tech companies against the likes of ICE, the NRA, far-right “news” outlets, and others.

Most recently, this issue was thrown back into the global spotlight following the decision of Amazon and other tech companies to deny Parler’s use of their platforms. 

The brands that their companies affiliate with and serve has also increased in importance to employees. A rash of studies over the past few years have illustrated that pride in the work done by their company is a critical macro factor in employee satisfaction and attrition. Put simply: an increasing percentage of employees will quit if they have values-based objections to who consumes their companies’ IP. Those values and beliefs, however, are seldom homogenous across an employee base.

## So Who Decides? 

How does a company walk the line between running a for-profit endeavor and turning away business that some portion of its employee base may find objectionable? In other words, how as a leader can you drive your company to take a stand when there may not necessarily be a unanimous view around what that stand should be?

Some scenarios are obvious. If the Aryan Nations decided to have a reboot, launched a recruiting website, and attempted to sign up for my company’s authentication service, I think very few employees would be hard-pressed to grouse if we chose to turn that business away.

Similarly, if a dark web organization associated with human trafficking in some way attempted to integrate our technology into a platform to support its endeavors, we would have no compunction about shutting that down.

The problem lies in the nuance. What about a religious organization that &mdash; while employing exclusionary practices towards the LGBT community &mdash; provides homeless shelters that house and feed hundreds of folks every night?

Or the far-right political party that promotes wild conspiracy theories that &mdash; while wholly unsupported and having no basis in fact &mdash; do not promote violence or hate speech or otherwise run afoul of the law?

More than ever, employees are conscious of the social stance that their employers take and insist on having a voice in those corporate positions. How do we balance the views of a widely disparate and heterogeneous workforce in a way that allows everyone to be proud of the organization where they work?

## Getting Started: Calling out the Issue

We set out to take a whack at this problem last summer. In the absence of a playbook or illustrative examples, we started at the beginning: bluntly, transparently explaining the issue and noting the challenges to our employees. 

We highlighted our values, including our support of diversity and inclusion across boundaries of race, color, sex, national origin, religion, age, disability, gender identity or expression, marital status, pregnancy, sexual orientation, political affiliation, union membership, or veteran status. 

We noted our license terms, which preclude using our technology for a variety of nefarious and/or illegal aims.
And then importantly, perhaps most importantly, we highlighted our support of each employee’s right to their own personal views on political and social issues, provided those views do not impact our ability to honor and uphold our corporate values. We noted that one of our challenges as a business is to stay true to our core values while also accepting that our company is composed of folks that have different views and opinions about a myriad of political and other issues.

## Encouraging Dialogue

The next step in that process was soliciting feedback from our employees — asking those that were so inclined to fill out an anonymous survey about how they felt we should handle this difficult problem.

Given how vocal and socially active many in tech are, we were not surprised to receive feedback from well over 20% of our employees. What we were surprised by, however, was the quality of and perspective displayed in the answers. Here’s a sampling: 

* _I’m so proud that we aren’t hiding from this, even though it’s such a hard issue._
* _I feel very strongly about my own views, but I can appreciate that my views shouldn’t count more than any of my peers._
* _I think we’ll find that it will be impossible to make everyone happy, but I think we should be ok with that, as long as we all believe in the process we come up with._


## From Ideation to Policy

Here’s where we ultimately landed:

**1: The most important thing is to have a dialogue**. So many of our team members simply appreciated the fact that we took the time to dig in and talk through the issue. Beyond that, though, most employees understood the importance of recognizing differing views and that the vitriol with which they may view a certain company may not be shared by all. We were pleased with the balance and perspective we got back from the team here.

**2: Next, cleanly document the easy stuff**. We made it explicit that we would turn away business with entities that clearly violated local law or the acceptable use policy in our license agreement. Though most folks would assume this will be the case, the reinforcement and clarity were positive.

**3: Then take a whack at the hard stuff** &mdash; the decisions where different viewpoints and different opinions could lead to different results. We started with corporations or entities with policies or actions that have the impact of discriminating in hiring, promoting, or which adhere on the basis of race, gender, sexual orientation, gender identity, and veteran status. We laid out a policy whereby an employee could raise an objection to such an entity, and that objection would be reviewed by an internal committee. In making a determination as to whether to work with or continue working with such a company, we would evaluate a number of factors, including:

  * The extent of the discriminatory impact
  * Whether contrition had been made or any steps toward remediation undertaken 
  * If the company/entity provides other value to the world that might outweigh any alleged discrimination

Again, feedback from employees here was overwhelmingly positive. In particular, folks valued a predetermined set of criteria, as imperfect as it might be, as well as the notion of a committee to make decisions versus a unilateral executive decision. The transparency of this process, however, was the characteristic that resonated most with the team.

**4: Give employees a clear process to raise issues**. We clearly outlined the manner in which employees could raise objections to certain entities, and how that objection will be reviewed by the designated team, and a timeline for adjudication. We posted the process on the company Wiki page. 

Candidly, we felt the policy was a bit underwhelming. It’s short on details, long on vagaries and generalities. But we found it’s sufficient for its purpose &mdash; to include our employees in these decisions and foster a sense of inclusion and transparency. The simple fact that we were interested in the issue, and committed to an intentional process, helped our team members feel heard. Soliciting their feedback and providing an escalation path ensures that any strong viewpoints will have an avenue to be raised and considered. 

We know this is just the start and that there will be difficult questions in the future, but we believe that this groundwork can help any organization tackle those questions as a team.


When to Say Thanks... but No Thanks...

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Auth0 replaces in-house authentication solution to support rapid global adoption of tax automation and technology solutions



**BELLEVUE, Wash. – Jan. 26, 2021** – The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has been selected as the authentication provider for [Vertex](https://www.vertexinc.com/), Inc. (Nasdaq: VERX), a pioneer in tax automation and a leading global provider of indirect tax software and solutions. Having recently [completed an IPO](https://www.vertexinc.com/company/news/vertex-announces-pricing-initial-public-offering), Vertex will use Auth0’s identity and authentication solutions to manage and secure access to the Vertex platform.

Vertex helps more than 4,000 customers across 130 countries worldwide simplify tax complexities and digitally advance their business. The Vertex platform provides a comprehensive, integrated suite of tax technology solutions, including tax determination, compliance and reporting, data management, and document management. Vertex serves more than half of the Fortune 500 companies, along with the top tax, accounting, and consulting firms.   
 
To aid the company’s strategic priorities and digital transformation efforts, Vertex replaced its in-house identity management solution with the Auth0 identity platform. Auth0’s solutions help secure the authentication and authorization to Vertex’s applications&mdash;which help businesses efficiently manage end-to-end tax operations for customer transaction events&mdash;and help Vertex manage its user authentication experience. 
 
“The rapid changes taking place in today’s global business, technology, and regulatory environments demand intelligent solutions that are secure and scalable,” said Steve Wasserman, Principal Architect at Vertex, Inc. “Identity management is a critical component to any transformation process, and having a proven identity expert like Auth0 allows us to confidently serve our growing customer base.”

“As a trusted leader in tax technology, Vertex is instrumental in calculating the tax for businesses while removing the many hurdles surrounding tax obligations and global commerce,” said Ghazi Masood, SVP of Americas for Auth0. “The security of these transactions is paramount, and Vertex understands the role authentication plays in that process. We look forward to aiding the Vertex team and its customers with their digital priorities to drive long-term success.”

<include src="asides/AboutAuth0" />

### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />


Vertex Selects Auth0 to Help Businesses Deliver Secure Tax Solutions

Graham Moody joins as first people director for Auth0’s international business 



**LONDON – 20 January 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has earned a 3 Star Accreditation from [Best Companies](https://www.b.co.uk/) as one of the best places to work in the UK. Best Companies’ methodology powers _The Best Companies to Work For_ lists, spotlighting the UK’s best workplaces on a national stage.

The 3 Star Accreditation is Best Companies’ highest standard of workplace engagement, recognizing organizations that have demonstrated outstanding leadership and management during the pandemic and an extraordinary commitment to employee wellbeing and growth. Qualifying organizations must score 738 or higher on the Best Companies engagement survey distributed to their UK-based employees (Auth0 scored 833.6).

“Being a well-led and well-managed organization with extraordinary levels of employee engagement during these unprecedented times is an exceptional achievement. It demonstrates Auth0’s commitment to their people at a time when it means more than ever before – congratulations,” said Jonathan Austin, founder, and CEO of Best Companies.

Among Auth0’s results, 95% of respondents agreed with the statement, “I love working for this organization,” and 93% agreed with, “My manager cares about how satisfied I am in my job.” Read more about [what it’s like to work at Auth0](https://www.b.co.uk/company-profile/?Auth0-108768) on the Best Companies website.

“We are thrilled with the 3 Star Accreditation from Best Companies, especially because it’s an organization that truly celebrates and recognizes the incredible impact that culture has on the health and success of a company,” said Carolyn Moore, SVP People at Auth0. “Culture has been a cornerstone for Auth0 since day one, and we have invested a great deal of time and resources into ensuring that it flourishes regardless of how large we grow.”

The Best Companies accreditation is the latest recognition of [Auth0’s remote-friendly culture](https://auth0.com/press/awards) and the company’s first best place to work award in Europe, Middle East, and Africa region (EMEA). [Auth0 recently doubled its EMEA business](https://auth0.com/blog/auth0-doubles-business-in-the-emea-region/), which benefits from a strong local team in key geographies across the region.

Auth0 continues to invest in its culture around the world by welcoming Graham Moody as the first people director for its international business. Moody has led people and culture teams for startups and large multinationals, including Genius Sports, Ansarada, and VMware. Based in London, he leads the company’s human resources and employee experience functions to help foster Auth0’s outstanding culture at scale.

Watch our [interview with Graham Moody](https://www.youtube.com/playlist?list=PLZ14qQz3cfJILFcgg9eR5KdUbvQFQfcPn), and visit the [Auth0 careers page](https://auth0.com/careers) to join our growing team.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

_Richard Scarlett or Jamie Waddell_ <br />
Finn Partners for Auth0, EMEA <br />
[Auth0-EMEA@finnpartners.com](mailto:Auth0-EMEA@finnpartners.com) <br />


Auth0 Awarded Highest Accreditation by Best Companies UK

The gold standard for data security has something to teach every business.



ISO 27001:2013 is an international security standard that lays out best practices for how organizations should manage their data. It outlines how companies should manage information security risk by creating an information security management system (ISMS). This approach demands executive leadership while embedding data security at all organizational levels. The standard is voluntary, but organizations that follow its guidelines can seek ISO 27001 certification.

ISO 27001 was developed in tandem by the [International Organization for Standardization](https://www.iso.org/standard/71670.html) (ISO) and the [International Electrotechnical Commission](https://www.iec.ch/homepage) (IEC). It was originally released in 2005 and revised in 2013, thus its full title: ISO/IEC 27001:2013.

For companies that earn ISO 27001 certification, it’s a sign of their commitment to data security. But even companies not seeking certification should pay attention to ISO 27001’s lessons.

## What Is ISO 27001?

Essentially, all the guidelines in ISO 27001 add up to one thing: a guide for creating an ISMS. An ISMS describes the structures an organization has in place to manage data, including technology, physical security, personnel policies, and organizational hierarchy that delegates responsibility for these issues.

## Why ISO/IEC 27001:2013 Matters

ISO 27001:2013 certification is an important thing to look for in any cybersecurity partner because it indicates an organization-wide commitment to security. Working with such a partner can benefit your own organization’s security. As Clause 6 states, sometimes the most effective way to deal with data security risk is to either eliminate it or outsource it to a third-party.

For example, by choosing an [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/) partner to manage your user passwords, you offload some risk by not storing sensitive data on your own servers. And using an ISO 27001-certified IAM provider ([as Auth0 has done since 2018](https://auth0.com/blog/auth0-achieves-iso-27001-certification/)) sends a message to your own users and partners that your data is secure.

ISO 27001 is also the cornerstone of a growing international consensus about data security best practices. [Australia based its federal Digital Security Policy](https://blog.itgovernance.asia/blog/iso-27001-growth-in-australia-stems-from-government-initiatives) on ISO 27001. Likewise, ISO 27001 can provide guidance on how to meet the standards of other data privacy laws, [such as the GDPR](https://www.itgovernance.co.uk/gdpr-and-iso-27001), which often direct companies to it as an example of universal best practices. So if you abide by ISO 27001’s recommendations, you’re on the right track for legal compliance, not to mention improved data security.

