Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
 
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
 
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

Auth0 and Google Cloud are partnering to secure AI agent communication with the new Agent2Agent (A2A) protocol, ensuring robust authentication for the next generation of AI interactions.

Production-ready AI agents need to be secure, and auth is a big part of security. Auth0 is partnering with [Google Cloud](https://cloud.google.com/?hl=en) to help deliver secure authentication for the [Agent2Agent (A2A) protocol](https://developers.googleblog.com/en/a2a-a-new-era-of-agent-interoperability/).

### What is the Agent2Agent protocol?
Agent2Agent (or A2A) is a new open interoperability protocol created by Google Cloud, and launched a month ago, with support and contributions from 60+ companies.

It aims to allow agents to communicate with other agents regardless of their implementation framework or tech stack. For example, a “client” agent should be able to communicate with server agents implemented with LangGraph, Google ADK, Vercel AI SDK, any other agentic framework or any agent implemented without one.

![](https://images.ctfassets.net/23aumh6u8s0i/6qm1UcMBH6arg4ynuBUBMJ/7c7c8117381a56dcd90117deea2fddbb/img_01.png)

### Why is auth important for AI agents?
As companies and developers deploy AI agents into production, interactions between these agents will be common. And naturally, these interactions need to be secure.

We can say that each AI agent can act as a client (when requesting data from other AI agents) and as a server (when responding to data requests from other AI agents).
![](https://images.ctfassets.net/23aumh6u8s0i/5Ku1FadhT8Jqg8EZ9PaiRG/a52b5ed2985a1e1b76cef7052602ff58/img_02.png)

So we end up with some auth-related questions to be answered. These matters are important when implementing any system, and agentic systems are no exception. But there are also a few questions that become more prevalent with the rise of AI agents:

- **Authentication:** How does the server agent know who is trying to perform an action?
- **Delegation:** Is the agent acting on its behalf, or on behalf of a user?
- **Consent:** If the client is acting on behalf of a user, how does the user consent to this operation?
- **Authorization:** How does the server agent know if the caller can perform the action (e.g. call a specific tool)? If the client is acting on behalf of a user, is the user authorized to perform this action?
- **Auth for headless agents (agents without a UI):** How should AI agents without a UI authenticate users?
- **Fine-grained authorization:** How do we ensure AI agents only have the permissions they need to perform their task, and not more?

### What are we partnering on?
A2A is being designed to support enterprise-grade authentication and authorization from day one. This means the protocol should be able to provide good answers to those questions and support all of those scenarios in multi-agent systems built with A2A.

We are working with Google Cloud to define A2A auth specs based on secure standards, and build SDKs and code samples that showcase A2A auth capabilities. This will include how to integrate A2A with [Auth0](https://auth0.com/) and our new product [Auth for GenAI](https://auth0.com/ai), providing both great security and great auth user experiences.

### How does auth work in A2A?
Agents expose how they operate via [Agent Cards](https://google.github.io/A2A/topics/key-concepts/#fundamental-communication-elements), which include what they can do, how they can communicate (e.g. support streaming?), and how clients should authenticate to them following the [OpenAPI spec](https://github.com/google/A2A/pull/359). Clients use the Agent Card to discover agents and understand how to interact with them.

For example, this agent card defines an HR agent that can receive an email and reply if a person works at a company or not. Clients can authenticate by obtaining an access token via a [client credentials](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow) OAuth flow and then providing the token to the agent to authenticate.

```python
AgentCard(
 name='Staff0 HR Agent',
 description='This agent handles external verification requests about Staff0 employees made by third parties.',
 url=f'http://{host}:{port}/',
 version='1.0.0',
 defaultInputModes=HRAgent.SUPPORTED_CONTENT_TYPES,
 defaultOutputModes=HRAgent.SUPPORTED_CONTENT_TYPES,
 capabilities=AgentCapabilities(streaming=True),
 skills=[
 AgentSkill(
 id='is_active_employee',
 name='Check Employment Status Tool',
 description='Confirm whether a person is an active employee of the company.',
 tags=['employment status'],
 examples=[
 'Does John Doe with email jdoe@staff0.com work at Staff0?'
 ],
 )
 ],
 authentication=AgentAuthentication(schemes=['public']),
 securitySchemes={
 'oauth2_m2m_client': OAuth2SecurityScheme(
 description='',
 flows=OAuthFlows(
 authorizationCode=ClientCredentialsOAuthFlow(
 tokenUrl=f'https://{os.getenv("HR_AUTH0_DOMAIN")}/oauth/token',
 scopes={
 'read:employee_status': 'Allows confirming whether a person is an active employee of the company.',
 },
 ),
 ),
 ),
 },
 security=[{
 'oauth2_m2m_client': [
 'read:employee_status',
 ],
 }],
)
```

One thing we have also been exploring with the Google Cloud team is how agents that don't have a UI (“headless agents”) should authenticate users. For these scenarios we believe the [Client Initiated Backchannel Authentication (CIBA)](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html) flow will be a very valuable tool for developers and architects. CIBA is an OpenID Connect flow that does not rely on redirects in the user's browser. Instead, Agents can reach out to users outside via push notification, email, SMS, etc. for them to authenticate. To give you an idea about what CIBA provides from a security standpoint, it can also be used to meet the strong auth requirements of FAPI for financial transactions.