### ISO 27001 certification

The bar for ISO 27001 certification is high. It requires intensive documentation, including a detailed risk assessment, records of internal training, audits, managerial review, and documentation of the relevant controls from Annex A. In addition, organizations that want to be certified must have their ISMS audited by an accredited body, a process that must be repeated annually.

Because ISO 27001 certification is so demanding, few companies actually undertake the certification process. Despite that, businesses of all sizes and industries should be aware of ISO 27001. It’s valuable both as a source of guidance for their own data management policies and as a way to judge potential data security partners.

![ISO 27001:2013](https://images.ctfassets.net/23aumh6u8s0i/5XIcDqEoGCzGiiAbjpf0rt/e971529afb8482b999c097c1a33aed65/iso-27001-separator-1)

## An Overview of ISO 27001:2013

ISO 27001 is divided into two sections: clauses and controls. The clauses largely serve as an introduction to the key terms and concepts, especially ISO 27001’s emphasis on information security leadership from the highest levels of an organization.

Anyone who wants to read the ISO 27001:2013 standard in full must [purchase a copy](https://www.iso.org/standard/54534.html), but here we’ll provide an overview of what the standard contains.

### ISO 27001 Clause 6: Risk Assessment

Clause 6 is especially important because it outlines how organizations should conduct a risk assessment to identify and analyze potential threats to their data security.

The fundamental questions in a risk assessment are:

* What data does the organization maintain?
* What are the potential consequences if that data was compromised, breached, tampered with, or lost?
* What are the information security risks, and what is the likelihood of them materializing?
* Who in the organization is responsible for managing these risks?

[_ISO Consultant Kuwait_](https://isoconsultantkuwait.com/2019/08/02/iso-270012013-clause-6-planning/) emphasizes how important it is to be as specific as possible when identifying risk scenarios and to identify the potential event, its effects, and its cause. They give the example of a hacker gaining access to internal systems via a brute-force attack (event), which was possible because the company doesn’t require strong passwords or use [brute-force protection](https://auth0.com/docs/attack-protection/brute-force-protection) (cause). The attacks lead to a governmental investigation and damage the company’s reputation (effect).

Once an organization has answered these questions, they can choose from several “risk treatment” options:

* Eliminate the risk (either by eliminating the data or the behavior that is putting data at risk).
* Share the risk by outsourcing to a third-party or through insurance
* Accept the risk after concluding that the threat is highly unlikely, the consequences would be minimal, or the costs of changes outweigh the potential benefits
* Control the risk to reduce the likelihood of bad outcomes

### ISO 27001 Controls

Annex A forms the bulk of ISO 27001, and it deals with the risk controls organizations can implement, based on the results of their risk assessment. ISO 27001:2013 lists 114 controls, divided into 14 categories.

#### Annex A.5: Information Security Policies
[This annex mandates](https://www.isms.online/iso-27001/annex-a-5-information-security-policies/) the creation of a written set of information security policies, published with the approval of management. These policies will collect the controls established through the rest of the annex. They must be reviewed at regular intervals or in the event of an internal or external change that would impact information security.

#### Annex A.6 Organization of Information Security
The first part of Annex A.6 concerns assigning responsibility for information security to all relevant stakeholders.
Part two specifically concerns maintaining data security on mobile devices and with remote workers.

#### Annex A.7: Human Resource Security
This section concerns ensuring that employees and contractors understand and are capable of fulfilling their obligations to data security, starting from before they are hired and ending with the off-boarding procedure.

#### Annex A.8: Asset Management
As the name indicates, this annex identifies information assets and classifies them according to the level of protection they require.

#### Annex A.9: Access Control
[Annex 9](https://www.isms.online/iso-27001/annex-a-9-access-control/) concerns a crucial element of any ISMS: controlling access to information. It’s divided into four sections, which outline the responsibilities of organizations to provision and deprovision users and implement secure login procedures, as well as the responsibility of individuals to respect IT security policies for authentication.

#### Annex A.10: Cryptography
This section concerns the proper use of encryption and how to protect cryptographic keys.

#### Annex A.11: Physical and Environmental Security
This is the longest section, with 15 individual controls, all of which deal with policies that protect an organization’s physical premises and the equipment in which it stores information.

#### Annex A.12: Operations Security
Annex A.12 includes best practices for ensuring data protection and integrity, from conducting data backups to malware prevention to maintaining internal logs.

#### Annex A.13: Communications Security
There are two sections to this annex. The first deals with maintaining internal network security, while the second addresses the security of information that leaves the organization.

#### Annex A.14: System Acquisition, Development, and Maintenance
This section mandates that information systems be analyzed with regard to their impact on security throughout their existence. It deals with the development, testing, implementation, and updates of information systems.

#### Annex A.15: Supplier Relationships
Unsurprisingly, this section concerns maintaining data security with third-party suppliers and maintaining an agreed-upon level of security.

#### Annex A.16: Information Security Incident Management
In this annex, organizations determine how they will deal with security incidents. This includes designating employees to take responsibilities for different types of events, including reporting them to authorities.

#### Annex A.17: Information Security Aspects of Business Management
Annex A.17 illustrates a bedrock principle of ISO 27001: that information security be directly tied to business outcomes at all levels. This section is devoted to minimizing business disruption by including information security in a business continuity management system.

#### Annex A.18: Compliance
Here, organizations must identify their legal and regulatory obligations to incorporate them into their ISMS.

![ISO 27001:13](https://images.ctfassets.net/23aumh6u8s0i/4hAaoLhTCKrPFSFwecyGhE/b3af0bb7fd4f0469a8ca38d69aa3820d/iso-27001-separator-2)

## ISO 27001:13 Creates Trust for Businesses and Their Partners

In a world in which data security is crucial, it can be hard to know where to begin getting your business’s house in order and equally hard to know whom to trust with your organization’s data. ISO 27001 simplifies this process by providing guidance anyone can follow, as well as a standard few can reach. For more information, [please reach out to the team at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


What Is ISO 27001:2013? A Guide for Businesses

Giving your customers good news can make it less likely you’ll have to give them bad news later.



Which sounds more like an email opener you’d like to write, this one:

> “_Dear customers, we’ve had a data breach, and your personal information was part of it._”

Or this one:

> “_Dear customers, another year with no data breaches! Here’s how we’re keeping your personal information private and secure._”

That’s what we thought.

The global COVID-19 pandemic didn’t cause data breaches. What it did was cause companies to realize how easily lackluster security protocols and slack remote work policies could lead to their proprietary and customer information being compromised. In fact, [nearly a third of companies](https://www.ibm.com/downloads/cas/QMXVZX6R?lnk=STW_IN_CLP_L1_TL&psrc=OPT&pexp=mob&lnk2=ar_DataBreach) will be subject to a breach sometime in the coming two years. 

The pandemic is also making people feel increasingly cut off from the world they once knew, so any communication received can have an exponential impact. And with privacy matters all over the 24/7 news feed, communication from your company that discusses the measures you’re taking to protect your customers is likely to be quite well received.

While you and your teams are hard at work locking down the [perimeter](https://auth0.com/resources/whitepapers/identity-perimeter), ensuring that remote workers are using proper security etiquette, and enabling everyone to access the resources they need when they need them &mdash; remember you’re not in a vacuum. Your customers would love to know of the steps you’re taking to ensure their private information stays private. And think of the boost to your company’s reputation when these customers tell their friends and family about the heart-felt email they just received from your CIO, telling them about the newest round of measures you deployed.

![Before You Write, Plan Out Your Campaign](https://images.ctfassets.net/23aumh6u8s0i/4SX1MxqNAsTuOPhOz97y6W/80440070b08e62080d90bcb0ef9f5d8b/breach-prevention-sep01)
<br />

## Before You Write, Plan Out Your Campaign

Any PR firm will tell you that it’s not just what you say but how you say it that matters. And any psychologist will tell you the same thing. They would also likely agree that when you have a lot of information to impart to your audience, they stand a better chance of internalizing more of it if you mete it out in easily digestible, bite-sized snippets.

Sit down with your security teams. Talk about what steps they’re taking, have taken in the recent past, and have on the books in the coming days/weeks/etc. See what metrics they’re using to monitor progress and what their workflow looks like. Take it all in. And take notes.

Then, back at your desk, parse what you just learned. Translate the technical jargon into plain language. Be sure you’ve got answers to all of the six W’s: Who, What, When, Where, Why, and How. Decide which pieces of information you gathered are appropriate for public consumption and which are better kept internal (there is such a thing as too much information, after all).

Now, work with your marketing and/or PR team to craft your communication campaign. Mix it up, with some information going out over each of the channels you know your customers are using blog posts, videos on YouTube, think-pieces for LinkedIn, sound-bites on Instagram Stories, and memorable one-liners for Twitter. Your customers are everywhere, consuming content via multiple channels throughout the day, and you don’t want to miss any of them.

## Internal vs. External Communication About Data Breaches

Our focus here is on how you talk with your customers about data breaches. We would be remiss; however, if we didn’t give passing attention to the other population, you need to be in contact with on this important subject, your employees. A recent Ponemon Institute study showed that [24% of breaches](https://www.centrify.com/media/4737054/ponemon_data_breach_impact_study.pdf) are caused by human error on the part of employees or contractors. That should be a wake-up call. Training is crucial to preventing such attacks.

The most prevalent root cause of human error in this context are phishing emails and other forms of social engineering. Verizon’s annual Data Breach Investigations Report (DBIR) has consistently shown that phishing scams account for [~90% of breach root causes](https://enterprise.verizon.com/resources/reports/dbir/#report). User training is the most effective way to [combat phishing attacks](https://auth0.com/blog/protecting-against-phishing-attacks/) by teaching people what to look for and how to proceed when they fear they may be being phished. There are further options as well; for example, some IAM solutions include [automated anti-phishing](https://auth0.com/blog/how-auth0-automates-phishing-response/) measures that are easy to implement and can dramatically reduce the efficacy of such attack vectors. As you can see, there is some overlap in what you’re communicating, but the language and specifics will change depending on your audience.

## 3 Keys to Successfully Communicating With Your Customers About Data Breaches

As with any written content, voice matters; along with determining the best channels to use in your information campaign, you’ll need to set the right tone as mentioned above while staying in brand voice. With sensitive yet technical information like data breach protection activities, word choice will also be a crucial piece of the puzzle to focus on. There are three primary factors you need to remember when crafting this content: transparency, concision, and empathy.

### Be transparent

Chances are you’ve been busy implementing detailed data protection measures. Some of these measures are likely things your customers will have heard of, like multi-factor authentication, malware protection, and even encryption is part of the lexicon these days. Keeping your customers in the know about the steps you’re taking in these areas will increase their goodwill toward you and the company.

At the same time, there are likely other steps, things like moving to a componentized infrastructure framework, automating IAM, and implementing a bug bounty program that would only serve to confuse the matter in their minds. Not to mention that making things like a bug bounty program public can raise concerns in those who aren’t aware of the beneficial nature of these programs.

So while you want to be transparent about your data security plan, you need to remain cognizant of the line between sharing enough and sharing too much. 

### Be concise

There are two parts to this suggestion. The first is precisely what it sounds like — don’t fluff it up. Data breaches are a subject that most people don’t want to know too much about, while at the same time understanding that they do need to know something. Presenting your content using concise language, without lengthy explanations or paragraphs full of flowery language, will show your audience that you know what you’re talking about and that you value their time.

The second part of being concise is knowing your audience. It’s only in knowing who you’re writing for that you can choose the right words to convey your message so that they’ll both understand and recognize your expertise in the subject. Use too many technical words or acronyms, and they’ll lose focus. Use kindergarten-level language, and they’ll feel you’re talking down to them. Finding the right balance is something that takes experience but is absolutely worth investing the time in.

### Be empathetic

Empathy is something that seems to be lacking in much of the technical communication going around these days. Emotionless jargon isn’t going to engender the trust and confidence you want your customers to have. Sensory language, words that make them feel you truly know where they are and how they feel, that’s what you want to use. Personalize your communications; use the words “I,” “we,” and “you.” Official business communication guidelines will say to the contrary that you should never use these words, but you need your content to resonate on a personal level, and for that to work, you need to connect on that personal level.

Tell your readers a story, the story of how you understand their concerns about data privacy and everything your awesome company is doing to ensure that their information doesn’t end up in the hands of some malicious actor. Use anecdotes include stories from your own life if applicable, and most of all, be empathetic. Powerful, evocative language helps here. Malicious, contempt, fervor, resolute, steadfast; these words evoke strong imagery for most people, and that’s exactly what you’re going for. You want your audience to see that on a deep, personal level, you get it. 

![3 Keys to Successfully Communicating With Your Customers About Data Breaches](https://images.ctfassets.net/23aumh6u8s0i/oHFerhauBupFwdc9RM1xk/2df76607817ce8aabc7f11c2bb71efa7/breach-prevention-sep02)
<br />

## Summary

It’s a fact of our 21st-century connected world that data breaches happen. The COVID-19 pandemic has accelerated the timeline for companies to get their infrastructure up to scratch and seal the holes in their permeable perimeters. Now is not the time to rest on your stellar track record of zero breaches in the past two years. Rather now is the time to be working full-tilt to ensure that the track record continues into the foreseeable future and beyond.

Build your perimeter and communicate with your users to instill the trust they’re looking for and that you need in order to continue growing. Remember how you reacted to those two potential email opening lines in the intro. Which one do you think your users would rather get next week?

[Get in touch with Auth0 today](https://auth0.com/contact-us) to start the conversation.

<include src="asides/AboutAuth0" />


How to Talk About Breach Prevention With Your Customers

There is a direct relationship between your data breach policies and overall business resilience.



Is your business resilient enough to weather the storm that is a data breach? Should the worst happen and you find your company's confidential data exposed to prying eyes, do you have a robust incident response (IR) plan in place to help guide you?

A data breach can spur a company to action like few other events we can think of. It takes a good deal of forethought and planning to be able to manage the fallout, reassure customers that their privacy wasn't compromised (and if it was, to outline the steps you're taking to protect them), and so on. There's a lot of adapting required, and that means the more resilient your business is, the better equipped you'll be to come out the other side of a breach intact.

We're going to break this expansive topic into three sections for today's overview, what we mean when we say "business resiliency," a sample of the business impacts a data breach can have on your company, and some concrete steps you can take today to begin developing the resilience your business needs.

![Data Breaches and Business Resilience](https://images.ctfassets.net/23aumh6u8s0i/3iuokX9OUndtAbdOcAZnoW/cb6066767d6ff4ff6e4ea80a417c8238/breach_zoom1)
<br />

## Business Resiliency: A Definition

Resilience, resiliency, business resilience, personal resilience, the idea of resilience has taken hold in recent years, and it seems like everyone is talking about it. At the same time, we've noticed a diversity of opinions on just what the word "resilience" means. We take a broad view of the concept, borrowing from the psychological literature on the topic:

<include src="TweetQuote" quoteText="Resiliency: An entity's ability to pivot in order to maintain its core principles and values in the face of a dramatic turn of events."/>

This definition leaves some things open to interpretation, and that's part of why we like it. Is that entity a person? A corner store? A family? A multinational corporation? The definition applies to all of the above. For a business to fit this definition, its systems must be scalable, processes flexible, and systems adaptable.

One more thing to point out about our working definition, the missing words "return to normal." If there are one lesson businesses are learning during the global COVID-19 pandemic, it's that the future is uncertain, and nobody can accurately predict what "normal" will look like in 6 months' time, let alone six years' time. For a business to consider itself truly resilient, it must recognize that uncertainty and structure its processes accordingly. This resiliency is the key to future-proofing your business for whatever the new normal looks like.

## Business Impacts of a Data Breach

So what does all that talk about business resiliency have to do with data breaches? Only everything. An organization with flexible processes and agile systems in place will be better positioned to respond quickly and concisely should the worst-case scenario occur &mdash; customer data leaked into the wilds of the dark web.

We go into greater detail about the potential impacts to your business in an upcoming whitepaper, so look for that soon. In the meantime, we're going to give you a sampling of some of the areas that tend to be hardest hit in the event of a breach: financials and brand reputation. As with any business topic, there will be overlap between these. However, there are enough differentiating factors that you'll want to approach them separately.

### Financial impacts of a data breach

To many, it will seem self-evident that the bottom line will take a hit with a breach. However, there are hidden costs that many overlook when laying out business continuity plans and data recovery schemes. For starters, if you are located or do business in a region covered by data protection legislation, you'll be looking at potential fines and regulatory fees. The major global regulations, GDPR in the EU, CCPA in California, PIPEDA in Canada, and LGPD in Brazil, for example, all include hefty fines if a company is found to have been non-compliant.

Then, for public companies, you'll be looking at a stock dip. A recent study by the Ponemon Institute found that, on average, companies see a [5% drop](https://www.centrify.com/media/4737054/ponemon_data_breach_impact_study.pdf) upon disclosure of a breach. This same study showed that companies with strong security postures pre-breach could expect that to be much lower, as well as having a much shorter journey to recovery. That strong security posture includes a well-documented business continuity plan and IR protocols.

Then you'll have the costs associated with cleanup and recovery. This category of costs includes everything from legal fees should any affected individuals decide to take action in that arena to bringing in outside forensic security experts to assist in the postmortem investigation. Then there are the PR experts you'll want to bring in to ensure your public statements are empathetic and disclose enough information to placate fears without giving away too much.

### Brand reputation impacts of a data breach

This is a controversial topic in certain circles. That's because there's an internal divide in how much responsibility each department has in maintaining your business' brand reputation. While IT generally sees it as someone else's job, marketing tends to see it as a company-wide job. Put that difference down to the differing views each team has on the processes involved. IT deals with systems and infrastructure, so it has an internal view of the business, while marketing handles customers day in and day out, so they're getting the view of an outsider. Either way, it is incumbent on the organization to be aware of the public's perception of the company and to understand the ramifications a data breach has on it.

Communication lies at the heart of maintaining your reputation in the aftermath of a breach. Companies that own up to the fact that they were breached, communicate in a timely manner with those affected, and stay as transparent as possible throughout are the companies who will emerge intact. Maintaining customer loyalty is a tricky proposition in the best of circumstances and only gets trickier when private information is leaked. According to the same Ponemon Institute study, nearly [1 in 3 customers](https://www.centrify.com/media/4737054/ponemon_data_breach_impact_study.pdf) who were involved in a data breach in the last year discontinued their relationship with the business involved. Imagine how much easier it would be to recover financially if you were able to keep those customers instead?

![What You Can Do Today To Begin Building Business Resiliency](https://images.ctfassets.net/23aumh6u8s0i/3rV2ZenLrXsIEawsbP3pJm/5766390f17cf6141ef7667fce8cc1c7b/breach_zoom2)
<br />

## What You Can Do Today To Begin Building Business Resiliency

Now we come to the part where we give you some ideas for how you can begin, today, to build up the sort of business resiliency you need to survive the worst-case scenario that is a data breach. To some extent, this resiliency can help you avoid a breach scenario in the first place by building up your [perimeter defenses](https://auth0.com/resources/whitepapers/identity-perimeter) and implementing choice technologies like a solid IAM (Identity and Access Management) solution. Should you find yourself staring at a security alert saying that you've been breached, these same tips can help guide your response and recovery:

1. Develop a strong business continuity plan
2. Assemble an executive disaster recovery team
3. Test IT and business team readiness
4. Craft a crisis communication plan
5. Implement regular security testing procedures
6. Roll out training programs for all staff
7. Lockdown your perimeter
<br />

As you can see from this introduction, the relationship between business resiliency and data breaches is a complex one with a lot of moving parts. Having resilient, flexible systems in place is crucial to being able to pivot when necessary in order to maintain your business trajectory, no matter the situation you encounter. We hope that if you take one thing away from this article, it's that how you respond to a crisis scenario will be a major determining factor in how hard you'll feel the impact of a data breach and how long your recovery will take. [Reach out to learn more](https://auth0.com/contact-us). We'd love to hear from you!

<include src="asides/AboutAuth0" />


Data Breaches and Business Resilience: What's The Relationship?

Reinforces commitment to the region with new headcount, customers, and partners



**LONDON – 25th November, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has doubled its business in the Europe, Middle East, and Africa region (EMEA) in the third-quarter over the same period last year. Randstad, Pret A Manger, Nutmeg, Flo Health, Libération, WeTransfer, and DPG Media, with its "Streamz" online video-on-demand platform, join the hundreds of customers across the region already using the Auth0 platform. 

"Randstad has been progressively rolling out the Auth0 solution for identity management, designed to foster collaboration among our 41,000 team members around the world," said Koen Klaassen, global identity and access management program lead at Randstad. "The Auth0 private cloud solution fits our needs in terms of compliance and scalability, delivering the right level of performance and control."

Auth0's growth benefits from the success of its modular, "building block" approach, which helps customers and developers to customize identity capabilities for their exact use case. The September launch of [Auth0 Marketplace](https://marketplace.auth0.com/) provides further extensibility by introducing native third-party solutions from technology partners, including regional companies like Onfido, MyLife Digital, and Scaled Access.

Additionally, channel partners are contributing to the adoption of the Auth0 platform in the EMEA region. Auth0 has concluded agreements with new partners across EMEA, including CMS Distribution in the UK and systems integrator Devoteam in France, who have joined 30 regional partners already offering the Auth0 platform.

"Devoteam measures its success by enabling customers to unlock greater value in their digital transformation projects," said Karim Bouami, digital identity and trust service director, Devoteam. "When identity management is a critical part of these projects, Auth0 brings a solid solution to support customers in those transformations, improving security without sacrificing engagement or experience."

Auth0 continues to scale its regional footprint to accompany increases in customer demand, increasing regional headcount to 139 in the third quarter, up more than 50% from the same period last year. With employees based across the EMEA region, Auth0 maintains a strong culture of remote working, which predates Covid-19 confinement periods in the region. 

"Our seamless transition in and out of remote working scenarios has helped keep our focus on serving our customers this year," observed Steven Rees-Pullman, SVP International, Auth0. "As we continue to evolve our offering and our organization to reflect demand, we aim to become a trusted local partner for each and every one of our customers across the region."

Auth0's regional footprint is underpinned by the strength of its technical teams, who engage with thousands of developers through a broad program of conferences, videos, and content. "Europe sets itself apart as a strategic region for engineering talent, and as a software company, Auth0 is proud of our highly-skilled engineers and designers," said Carolyn Moore, SVP People of Auth0.

In October, the prestigious [KuppingerCole KCLive Award for Customer Authentication](https://auth0.com/blog/auth0-powers-signify-s-award-winning-customer-authentication-solution/) was presented to Auth0's customer Signify for outstanding customer experience. Auth0 has also been named to the [2020 Forbes Cloud 100](https://auth0.com/blog/auth0-is-named-to-the-2020-forbes-cloud-100/) for the third consecutive year.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

_Richard Scarlett or Jamie Waddell_ <br />
Finn Partners for Auth0, EMEA <br />
[Auth0-EMEA@finnpartners.com](mailto:Auth0-EMEA@finnpartners.com)


Auth0 Doubles Business in the EMEA Region

Every business that accepts credit cards needs to be compliant with PCI, but your obligations vary dramatically depending on your size and structure.



If your business accepts credit card transactions, then you should be familiar with the Payment Card Industry Data Security Standard (PCI DSS). The rules (usually abbreviated as PCI) are a set of guidelines that seek to govern how businesses safeguard sensitive credit card information, with the goal of minimizing data breaches and fraud. Many merchants know PCI only as a mysterious surcharge from their credit card processor. But PCI compliance can become a serious and costly issue, especially if your bank unexpectedly demands that you prove compliance.

Here, we’ve created a straightforward guide that cuts through both legalese and technical jargon in order to explain what PCI is and how to determine your compliance obligations.

## PCI Definition and Key Concepts

Underneath the acronyms, PCI is actually very simple: a set of rules established by credit card companies to ensure that merchants are keeping their sensitive data secure.

### Background

PCI was [established in 2006](https://www.pcicomplianceguide.org/faq/#12) by Visa, Mastercard, Discover, American Express, and JCB, and it’s been updated periodically since then. The specific standards are written by a council created by the payment companies: the Payment Card Industry Security Standards Council (PCI SSC). However, the rules aren’t enforced by the council but by the card companies and [acquiring banks](https://www.merchantmaverick.com/what-is-acquiring-bank/).

### Compliance and noncompliance fees

It’s important to emphasize that PCI is not a law. However, given the clout of the five major card brands, as well as the credit card processors and acquiring banks, PCI is functionally mandatory. Credit card companies can issue fines for acquiring banks for noncompliance. Banks, in turn, will charge merchants a [PCI non-compliance fee](https://www.valuepenguin.com/credit-card-processing/pci-compliance-fee-explained#:~:text=Some%20merchants%20may%20also%20be,commonly%20around%20%2420%20per%20month.) and can even stop working with a business altogether.

Conversely, most credit card processors/merchant service providers also charge a monthly or annual [PCI compliance fee](https://www.merchantmaverick.com/pci-compliance-fees/). Many providers that charge this fee include services to make sure your business is PCI-compliant. However, some just tack on the surcharge without giving you anything in return.

### PCI Overview

All PCI rules relate back to a central goal: to encourage merchants to store as little credit card information as possible, so they are less vulnerable to data breaches and fraud. Meanwhile, PCI also helps craft guidelines for the service providers that handle cardholder data, minimize their exposure.

PCI helps to minimize risk by imposing lighter standards on merchants who do a few key things:

* Outsource credit card processing and data storage to trusted service providers.
* Regularly audit and update their security measures, such as encryption, password changes, etc.
* Keep internal systems as simple as possible. In the case of brick-and-mortar merchants, for instance, they point to Wi-Fi, in-store cameras, and physical terminals as threat vectors that hackers can use to steal data.

### PCI key terms

[PCI DSS defines a merchant](https://www.pcisecuritystandards.org/pci_security/glossary#M) as “any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC.” So while the term “**merchant**” can evoke a traditional idea of retailers, the term here is much broader. It’s also important to note that debit cards, if they bear the logo of the major brands, also fall under the rules.

Meanwhile, PCI defines a **service provider** as an entity that is “directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data.” So if a merchant uses Stripe or PayPal to handle e-commerce payments, those are service providers, but the category can also include your website hosting provider, your identity and access management (IAM) platform, and any other service that touches this data. Unsurprisingly, service providers can also be merchants since they too accept cardholder data as payment.

So what kind of data are we talking about? **Cardholder data** under PCI includes the card number, which PCI calls the “primary account number (PAN).” It can also mean the PAN, as well as the cardholder’s name, the card’s expiration date, or the security code.

## Does PCI DSS Apply to My Business?

The short answer is yes! If your business accepts card payments&mdash;whether in person, online or over the phone&mdash;PCI applies to you. However, your obligations under PCI vary dramatically depending on what type of business you have and how you handle payments.

The best way to determine your business’s obligations is to take the [self-assessment on PCI’s website](https://www.pcisecuritystandards.org/document_library?category=saq&document=saq). But there are multiple self-assessment questionnaires, so you need to determine which one best applies to your business. You can do that using this [PCI-provided table](https://www.pcisecuritystandards.org/pci_security/completing_self_assessment). Figure out which designation describes how you process credit card payments, and then take the appropriate questionnaire.

![PCI Questionnaire](https://images.ctfassets.net/23aumh6u8s0i/3Pij7WjlmS0GBMTCrnj5X2/e6f32e65e95e6e16d6e38469e9bfa2f5/pci_table)

You might notice that the vast majority of the merchant types above describe businesses that don’t store credit card information themselves. That’s in keeping with PCI’s overall preference for merchants outsourcing this storage to third-party professionals. Merchants who do choose to store credit card data themselves&mdash;for example, for the purpose of processing recurring payments&mdash;have among the highest compliance standards. Those merchants may be obligated to hire a [qualified security assessor (QSA)](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors) to conduct an onsite audit to ensure a merchant meets their PCI DSS requirements.

Your PCI obligation also varies by level, based chiefly on your card transaction volume. Every business is assigned a PCI compliance level from 1-4, with level 1 having the highest standards. Unfortunately, these levels aren’t exactly straightforward, and, technically, each cardholder brand has its own set of levels. However, the Visa and Mastercard levels are generally considered standard, so they’re the ones we include here:

* **PCI compliance level 4**: For e-commerce: fewer than 20,000 annual Visa/Mastercard transactions. For all merchants: fewer than 1 million annual Visa/Mastercard transactions.
* **PCI compliance level 3**: This level applies only to merchants that process 20,000 to 1 million annual e-commerce transactions per year.
* **PCI compliance level 2**: All merchants who annually process between 1 million to 6 million Visa/Mastercard transactions, regardless of channel.
* **PCI compliance level 1**: Any merchant annually processing more than 6,000,000 Visa/Mastercard transactions via any channel. In addition, any merchant that has experienced a security breach that exposed cardholder information is automatically moved to level 1.

## PCI DSS Compliance Guidelines

Regardless of your merchant level or how you accept payments, there are some basic housekeeping steps you should take to keep up on your PCI compliance:

* **Conduct a quarterly vulnerability scan of your systems using a PCI-approved party**. This scan is an automated process that probes your systems to identity potential entryways for attackers. If you’re currently paying a PCI compliance fee to your merchant service provider, this is one of the services they should offer you.
* **Conduct an audit of your current credit card processes**. This doesn’t just mean the processing itself, but every touchpoint for that data, including both digital and physical access. If you’re not sure where to start, take a look at [PCI’s documentation](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf), which points out some common data security pitfalls. For example, if you’re a brick-and-mortar retailer, make sure you don’t have internet-connected security cameras pointed at your point-of-sale system. If you’re an e-commerce merchant and you process payments yourself, make sure internal access to payment pages is rigorously controlled.
The basic rule of thumb in a self-audit is that if there isn’t a strong business need for keeping cardholder data in-house, don’t do it. Such data makes you vulnerable to attackers, increases the likelihood that you’ll be found PCI-noncompliant, and puts you at risk of non-compliance with [global data privacy laws](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA/email/?email=elaine%40animalz.co).
* **Keep your security up to date**. At a minimum, that means regularly updating system passwords, installing patches to all software (especially antivirus software), and updates on your payment terminals. These are simple fixes that can prevent a lot of attacks.
* **Use responsible vendors and service providers for payments**. PCI SSC provides this [list of questions](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Questions_to_Ask_Your_Vendors.pdf) to ask vendors to ensure you’re working with partners who are themselves in compliance and who can support you in maintaining compliance.
* **Control internal access to data**. As the [PCI SSC’s guide for small merchants states](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf), “Access control is all important.” Implement strong access-control measures to ensure that employees can only access the amount of cardholder data they need to do their jobs.

You need an [IAM system](https://auth0.com/blog/what-is-iam/) that issues a unique ID to anyone who can access this information, so you can trace any breach to the source. If you have one “admin” login for an entire store, and every employee can use it, you’re in serious need of an IAM update.

Like your payment platform and firewall provider, your IAM partner needs to be PCI compliant. For example, in 2019, [Auth0 became](https://auth0.com/blog/auth0-completes-pci-dss-validation-for-iam/) among the first identity providers to achieve Level 1 compliance.

## Getting PCI-Compliant Is a Smart Business

Many small-business owners simply aren’t accustomed to thinking about their information security policy. Unfortunately, no merchant is too big or too small for hackers, and credit card data is some of the most valuable and sensitive information in existence. So while no one really wants to think about PCI DSS compliance, it might be just the nudge you need to update your information security policy and implement tighter security controls.

For more information on how an IAM partner can be a part of your data protection strategy, please [reach out to the professionals at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


What Is PCI? A Business Guide to Compliance

steven-rees-pullman

I am an Internationally proven professional with experience including full P&L, Business Sector and Corporate planning and execution roles. My specialities — driving revenue and organisational growth in the EMEA.

General Manager EMEA

Steven Rees-Pullman

IAM is either making your business money or draining resources. Here’s how.



Business decision-makers often balk at updating their [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/) system, partly because of a fundamental misunderstanding of what IAM actually is. To be fair, it’s easy to confuse IAM with its most visible element: the login box. But in reality, the login box is to identity management what a light switch is to your home’s electrical system. IAM encompasses a complex set of functions that touch nearly every aspect of your business and have a measurable impact on your bottom line. Leaving an outdated IAM system in place — whether you’re managing the identities of employees, business partners, or end customers — is both costly and dangerous.

The alternative to living with this faulty wiring is to replace an in-house identity solution with a third-party system built by experts in the [Identity as a Service (IDaas)](https://auth0.com/blog/identity-as-a-service-in-2018/) field. A modern IAM solution can provide both a quick business win and long-term value by decreasing costs, increasing revenue, and making businesses more adaptable in a shifting technological and legal landscape.

![Business Value of Identity](https://images.ctfassets.net/23aumh6u8s0i/6hiKy3QBcDylVsHi8509Eq/414d9b468d1cadaa748ca38699c3e80f/iceberg_business_value)

## Modernizing Identity Reduces Maintenance Costs

Businesses that are reluctant to invest in IAM are often unaware of how much money they’re already spending on it. Maintaining an outdated, decentralized IAM system is usually a full-time job for at least one developer. In addition, dealing with identity-related issues such as lost passwords takes up the majority of your support desk’s time.

The maintenance costs of in-house Identity are high even if we only define “maintenance” as keeping the existing system running so users can log in and access resources. When businesses improve their custom IAM systems, those costs skyrocket.

Auth0 customers regularly report that if they attempted to build our features themselves, it would take an entire team of developers. For example, Gymshark saved £900,000 per year in engineer salaries when they enlisted Auth0 to centralize authentication across their apps.

The reason it’s so challenging for companies to update IAM in-house is simply that legacy, and in-house identity systems weren’t designed to do everything that modern IAM platforms can do. A startup can get by with a simple approach to IAM if all they’re doing is managing logins for their small team of employees. But that approach doesn’t scale well, especially if the company also wants to manage the login process for its customers. So when that business moves past the startup stage, and it acquires another business, their Identity needs become dramatically more complex. How will they migrate both sets of employee data to a single system when their IAMs don’t naturally integrate? How will they control access to sensitive data during the transition period, when employees are leaving and joining the business? Trying to answer these questions yourself costs time and resources, can derail important M&A deals, and erodes the experience for external users in a context where customer experience has a direct impact on the bottom line. 

## Identity Is Critical to Legal Compliance and Security

If you don’t invest in a sophisticated, secure identity solution, then you’re essentially budgeting for regulatory fines and the myriad costs associated with data breaches. Given the rise in global data privacy laws and cyberattacks, the chances that you will be impacted are only increasing.

### Identity-based attacks are a pervasive threat

Today, hackers the world over use authentication as their preferred gateway to attack. [Verizon’s 2020 Data Breach Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf) found that the most common forms of data breaches are identity-based: phishing and attacks using stolen credentials. These [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) mean huge expenses for businesses, in the form of application downtime, lost customers, and IT costs. The [Ponemon Institute reports](https://www.akamai.com/us/en/multimedia/documents/report/the-cost-of-credential-stuffing.pdf) that a company that falls victim to a credential stuffing attack stands to lose an annual average of $6 million (about 4.6 million pounds or 5.1 million euros). Thwarting these attacks requires IAM features such as brute force protection, multi-factor authentication (MFA), and rigorous access control.

### Identity is at the center of data privacy laws

The General Data Protection Regulation (GDPR) made data privacy a major issue for companies in the EU and around the world, and much of what it sought to regulate concerned managing access to personal data. Many of the [biggest GDPR fines](https://auth0.com/blog/gdpr-fines-hit-these-companies-hard-heres-how-to-avoid-them/) have been issued to companies that lacked adequate access controls or failed to protect user credentials.

Since GDPR’s passage, more countries have passed laws of their own, and today, we live with an ever-evolving patchwork of international data privacy legislation. This state of affairs will only increase, which makes compliance an ongoing challenge. According to [Gartner](https://www.gartner.com/en/newsroom/press-releases/2020-09-14-gartner-says-by-2023--65--of-the-world-s-population-w), “By 2023, 65% of the world’s population will have its personal data covered under modern privacy regulations, up from 10% in 2020.”

When the European Court of Justice (ECJ) [struck down the EU-US Privacy Shield](https://auth0.com/blog/schrems-2-eu-us-privacy-shield-ruled-invalid/) framework in July 2020, it highlighted how these laws can change overnight and cause severe business disruption. Businesses that invested huge sums to make their in-house IAM Privacy Shield-compliant are now faced with the daunting prospect of another overhaul with [Schrems 2](https://auth0.com/blog/schrems-2-eu-us-privacy-shield-ruled-invalid/). But IDaaS providers like Auth0 were prepared for the change, so their customers can continue doing business, uninterrupted.

## IAM Unleashes Innovation

For better or for worse, your company’s IAM platform will impact your ability to innovate. This happens in two ways. The first is simple: Every hour your developers spend on authentication is an hour they’re not improving your core product.

Most companies are familiar with this logic when making other decisions about building vs. buying microservices. For example, [Auth0’s research](https://info.auth0.com/rs/712-VXW-158/images/The%202020%20State%20of%20Application%20Assembly.pdf?utm_medium=email&utm_source=mkto&utm_campaign=state-of-app-2020-whitepaper&mkt_tok=eyJpIjoiTm1JM1pEazVOamcxTURReSIsInQiOiIrVHZ3dnA5b1JBK09VbUFnUmVnTThESVpEQkZRZlErelVsV0x2VGlsTUEzeVl6dTcxKzdEakVRaHJvb3o3WFB4VjRxSXZXRU9SUjV1ZG1tQ1wvdE1rYUR1OU9vVXNvU3dFZEJZR1EzTVZsb2t5MjFzVjhsSkZjTjhUaGZjMGpmQTYifQ%3D%3D) found that when companies need to incorporate a payment tool in their app, only 26% build it themselves. The other 74% use a software-as-a-service SaaS solution like Stripe or Paypal. The same logic holds true for authentication.

Companies can reserve the resources they save on IAM and devote them to innovating. For instance, [Auth0 customer Signify](https://auth0.com/case-studies/signify/) was able to reinvest 4.8% of their sales in R&D, an investment they otherwise would have spent on authentication. According to Etienne Bertou, Signify’s principal cloud architect, “When you work with a partner like Auth0, it takes a lot off of your roadmap that should not be the focus of your R&D teams.”

Aside from freeing up resources, an IAM system can drive innovation. For example, consider the impact of centralized Identity on improving analytics and customer outreach. When a single IAM provider handles user authentication across devices and integrates seamlessly with every other system, it de-silos data to create a single source of truth about users. This idea is the heart of an [omnichannel approach](https://auth0.com/blog/why-an-omnichannel-strategy-is-critical-in-2020/) to retail and marketing.

![Omnichannel](https://images.ctfassets.net/23aumh6u8s0i/4R9jiLsQ22iKfF5nFYW5qm/5e22f180c5c980130af02a358c9d7d04/omnichannel_diagram)

Streamlining authentication also improves UX and shows users that they’re dealing with a cutting-edge business. After all, the login box is where you make your critical first impression with customers &mdash; and they’ll quickly be turned off by cumbersome form fills. When Auth0 customer [Arduino introduced social logins](https://auth0.com/case-studies/arduino/), they increased conversions by 20%, proving the value of a modern authentication experience.

## Identity Is Central to Your Business

It’s always important to make sound investments in technology, and particularly in a moment of global uncertainty. But having a secure and extensible IAM solution is one of the best defenses against that uncertainty because it makes businesses more capable of adapting to change.

Moreover, IAM is already affecting your bottom line, even if some of that impact only becomes visible when something goes wrong. Instead of waiting for an IAM emergency, start calculating all the ways your approach to Identity impacts your business. You’ll soon learn whether it’s working as a cost or as an asset.

<include src="asides/AboutAuth0" />


The Business Value of Identity

Auth0 report reveals that despite budget barrier removal, adoption remains immature



The ease of use, deployment, and management offered by SaaS applications has transformed how companies do business. This explosion of SaaS usage over the last ten years has also attracted billions in venture funding while inspiring thousands of entrepreneurs to launch new products that propel them to [cloud stardom](https://www.forbes.com/cloud100/#60795605f941). **_Cloud_** has even become a mainstream term that non-technical consumers use in day-to-day conversations. And yet there is one area of SaaS adoption that remains relatively immature: **SaaS components**.  

A SaaS component is a cloud tool that replaces a specific function within an application. Historically, as organizations have built custom software, their software development teams would code these functions into the application. But as software development has moved from monolithic codesets to agile microservices models, companies have made the shift to using SaaS components for non-differentiating functions. 

For example, Stripe is a commonly used SaaS component for payment processing. Companies no longer need to spend valuable developer time coding and managing a custom built payment system. Instead, they can simply purchase Stripe and integrate it into their application, saving development and maintenance time and risk. Easy, right? 

Given these undeniable benefits, most companies must have already completed this shift to SaaS components?  

Our research says: **actually... no**. 

> _“SaaS component adoption is still relatively immature.”_ <br />
> -Auth0 Report: [_How Development Teams Purchase SaaS_](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas)

[According to the research](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas), the majority of technical teams believe in the value of SaaS component usage; however, adoption rates vary greatly from company to company, and overall usage is relatively low.  

![Build vs. Buy](https://images.ctfassets.net/23aumh6u8s0i/4YezuZ6kRBychXl1xfZ2U3/46ae92f3083c81b6ab844a51b5f7fb8f/saas_01_build_vs_buy)
![Percentage](https://images.ctfassets.net/23aumh6u8s0i/6MdVlrUq2vWPCHHc352dv2/cb4187c49344f24a8cfb970533ea0057/saas_02_percentage)

## Why SaaS Component Adoption is Low

The research report also surveyed respondents on the issues that have prevented their team from using third-party SaaS components. The top five reasons in ranked order are: 

1. Cost Issues/Lack of Budget
2. Security Issues/Concerns
3. Missing Features/Functionality 
4. Timing/Speed 
5. Management Doesn’t Approve or “Get it.”

But this low adoption rate will not remain for long. According to the [Covid-19 Digital Engagement Study](https://www.twilio.com/covid-19-digital-engagement-report), produced by Twilio, COVID-19 has sped up digital transformation by 5.3 years. This acceleration has given development teams the budget and permission to innovate. 

> _“Obstacles have been cleared, barriers have been broken down, and budgets have been freed up.”_ <br />
> -Twilio: [_COVID-19 Digital Engagement Report_](https://www.twilio.com/covid-19-digital-engagement-report)

2021 is the time to build, but how companies approach their innovation will be the critical aspect of how they succeed. Given the current low usage rate of SaaS components, early adopters will benefit the most in productivity gains. But with a wide spectrum of SaaS tools in the market, where does a development team look to start? Given that each company has their own unique business requirements, it’s best to do an internal audit of the application components that take the most time and effort to build and maintain.  

According to the [_How Development Teams Purchase SaaS_](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas) report, the top five components in ranked order are: 

![Most Time and Work](https://images.ctfassets.net/23aumh6u8s0i/48FwXBp1zXpyZt2ypSs3nn/fd40cdc5fe536cba99e03b29b402f176/saas_03_most_time_and_work)

And for companies that are currently building authentication systems internally, the research also showed that moving to a SaaS component can help companies reduce their time to market.

![SaaS Platform](https://images.ctfassets.net/23aumh6u8s0i/JbFp9AYqonbrcrgO5qa4K/cccd58cf4b5d87dd0d3431185413c185/saas_04_saas_platform)

## Developers Influence SaaS Purchase Decisions

As companies move to integrate these SaaS components into their applications, it is critical that they put as much effort into HOW they buy as WHAT they buy. Research shows that developers care greatly about being consulted in SaaS component purchase decisions.

> _"Getting to choose SaaS components matters to 91% of developers."_ <br />
> -Auth0 Report: [_How Development Teams Purchase SaaS_](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas)

![Developers](https://images.ctfassets.net/23aumh6u8s0i/KqlaQ9zTkHWxr3cEeBSir/b59f9c48d32916b8af246cde786d178b/saas_05_developers)

These results clearly demonstrate how developers will be on the front-lines of the digital revolution, driving software selection decisions across organizations. And these teams will need SaaS components that are simple to use out of the box (and easy to customize). So while SaaS component adoption might still be immature in 2020, it is looking to be a top priority for many companies in 2021. 

To learn more about how companies can take a developer inclusive approach to SaaS component purchases, read the complete How Development Teams Purchase SaaS [report](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas). 

<include src="asides/AboutAuth0" />


Why Aren’t More Businesses Using SaaS Components?

2020 amendments to the APPI change the data security obligations of businesses



On June 5, Japan enacted a new set of amendments to its data-privacy law, the Act on the Protection of Personal Information (APPI). These Diet-approved updates are part of the APPI's "every three years" review policy, but the changes go far beyond minor tweaks to existing Japanese privacy law.

Taken as a whole, the 2020 amendments mark a further expansion of the APPI's scope, following in the footsteps of previous expansions. They increase the obligations of companies to be transparent and secure with the personal data of Japanese residents or risk incurring criminal penalties.     

The major part of the APPI amendments isn't expected to officially come into effect until spring 2022, although the timeline is subject to change. But if your company does business in Japan, now is the time to educate yourself and make sure your business is compliant.

## Why Japan's Data-Privacy Law Needed an Overhaul

In recent years, Japan has suffered a string of highly damaging data breaches, prompting the Japanese government to change its "hands-off" attitude toward data privacy and cybersecurity. Understanding those stories is crucial to understanding how the new amendments will be interpreted and enforced.

### A culture of poor cybersecurity

According to [_The Economist_](https://www.economist.com/business/2020/07/18/japan-incs-it-needs-a-security-patch), Japan "lags behind other advanced economies" when it comes to cybersecurity. Many Japanese SMBs have minimal security, and many more use vulnerable legacy technology. (_The Economist_ illustrates this point with this shocking statistic: "Nearly 14m people were still using Windows 7 when Microsoft stopped providing security patches in January [2020].")

### Data breaches prompt outrage and change  

The APPI was originally passed in 2003 and has been updated several times to require greater protection of personal data. In order to adapt to factors such as the rapid evolution of technology and global standards for protection of personal data, the 2015 Amendments required that new amendments be considered every three years. 

While the law was due for amendments in 2020, the contents of those amendments were influenced by a string of high-profile breaches. For instance, in 2019, Japan's Uniqlo retail chain revealed a breach that compromised the data of over 460,000 customers. Stories like this prompted a national outcry and calls to strengthen the APPI's enforcement capabilities. 

At the same time, another case was winding its way through the courts, which would help shape the direction of APPI amendments. Benesse, an education tech company, had a data leak, in which an employee for a subsidiary stole and sold the personal data of an estimated 29 million customers, reports the Japan Times. [Benesse](https://www.nikkei.com/article/DGXMZO39457050X21C18A2CC1000/) stated that the leak involved over 35 million records. 

After a lengthy legal battle, the courts found that the subsidiary should have known its protections against data exports were not up to date, and Benesse should have provided more appropriate supervision. According to [Data Guidance](https://www.dataguidance.com/notes/japan-data-protection-overview), both parties were found liable "for damages of JPY 3,300 (approx. €27) plus 5% late charges per annum per affected individual." Although Benesse was prosecuted under the old version of APPI before the 2015 Amendments (effected in 2017). Although you can't draw a direct line between this case and the 2020 amendments, it is clear that amendments mean action.   

The take-home message of all this context is that businesses can't afford to think of the APPI amendments as needless red tape or a continuation of the status quo. Rather, they're an opportunity to correct serious shortcomings in Japan's cybersecurity culture that could put your company's sensitive and proprietary data at risk.

## What's Changing in the APPI Amendments

The 2020 amendments to the APPI make two broad changes: giving individuals more rights over their personal data and increasing the reporting obligations of companies.

Here's a quick rundown of the APPI's scope.

### Who the APPI applies to

In principle, any business (whether for-profit or not) that handles the personal information of Japanese residents falls under the law, regardless of where the business is headquartered. The current APPI applies to non-Japanese entities if they acquire the data of Japanese residents and process it in a foreign country, except for certain provisions that are considered not applicable or enforceable to non-Japanese entities. There are [limited exceptions](https://www.dataguidance.com/notes/japan-data-protection-overview) for the press, professional writers and academics, religious groups, and political parties. This part of the law is largely unchanged from the previous version.

Under the current version of APPI, the Japanese government can report incidents involving non-Japanese businesses to the foreign business' own regulatory authorities. The 2020 amendments expand that power, and the PPC can demand documents and reports from foreign entities, as well as enter a facility and conduct and audit with a foreign regulatory authority.
                                                                       
### How the APPI defines personal information and personal data

The definition of personal information and personal data under the APPI hasn't changed since the 2017 revisions. It defines personal information as any information from which one can deduce the identity of a living individual. Such information includes biometric markers and official identifier numbers. Like the EU's General Data Protection Regulation (GDPR), there's also a special category of "sensitive personal information," which includes race, religion, criminal record, and medical history. Under the 2020 amendment, personal data includes personal data that are to scheduled to be deleted within six months from the date the entity obtained it, which is excluded under the current law.

It's important to note that the 2020 amendment introduces the concept of pseudonymized information, which can only identify individuals when combined with other data. According to the [_IAPP_](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi/), pseudonymized information is exempted from parts of the APPI, including the requirement to disclose and stop using personal data. Since pseudonymized information is limited to the internal use by businesses, it is not allowed to be shared with third parties by consent of the individual or through opt-out procedure.     

### The penalties for noncompliance

The current APPI establishes fines and penalties for violations, but the 2020 amendments make the penalties heavier. The amended APPI stipulates that parties who fail to comply with corrective orders by the Personal Information Protection Commission (PIPC, sometimes abbreviated as just PPC) can be liable for criminal punishment of up to 1 year imprisonment or fines of as much as 1,000,000 Japanese yen (if the party is a business entity, up to 100,000,000 Japanese yen). In addition, the 2020 amendments allow the PIPC to publish the names of operators who don't comply with orders.

In the case of a business or employee using personal information with a purpose to gain profit illegally, this Act is considered criminal and can be punished by up to a year in prison or a fine of as much as 500,000 Japanese yen (if the party is a business entity, up to 100,000,000 Japanese yen).           
Individuals can also sue for damages relating to the loss of privacy, which may end up having the biggest financial repercussions for businesses.

In practice, the PIPC usually follows an enforcement pattern of an initial inquiry into allegations, followed by recommendations to correct any violations. The PIPC can pursue legal action against companies who fail to change their behavior after this process.

### New rights of individuals under APPI

The 2020 APPI amendments give individuals an **expanded right of deletion or suspension of use**. According to [the law](https://www.ppc.go.jp/files/pdf/20200612_comparative_table_amended_APPI.pdf), data subjects can now demand their data be erased "if it has become unnecessary for a personal information handling business operator to utilize retained personal data," if that entity has had a certain data breach or leakage, or "there is a possibility that handling of the retained personal data... would harm the rights or legitimate interests of the principal."

Allowing individuals to demand erasure when there is a possibility of harm stands in contrast to the previous language, which allowed for deletion only when personal data was handled or acquired illegally. In addition, in the prior version of the APPI, any data scheduled to be erased within six months was exempt from the right to erasure. The new version removes the six-month exception.
     
<include src="TweetQuote" quoteText="The 2020 amendments also give subjects the right to request an electronic copy of their personal data."/>

### New obligations for companies under APPI

As we mentioned earlier, the old APPI guidelines did not include **mandatory reporting of data breaches**, but the new law does require businesses to report certain "leakage, loss or damage" to the PPIC, which thresholds will be set forth in the rules for the APPI later. However, the language of the requirement is still somewhat murky when it comes to informing individuals that their data has been compromised. The law says this requirement doesn't apply "when it is difficult to inform a principal and when necessary alternative action is taken to protect a principal's rights and interests."

The 2020 amendments include two notable provisions regarding **transfer of personal data to a third party**. The first expands regulations to transfers in cases where the disclosing party can't use the data to identify specific individuals, but the recipient of the data can.

According to [Data Guidance](https://www.dataguidance.com/opinion/japan-impact-adopted-appi-amendment-bill), "Given that provision of online identifiers (such as cookies) to third parties may become subject to consent requirements, this amendment will likely affect targeted advertising and other ad tech practices. The practical impact of the Amendments on businesses, in this respect, is high." However, Data Guidance goes on to say that, because obtaining consent for using cookies is already required under the GDPR, this requirement shouldn't be too onerous for GDPR-compliant companies.

The other unique element regarding third parties concerns **transfer of data across national borders**. Under the current version of APPI, businesses sharing data outside Japan must obtain the consent of the data subject and share information about the data-privacy systems of the third party and their country. If a business does not obtain prior consent (for example, because the transfer isn't to a third party), they are required to ensure that the recipient of the data has equivalent data protection standards to the APPI or is in a country with equivalent standards. At present, the only foreign countries for which this applies are the UK and the European Union.

The 2020 amendments make several changes to this regulation. They expand the information that must be shared with individuals when obtaining consent (the specific details have yet to be released). They also require that when sharing personal data with operators that have equivalent data protection standards, businesses must ensure that the protection standards are maintained.

Also, under the amended APPI, personal information operators are required to disclose their addresses and the name of the representative director in case the operator is a corporation. In addition, additional information needs to be disclosed for the provision of information through opt-out procedure or in case of joint use of personal information.

## Preparing Your Business for APPI Amendments

Like many international data-privacy rules, the text of the APPI doesn't make many specific suggestions for best practices. However, the PIPC has issued guidelines regarding appropriate security measures. The good news is that many of these guidelines are familiar to GDPR-compliant companies, and they start with some basic data housekeeping.

_The following guidelines are not intended as legal advice. Contact your legal counsel for specific recommendations for the provision of personal data._

### Appoint a Data Protection Officer (DPO)

This isn't a hard and fast requirement, but PIPC guidelines recommend it for companies in which a breach could cause harm, provided the business is large enough. If you're running an international corporation handling sensitive personal information and conducting cross-border data transfers, consider this recommendation a requirement.

A DPO can help ensure you're taking appropriate measures to stay compliant, such as regularly reviewing your privacy policy as guidelines evolve. 

### Update legacy systems

Given the prevalence of vulnerable legacy technology in Japan, it's essential to take a hard look at your company's internal systems. A failure to do so could lead to costly legal action. For example, in the Benesse case, the company's negligence hinged on the fact that they hadn't updated their processes to prevent the transfer of data to new Android phones. A small oversight with a big consequence.

In addition, staying on top of the latest encryption standards can free your company from some of its legal obligations. Under the current guidelines, businesses are not required to inform the PIPC of a breach, provided the leaked data is encrypted "[at a high level](https://www.dataguidance.com/notes/japan-data-protection-overview)."

### Implement access controls

The APPI demands that businesses take "necessary and appropriate action for the security control of personal data." The bedrock principle of "necessary and appropriate" security is that you should limit the number of people who can access personal information.

Implementing a sophisticated [workforce identity and access management (IAM)](https://auth0.com/b2e-identity-management-for-employees) system lets you assign permissions for who gets to access sensitive data. Moreover, it creates an immutable record of access, so if there is a breach, you can limit the damage.

If a simple username/password combination is all that it currently takes to access your company's personal information databases, then workforce IAM is a priority.

## Data Protection Is Mandatory, With or Without Privacy Laws

In passing the latest APPI amendments, the Japanese government has made it clear that it intends to take a tougher stance on the handling of personal data. But it shouldn't take a Diet approval for businesses to examine their use of personal information or to ensure that they have appropriate security control measures in place.

Hopefully, these amendments will lead to improved outcomes for Japanese companies, citizens, and everyone doing business in Japan.

For further information on how a modern approach to IAM can help protect your company's data and comply with data protection laws, reach out to the [team at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


The New Japanese Privacy Law: What Businesses Need to Know



Back in 2003, I was a young sales manager leading a small but solid team for a startup. After we were acquired by a large multinational company, I found myself reporting to an SVP of Worldwide Sales; we'll call her Marie, who was responsible for over $500MM in revenue. This was next-level for me, and my time reporting to her taught me an important lesson &mdash; how NOT to manage up.

## How Did I Screw This Up?

I reported to Marie for around 12 months. During this time, my team absolutely killed it. We were the top-performing go-to-market team across the entire $6B global business. We were never at less than 120% of the plan in any quarter and were the envy of teams across the org. I was doing nothing but making life easier for my new boss.

Or so I thought.

Despite all the success, I never felt like Marie enjoyed talking to me. She canceled at least half of our weekly 1:1s, citing travel or scheduling conflicts (once her exec assistant told me she was out of town literally 20 minutes after I walked past her in the lobby &mdash; that one hurt). 

When we did connect, she was brisk, all business, and very short. I wasn't expecting to be best friends. I didn't envision sipping martinis after work, grabbing dinner with our spouses, or joining her family at their Christmas party. 

But I also didn't expect to be treated like I was slathered with fish entrails. 

## Virtually Unmanageable

After finishing my one-year earn-out period, I gave my two weeks' notice and began looking for another early-stage company to jump into. During my exit interview, the HR business partner confided in me that my boss had said I was "virtually unmanageable" and "the most exhausting direct report" she'd ever had. 

Ouch.

Did I mention I crushed my numbers? Like CRUSHED my numbers? How on earth could my boss have thought of me as anything other than a beacon of light? A pillar of go-to-market excellence? A reliable watercraft on otherwise tumultuous seas?

It turns out that I was completely and utterly terrible at "managing up" or managing my relationship with my boss.

Looking back, there's a ton that I should have done differently. When I had more time under my belt managing teams of my own, I came to appreciate the art of managing up and how important it is to be intentional in how you manage your relationship with your boss. 

To pack it up, here are my biggest lessons:

## Lesson #1: Keep It Positive 

Anyone that works closely with me knows that I'm an Eeyore. I can be a little surly and a bit of a grouch. Apparently, I tortured Marie with dozens of grumpy paper cuts each week. Any random negative thing I noticed led to a grousing, whining email (this was 20 years before Slack, mind you). 

* "It's been ten days, and I still haven't received the slide templates Marketing promised."
* "The Solution Engineering org here is really weak."
* "Don't you agree that our new HR business partner is an @sshat?"

I was a stream-of-consciousness communicator and communicated with my boss like I would with a colleague, a friend, or someone sitting next to me on the bus. 

Venting is no problem, but don't do it to your boss. Find a peer, a friend, a spouse, a dude in line with you at Walmart, whatever &mdash; just not your boss.

## Lesson #2: Pack It Up

One way to tell the difference between a relatively new manager and a seasoned exec is the efficiency of their communication. Newer managers provide too much information, too much detail, and tend not to set expectations about what they need from a given conversation. In short, they ramble or babble. 

On the other hand, more seasoned executives are typically much more efficient &mdash; and effective &mdash; at quickly getting what they need. 

It's tough to give this lesson the right level of detail without turning this piece into a 3,500-word essay (I appreciate the irony that I cannot pack up how to pack it up). I will save that degree of detail for another blog post; however, some quick guidelines to consider:

* Set expectations for any 1:1 or meeting with your boss at the outset.

 → _We have 30 minutes, yes? I have two things I need your feedback on, and two requests I hope you can approve today._

* Layout what requests or needs you have.

→ _I'd like your support for a new initiative to drive more page views on our site. It requires a $250,000 unbudgeted investment._

* Share what information you have to support your request.

→ _I shared the context and math behind the request with you by GDoc last Friday. Have you had time to review it?_

* Ask what other information they need to make a call.

→ _What other information do you need from me to make a decision?_

* Stop talking.

→  ...

Be respectful of their time, provide context, and confirm they have what they need. 

## Lesson #3: Don't Over-Index on HR Stuff

This is a big one.

I focused a lot of my 1:1 time with Marie on people management issues, taking her through the minutiae of each personnel issue in my organization. Since I was a relatively new people manager, the people aspect of the job was the hardest for me, and the one most often on my mind.

Here's the thing: people issues that seem significant to an entry-level manager are par-for-the-course for executives that have managed people for much of their careers. Focusing communication on "lower-level issues", therefore, makes you seem like a "lower-level leader," and implies you're incapable of dealing with those issues.

_But Dave isn't part of my boss's job to coach me and help me become a better people manager?_ 

Of course. To be clear, this is **not** me telling you never to bring up people issues. It is a reminder that if you are a relatively new manager, people issues might be keeping **you** up at night, but that will **not** be the case for your boss. Lead all conversations with business issues &mdash; issues that tie to your boss's success &mdash; and save tightly-framed HR stuff for the end. Consider also leveraging a mentor, someone you can bounce ideas off of in a more relaxed environment.

## Lesson #4: Set the Cadence

If your boss is overloaded, your regular weekly/monthly meetings with them may feel harried, like an afterthought or a check-box endeavor. Take control of the communication, both the cadence and the subject matter. Suggest a regular time to meet, and propose a regular set of key performance indicators (KPIs) to review. If those KPIs just happen to be metrics upon which your boss herself is measured, even better. 

If you're stuck on how to structure the meetings, try something simple like "The 3 P's":

* Performance: a review of a dashboard of some sort that objectively tracks the performance of your team.

* People: the status of any headcount to be filled, restructuring plans, or other team-related items.

* Potpourri: any other random odds and ends.

Taking control over the cadence and agenda shows confidence, takes an item off your boss's to-do list and ultimately makes their lives easier.

## Lesson #5: Don't Hide the Gnarly

NOBODY likes delivering bad news to their boss. But if there's a problem brewing in your business, it is far wiser to bring that problem to your boss's attention than risk them discovering the issue on their own.

This runs counter to many new managers' instincts. It's often easier to convince ourselves that things will work themselves out, that the tides will turn, or engage in other acts of aggressive denial than admit dark clouds are on the horizon. 

If your boss identifies a problem in your business you have not discussed with them, they are likely to assume that (1) you're not aware of the problem, or (2) you're aware but have no idea what to do about it. 

Neither reflects well on you.

Bringing a potential wrinkle to your boss early, in fact, reflects **positively** on you as a new manager, even if the wrinkle never materializes. Consider:

* If you identify the problem first, you're on top of your business.
* If you bring a solution as well, then you are not only on top of your business, _you know how to manage through challenges._ 
* If you identify the problem but aren't quite sure what to do about it, you're _displaying good judgment_ and striking the right balance between working independently and seeking guidance.

Some of the worst breakdowns between managers and their direct reports occur when people don't identify or take responsibility for mistakes. Identify potential problems in your business and share them early. 

## 360 Degrees of Responsibility 

My ["Careful What You Wish For..." blog post](https://auth0.com/blog/careful-what-you-wish-for/?utm_source=linkedin&utm_medium=sc&utm_campaign=whatyouwish) looked at the difficulties of managing those on your team. But it's just as important to learn how to manage upwards if you are going to succeed. You might have the best objective results every week, but it doesn't mean a thing if you deliver those results alongside poor communications, a lack of understanding about the bigger picture, and 20 minutes of "I can't believe marketing messed that campaign up" chatter.

Like anything in leadership, be intentional about your communication strategy with your boss. Put in the time to plan, and review your progress regularly. 

Also, don't call co-workers @sshats.   

**The End**

<include src="asides/AboutAuth0" />


When Your Boss Is Just Not That Into You

We’re living in the API economy. Here’s how it can work for you.



In the mid-2010s, the acronym “API” graduated from a piece of technical jargon used by developers to a term passed around boardrooms. As early as 2016, [Gartner declared](https://www.gartner.com/smarterwithgartner/welcome-to-the-api-economy/) that “we live in the API economy.” Shortly after, the expression “API-first” followed the same course, but many people who use this expression still don’t know what it means.

Essentially, API-first architecture is an approach to software design that centers the API in order to create applications that can easily interface with one another. API-first creates ecosystems of applications that are modular, reusable, and extensible, like Lego blocks.

If you’re not a developer, you don’t need to grasp the finer points of the “[HTML5 vs. Native debate,](https://www.leaseweb.com/labs/2013/10/api-first-architecture-fat-vs-thin-server-debate/)” but you do need to understand the impact that is going API-first can have on your business and your bottom line.

## What Is API-First Design?

To understand the Value of an API-first strategy, first, we need a working API definition.

### API 101

API stands for “application programming interface.” It’s a piece of code that acts as a go-between for two heterogeneous pieces of software. An API acts as a mediator or translator between two parties, passing requests and responses back and forth while exposing only the code necessary to complete the transaction.

![api-101](https://images.ctfassets.net/23aumh6u8s0i/7kqCpc2bC5KwXcxvT3p0Kt/60e2c7fca4261e2aa0d183c3b17faae3/api-101)

An API is often compared to a waiter at a restaurant, communicating orders between the diner (which might be an internet browser) and the kitchen (the back-end services the diner is trying to access). The API takes this order to the kitchen and brings the requested dish back on a neatly organized plate. This system is good for the diner (who doesn’t need to walk to the kitchen/load a new webpage), and it’s good for the restaurant (which doesn’t want customers looking at its secret recipes/proprietary code).

[Social logins](https://auth0.com/learn/social-login/) are a common use case for APIs. When you implement social login, users can authenticate through an identity provider like Google, Apple, or Facebook with a single click. The API facilitates the whole, invisible interaction between your login screen and the social provider who confirms this user’s identity.

![social-providers](https://images.ctfassets.net/23aumh6u8s0i/5xb5T1z986ue58ss0iQTwe/fe48650ec1e99ed688660101a483d78c/social-providers)

### API-First Development

An API-first approach means thinking of an API as the most important user for an application. That might sound strange at first, but it makes intuitive sense, given how much crucial work the API does in communicating between applications.

API-first is a different approach from “code-first,” in which developers design an application’s functionality and then insert the API at the end. That code-first approach can be problematic if your application isn’t structured in a way that makes it easy for the API to access data. Going back to the restaurant analogy, API-first architecture means you design your restaurant so the waiter can navigate it with ease, rather than putting 15 flights of stairs between the kitchen and the dining room.

In API-first design, your development team works on API design before the rest of the application. As developer Joyce Lin wrote in [_Better Practices_](https://medium.com/better-practices/api-first-software-development-for-modern-organizations-fdbfba9a66d3), “By introducing new features as an independent service accessed by API, the rest of the app can be stitched together, along with any other future apps.” To accomplish this, any successful API-first strategy hinges on creating excellent API documentation all teams can use. This makes for a better developer experience and ensures the design of the API is treated as a valuable company resource.

That ability to easily stitch together different apps and features is essential in our cloud-based, interconnected world, in which few business processes work in isolation, and users demand rich experiences across all platforms and devices.

## How an API-First Approach Affects Your Bottom Line

The issue of API-first architecture can seem abstract from a business point of view, especially since APIs are designed to be unobtrusive rather than flashy. But focusing on APIs can have a direct impact on your business in the form of improved customer experiences, decreased development costs, and a better, more innovative product.

### Faster Time to Market

An API-first architecture speeds up the development process because APIs are modular and reusable. Your in-house team doesn’t have to code every functionality from scratch or try to integrate two fundamentally different applications. Instead, they start with integration in mind and work from there. APIs help facilitate the use of microservices, which are standalone features you can plug into any application.

Once the new API is built or purchased, your front-end and back-end teams can work on their own parts of the application simultaneously, instead of waiting on each other. That’s because these features don’t all have to build on one another; they just have to plug into the same API.

Faster time to market is a huge competitive advantage for most companies, so saving development time means huge financial benefits. That holds true whether your team is building an API or purchasing a third-party one. For example, [Auth0’s customers](https://auth0.com/customers/) regularly report releasing weeks or months earlier than they would have if they’d attempted to code their own identity solution in-house.

### Improved Customer Experience

API-first development started gaining traction when developers wanted to create fully functional user interfaces on mobile devices. API-first and mobile-first are interconnected design principles based on users’ desire to have rich, omnichannel experiences.

APIs improve CX by reducing friction, like social logins, a Google Calendar integration, so users don’t forget appointments or a Stripe integration that saves users from having to enter their payment information to make a purchase. APIs seamlessly connect different tools, which enables delightful user experiences.

As [Segment said](https://segment.com/blog/why-we-re-transitioning-to-api-first/) when they announced their transition to API-first, “In this networked world, customer experience is the only true competitive advantage.”

### More Adaptable, Innovative Products

API-first architecture opens the door to innovation by making it easier for your developers to add new functionalities and easier for outside applications to embed your services. For instance, [_HBR reports_](https://hbr.org/2015/01/the-strategic-value-of-apis) that when Walgreens opened its photo-printing services to third-party APIs&mdash;allowing customers to print photos from their phones or social media accounts&mdash;it earned six times more revenue per customer for digital users than for in-person users.

![value_of_api-first-separator](https://images.ctfassets.net/23aumh6u8s0i/1hLQoWjegBsHbP6vt4gPkq/8218f9cda487106ab0aa43a42457a06e/value_of_api-first-separator)

## Success Stories of API-First Companies

Many of the biggest Software-as-a-Service (SaaS) names in this generation of tech are API-first companies. Stripe, Plaid, and Segment have all earned valuations of over a billion dollars with API-first platforms.

For many of these companies, the API itself is the product. Take the example of Twilio, an early leader in the API-first movement. Twilio’s product is an API that integrates phone capabilities into apps like Uber, which, by all accounts, was a nightmarishly difficult challenge for many developers. Then Twilio CEO, [Jeff Lawson, made his pitch to investors](https://avc.com/2016/06/best-seed-pitch-ever/), saying, “We have taken the entire messy and complex world of telephony and reduced it to five API calls.”

That concept was an immediate hit. To quote the [ReadMe blog](https://blog.readme.com/on-the-origins-of-api-first-companies/): “The ability to outsource a small functionality was a game-changer for tech startups that wouldn’t have been able to build out the software on their own. Companies like GroupMe, Lyft, and Shopify were only able to take off because they no longer had this huge technical barrier keeping them from building the product they dreamed of.”

Of course, Auth0 itself is another example of a company that [achieved unicorn status](https://auth0.com/blog/so-you-want-to-be-a-unicorn/) on the strength of its API. Like any Identity-as-a-Service (IDaaS) platform, when you purchase Auth0, you’re purchasing access to our APIs, which facilitate transactions between users logging in and the databases that hold information about them.

## You Can Try API-First, No Matter Your Company’s Stage

If you’re thinking, “Wow, I’m sold on this whole API-first development idea, but I can’t afford to overhaul all my systems,” you can breathe easy. Transitioning to an API-first approach doesn’t require refactoring your existing applications. It just means embracing a different mindset going forward.

As [McKinsey](https://www.mckinsey.com/business-functions/mckinsey-digital/our-insights/what-it-really-takes-to-capture-the-value-of-apis) noted in their report on APIs, “Value doesn’t need to come from creating something new. Businesses can also use APIs to improve functionality or add new features to existing products and services.”

The beauty of API-first design is that it allows developers to play and experiment—often with open-source software—so you can get an idea of what APIs will provide the biggest ROI. Want to learn more about Auth0’s approach to API-first or let your team try our tool? [Contact us](http://auth0.com/contact-us) today.

<include src="asides/AboutAuth0" />


The Business Value of API-First Design

How to tell if your business at risk of user impersonation and what to do about it



Broken authentication is an umbrella term for several vulnerabilities that attackers exploit to impersonate legitimate users online. Broadly, broken authentication refers to weaknesses in two areas: session management and credential management. Both are classified as broken authentication because attackers can use either avenue to masquerade as a user: hijacked session IDs or stolen login credentials.

Attackers employ a wide variety of strategies to take advantage of these weaknesses, ranging from huge [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) to highly targeted schemes aimed at gaining access to a specific person’s credentials.

In recent years, broken authentication attacks have accounted for many of the [worst data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/), and security experts sound the alarm about this underrecognized threat. The [Open Web Application Security Project (OWASP)](https://owasp.org/www-project-top-ten/) has included it in its “Top 10” list of the biggest web application security risks since 2017. By 2020, broken authentication had climbed to the number two spot.

Below, we’ll explain what weaknesses are associated with broken authentication and how businesses can guard against them.

<include src="ebook-ads/BrokenAuthChecklist" />

## Session Management Flaws Open the Door to Attacks

Session management is part of broken authentication, but the two terms are often listed side by side so people don't assume that “authentication” refers only to usernames and passwords. Since web applications use sessions and credentials to identify individual users, attackers can impersonate them using either mechanism.

### Session Management Basics

A [web session](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) is a sequence of network transactions associated to the same user within a period of time. Let’s say you go to a social media website and browse for a while before logging in to your account. You find an interesting post where you want to comment, which requires you to log in. Once you leave a few comments, you log out and close the web browser window or tab. Everything you did from the moment you arrived to the website was a session. Web applications can track sessions before and after authentication.

Web applications issue every user a unique session ID for each visit, which allows the web app to communicate with the user as they move through the site. These [session IDs commonly take the form of cookies and URL parameters](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-management-implementation).

Session management concerns how you define the parameters of that session. For instance, how long can a session last before you automatically log a user out? How do you issue and revoke session IDs? How securely are they linked to a user’s IP address?

> Auth0’s long-lived sessions can help you improve user experience and reduce password reset costs. [Learn how to balance user experience and security to retain customers](https://auth0.com/blog/balance-user-experience-and-security-to-retain-customers/).

It's important to note that a user establishes an authenticated session with the web application once the user logs in. Consequently, OWASP states that the session ID of an authenticated session is temporarily equivalent to the strongest authentication method used by the application, such as username and password. **A hijacked session ID is as strong as a stolen login credential**.

### Session Management Attacks

#### Session Hijacking

Without appropriate safeguards, web applications are vulnerable to [session hijacking](https://auth0.com/blog/developers-guide-to-common-vulnerabilities-and-how-to-prevent-them/), in which attackers use stolen session IDs to impersonate users’ identities. The most straightforward example of session hijacking is a user who forgets to log out of an application and then walks away from their device. A hacker can then continue their session.

#### Session ID URL Rewriting

Another common avenue for session hijacking is “URL rewriting.” In this scenario, an individual’s session ID appears in the URL of a website. Anyone who can see it (such as via an unsecured Wi-Fi connection) can piggyback into the session. This is how [Zoombombing](https://www.cnet.com/how-to/how-to-prevent-zoombombing-in-your-video-chats-in-4-easy-steps/) happened.

#### Session Fixation

One commonly overlooked best practice is to rotate session IDs after a user logs in, instead of giving a user the same ID before and after authentication. Web applications that fail to do this are vulnerable to a [session fixation](https://owasp.org/www-community/attacks/Session_fixation) attack, which is a variation of session hijacking.

According to [Troy Hunt](https://www.troyhunt.com/learn-ethical-hacking-and-session/), the main idea behind a session fixation attack is that the attacker _predetermines_ the session ID the victim will use. The attacker then may send the victim a link that contains the predetermined session ID. The link will point to a resource that requires the victim to log in.

If the web application persists the authentication state of the victim in the session, the attacker can use that predetermined session ID to impersonate the victim after the victim logs in. Whether the attacker or the victim present that session ID to the server, the server will establish that the session ID corresponds to an authenticated session and grant access to protected resources.

Developers can prevent the attacker from following the victim by making the web application issue the legitimate user a new session ID after logging in. When the web application rotates the session ID, the predetermined session ID becomes useless.

![Hackers](https://images.ctfassets.net/23aumh6u8s0i/15UY9ZPvcKOsqy9pM078pc/65fe774d42beeaa18fb8ebb418810739/WhatIs_Broken_Auth_sep-1)

## Attackers Exploit Weak and Compromised Credentials

In recent years, attackers have discovered that the easiest way to access off-limits systems is to log in with someone else’s credentials. According to [Verizon’s 2020 Data Breach Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf), phishing and using stolen credentials are now the two most common mechanisms to execute a data breach. They report that “hacking and even breaches in general... are driven by credential theft.”

Malicious actors use various methods to steal, guess, or trick users into revealing their passwords.

#### Credential Stuffing

When attackers access a database filled with unencrypted emails and passwords, they frequently sell or give away the list for other attackers to use. These attackers then use botnets for brute-force attacks that test credentials stolen from one site on different accounts. This tactic often works because people frequently use the same password across applications. 

![Credential Stuffing](https://images.ctfassets.net/23aumh6u8s0i/aklnhl37XxWkoCKLY0OTK/e5874c9f07ef7e4b7f5d7ceb6b220bc1/anatomy-credential-stuffing)

There are currently billions of compromised credentials available to attackers. Most of the time, users don’t even know that the password they’ve been using since high school just became a skeleton key for all their accounts.

#### Password Spraying

Password spraying is a little like credential stuffing, but instead of working off a database of stolen passwords, it uses a set of weak or common passwords to break into a user’s account. A [2019 survey by the UK's National Cyber Security Centre (NCSC)](https://www.cnn.com/2019/04/22/uk/most-common-passwords-scli-gbr-intl/index.html) found that 23.2 million accounts used “123456” as their password, while millions more used sports names, curse words, and the ever-popular “password".

Password spraying is a type of brute-force attack, but it often slips by automatic lockouts that block IP addresses after too many failed login attempts. It does this by trying the same password, one user at a time, rather than trying password after password on a single user.

#### Phishing Attacks

Attackers typically [phish](https://auth0.com/blog/phishing-goes-viral-covid-19-themes-in-cybercrime/) by sending users an email pretending to be from a trusted source and then tricking users into sharing their credentials or other related information. It can be a broad-based attempt that hits everyone at an organization with the same phony email, or it can take the form of a “spear phishing” attack tailored to a specific target.

Spear phishing can be particularly useful to attackers. They can use that attack technique to manipulate someone’s emotions based on their personal information. For example, an email with the subject line “pictures of your sister” is much more effective if it mentions your sister’s name.

[The 2020 CrowdStrike Services Report](https://www.crowdstrike.com/blog/2019-services-report-key-findings-part-1/) found that 35% of successful network breaches started with a spear phishing attack in 2019. Attackers had different mechanism to lure their victims through spear phishing: 19% used attachments, 15% included a malicious link, and 1% employed spear phishing via a service.

By now, most organizations are familiar with phishing attacks and warn their customers not to open suspicious emails. Despite that, the [2017 Phishing Resiliency and Defense Report by Cofense](https://cofense.com/phishing-resiliency-%20report-2017/) found that “organizational susceptibility” to phishing was still around 5%. If you have 20 employees, one of them might still click a phishing email.

## How to Fix Broken Authentication in Your Organization

Broken authentication attacks are devastating and common, but they are also highly preventable. By putting a few safeguards in place, you can make your organization a much less appealing target for attackers.

### Update Session Management

#### Control Session Length
Every web application automatically ends sessions at some point, either after logout, a period of no activity, or a certain length of time. Tailor your session length to the type of user and the application they’re using.

A streaming-video service might want their sessions to be weeks long, so users can navigate straight to Netflix without having to log in every time. But a banking app should automatically log users out after a few minutes since the risk of a hijacked session is much higher.

#### Rotate and Invalidate Session IDs
As we discussed, the best way to prevent session fixation is to issue a user with a new session ID after login. Similarly, sessions and authentication tokens must be immediately invalidated after a session ends, so attackers can’t reuse them.

#### Don’t Put Session IDs in URLs
There are so many ways that URL rewriting can end up exposing session IDs, so your safest bet is not to go that route. Use cookies generated by a secure session manager.

![Scare_Off_Hackers](https://images.ctfassets.net/23aumh6u8s0i/3Cu6Hhk4uxBk10a168mv7g/b7d9b0fcd37582dd087327574361ff8b/WhatIs_Broken_Auth_sep-2)

### Tighten Password Policies

#### Implement Multi-Factor Authentication (MFA)

[OWASP’s number one tip](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A2-Broken_Authentication) for fixing broken authentication is to “implement multi-factor authentication to prevent automated, credential stuffing, brute force, and stolen credential reuse attacks.”

Given how vulnerable passwords are to credential stuffing and password spraying, it’s clear that they are no longer adequate to secure an account. MFA provides an extra level of security by demanding an additional credential that’s harder for attackers to fake, such as a biometric scan or one-time code.

#### Don’t Permit Weak Passwords

When designing your application’s login page, OWASP recommends following [NIST guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret) on password length and complexity. They also advise automatically rejecting any of the most common passwords on the web.

Use an identity and access management (IAM) platform that helps you create and implement a password strategy easily. The platform should also provide you with login and signup pages with forms that enforce your password policies. [Auth0 Universal Login](https://auth0.com/universal-login) offers you that secure login infrastructure to authenticate your users to your apps.

#### Don’t Store Passwords in Cleartext

A strong password storage strategy is critical to mitigate data breaches that put the reputation of any organization in danger. Hashing is the foundation of secure password storage. The [premise of hashing is simple](https://auth0.com/blog/how-secure-are-encryption-hashing-encoding-and-obfuscation/#What-is-Hashing-): given arbitrary input, output a random string of a specific length.

What's important to highlight is that the hashing operation is irreversible. An attacker cannot determine the original password by looking at the hashed password. However, if two users choose the same password, the hash will be the same. You can add random data to the password to guarantee that the output of the hashing process is unique. [This random data is known as a "salt"](https://auth0.com/blog/adding-salt-to-hashing-a-better-way-to-store-passwords/).

Due to the properties of hashing mentioned above, you don't need to encrypt the hashed password before you store it in the database. [When a user attempts to log in](https://docs.oracle.com/cd/E26180_01/Platform.94/ATGPersProgGuide/html/s0506passwordhashing01.html), your web application uses the supplied password as input to a hashing function and compares the output to the database value. If the password hashes match, the login is successful.
 
Hashing with salts can protect you against different attack vectors, such as rainbow table attacks, while slowing down dictionary and brute-force attacks. 

Use an identity and access management (IAM) platform that helps you prevent critical identity data from falling into the wrong hands. Auth0 never stores passwords in cleartext. Passwords are always hashed and salted using [bcrypt](https://auth0.com/blog/hashing-in-action-understanding-bcrypt/), an industry-grade and battle-tested algorithm. Additionally, Auth0 encrypts both data at rest and in motion. All network communication uses TLS with at least 128-bit AES encryption. Auth0 built state-of-the-art security into its platform to protect your business and your users.

#### Use Breached Password Protection

Use an identity and access management (IAM) platform with [breached password protection](https://auth0.com/docs/anomaly-detection/references/breached-password-detection-triggers-actions). When the platform discovers a compromised credentials cache, it will notify you if any of your users were compromised. Those users will be locked out until they change their passwords, so attackers can't use their compromised passwords against you in a credential stuffing attack.

### Guard Against Attacks

#### Conduct Workplace Phishing Training

Teaching your workforce how to spot malicious emails is a project you must take seriously and update frequently. As phishing attacks get more sophisticated, they become harder to spot, and the only way to combat this threat is to keep your staff informed.

#### Implement Brute-Force Protection

Attacks involving broken authentication can compromise not only your data but also crash your site. [Traffic can spike by 180x](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) during a credential stuffing attack, so brute-force protection is an absolute must to stay online. It works by limiting the number of times a specific IP address can attempt to log in, so bots can’t flood your system.

#### Employ anomaly detection

A sophisticated IAM system doesn’t look at just logins and session IDs to determine whether a user is legitimate or malicious. It should also flag other types of suspicious behavior. [Anomaly detection](https://auth0.com/docs/anomaly-detection) will alert you if, for instance, an employee logs off at 10 p.m. in North America and logs back on at 3 a.m. in Bangladesh.

## Address Broken Authentication, Discourage Attackers

Web applications will become more attractive to attackers as companies move more valuable and sensitive data to the cloud. Broken authentication has made it relatively easy for motivated attackers to slip by because even companies with big security budgets often overlook these basic security flaws. It’s a little like barring every window in your home while leaving the front door wide open.

Fortunately, you can deter attackers by putting the protocols we’ve discussed in place. To quote Verizon’s report: “Attackers prefer short paths and rarely attempt long paths. It means anything you can easily throw in their way to increase the number of actions they have to take is likely to decrease their chance of fleeing with the data significantly.”

To learn about how a dedicated IAM platform can help you address broken authentication, [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=reach%20out%20to%20the%20team%20at%20auth0).

<include src="asides/AboutAuth0" />


What Is Broken Authentication?

angela-devlin

Program manager focused on all things self service at Auth0. I am passionate about making Auth0 the very best user experience for all of our customers. In my free time, I’m with my husband and two daughters at the park, hanging out with my adorable old cat or heads down working on my MBA.

Program Manager, Self Service

Angela Devlin

How using Auth0 can solve your startup's authorization and identity needs.



As an Identity Platform, we believe it is especially critical for young startups to determine their identity solution and implement it right from the start, to avoid complications and extra work down the road. Auth0 has always been dedicated to innovation by offering simple authorization and identity solutions to developers, so you can focus on what matters most to you. We are also dedicated to equality and want to level the playing field by making our services easily accessible to minority founders and companies that may run into specific challenges during their first steps as a business. To help you with your awesome new ideas, **we are now offering our startup plan free for a year** to anyone that meets the following criteria:

* Your startup must be under two years old.
* Your startup must be venture-backed and with less than $2M of funding.
* Your startup must have less than $1M in revenue.

Auth0 can help you by handling your business critical identity processes, providing a seamless and safe login experience. Auth0 is also compliant with end user data requirements, GDPR, HIPPA, and more; we can help you stay compliant as your business and identity needs grow. 

_"We are a privacy-first company. Knowing that Auth0 is GDPR compliant was a big factor in our decision to expand our partnership. It goes without saying; we feel very secure."_ Itay Flikier, Engineering Team Leader at Otonomo.

Auth0 is an industry leader in simplicity, control, and extensibility. We know how much time you need to spend on your core business, especially in the early stages, and want to take care of your identity needs, so you can focus on what is most important. We also know that as a new startup, you will be concerned with saving money. While our customers see significant cost and time savings using Auth0, the startup program will be provided to you for free for a full year, so you don't have to worry about that either.

_"If we didn't have Auth0, we'd probably need seven or eight developers focused on [identity]. Our teams now can spend much more time working on the improvements that our customers actually see and care about. Not having to spend time on means that we get to spend time on everything else."_ Chris Hood, CT, and Co-Founder at GO1.

Auth0 safeguards billions of transactions each month, let us help you with yours.

Sign up at [https://auth0.com/startups/](https://auth0.com/startups/)


Auth0 Startup Plan Now Free for Everyone

The trends defining the year and how businesses can protect themselves

"business"