### A working sample
Enough chat, let's see some working [code](https://github.com/google/A2A/tree/main/samples/python/agents/headless_agent_auth) :) We've worked with the Google Cloud A2A team to build a demo showcasing these capabilities. Imagine a scenario where:
 
1. John Doe, who works at Staff0 wants to open a bank account by talking to a chatbot agent
2. Because of internal policies, the bank agent needs to verify that the user is an employee at Staff0, so it contacts the Staff0 HR agent.
3. The Staff0 HR agent can use the Staff0 HR API to check if the user is an employee or not.

For example, it could result in an application flow like this:
<AmpContent>
<amp-youtube
 data-videoid="X22XNlRnHZU"
 layout="responsive"
 width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<iframe class="vidyard_iframe" title="Auth0 + Google A2A & ADK sample" src="//play.vidyard.com/utu4caQfTCBHbbnXDaWo9a.html?" width="640" height="360" scrolling="no" frameborder="0" allowtransparency="true" allowfullscreen referrerpolicy="no-referrer-when-downgrade"></iframe>
</NonAmpContent> 

To make it simple to run such a sample, we uploaded it to the A2A repo here. The sample A2A client plays the part of the Bank Agent. When you run the demo, this is what happens behind the scenes:
![](https://images.ctfassets.net/23aumh6u8s0i/417VrO2pWfdEVy3TkATSS5/090672e74f0c822ae90dad8182c4cebe/img_03.png)

### Closing thoughts
At Auth0 we believe AI has the potential to radically reshape software in general and identity in particular. We believe there will be an explosion in AI agents (non-human identities), which requires more security, finer grained access control and support for various delegation scenarios. 

We look forward to continuing our collaboration with Google Cloud, and helping builders secure their AI agents, both by contributing to AI protocols (e.g. MCP, A2A), new capabilities of [Auth for GenAI](https://auth0.ai), and developing new products and features that enable an AI powered world.

[Duplicate] Secure A2A authentication with Auth0 and Google Cloud

alisa-duncan

Alisa Duncan is a Senior Developer Advocate at Okta, a full-stack developer, and a community builder who loves the thrill of learning new things. She is a Google Developer Expert in Angular and organizes coding workshops and community events locally and internationally. Her background is primarily working on enterprise software platforms, and she is a fan of all things TypeScript and JavaScript.

Senior Developer Advocate

Alisa Duncan

OAuth 2.0 provides a more secure model than API keys for machine-to-machine communication. Learn why.

Why You Should Migrate to OAuth 2.0 From API Keys

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Giving your customers good news can make it less likely you’ll have to give them bad news later.

Which sounds more like an email opener you’d like to write, this one:

> “_Dear customers, we’ve had a data breach, and your personal information was part of it._”

Or this one:

> “_Dear customers, another year with no data breaches! Here’s how we’re keeping your personal information private and secure._”

That’s what we thought.

The global COVID-19 pandemic didn’t cause data breaches. What it did was cause companies to realize how easily lackluster security protocols and slack remote work policies could lead to their proprietary and customer information being compromised. In fact, [nearly a third of companies](https://www.ibm.com/downloads/cas/QMXVZX6R?lnk=STW_IN_CLP_L1_TL&psrc=OPT&pexp=mob&lnk2=ar_DataBreach) will be subject to a breach sometime in the coming two years. 

The pandemic is also making people feel increasingly cut off from the world they once knew, so any communication received can have an exponential impact. And with privacy matters all over the 24/7 news feed, communication from your company that discusses the measures you’re taking to protect your customers is likely to be quite well received.

While you and your teams are hard at work locking down the [perimeter](https://auth0.com/resources/whitepapers/identity-perimeter), ensuring that remote workers are using proper security etiquette, and enabling everyone to access the resources they need when they need them &mdash; remember you’re not in a vacuum. Your customers would love to know of the steps you’re taking to ensure their private information stays private. And think of the boost to your company’s reputation when these customers tell their friends and family about the heart-felt email they just received from your CIO, telling them about the newest round of measures you deployed.

![Before You Write, Plan Out Your Campaign](https://images.ctfassets.net/23aumh6u8s0i/4SX1MxqNAsTuOPhOz97y6W/80440070b08e62080d90bcb0ef9f5d8b/breach-prevention-sep01)
 

## Before You Write, Plan Out Your Campaign

Any PR firm will tell you that it’s not just what you say but how you say it that matters. And any psychologist will tell you the same thing. They would also likely agree that when you have a lot of information to impart to your audience, they stand a better chance of internalizing more of it if you mete it out in easily digestible, bite-sized snippets.

Sit down with your security teams. Talk about what steps they’re taking, have taken in the recent past, and have on the books in the coming days/weeks/etc. See what metrics they’re using to monitor progress and what their workflow looks like. Take it all in. And take notes.

Then, back at your desk, parse what you just learned. Translate the technical jargon into plain language. Be sure you’ve got answers to all of the six W’s: Who, What, When, Where, Why, and How. Decide which pieces of information you gathered are appropriate for public consumption and which are better kept internal (there is such a thing as too much information, after all).

Now, work with your marketing and/or PR team to craft your communication campaign. Mix it up, with some information going out over each of the channels you know your customers are using blog posts, videos on YouTube, think-pieces for LinkedIn, sound-bites on Instagram Stories, and memorable one-liners for Twitter. Your customers are everywhere, consuming content via multiple channels throughout the day, and you don’t want to miss any of them.

## Internal vs. External Communication About Data Breaches

Our focus here is on how you talk with your customers about data breaches. We would be remiss; however, if we didn’t give passing attention to the other population, you need to be in contact with on this important subject, your employees. A recent Ponemon Institute study showed that [24% of breaches](https://www.centrify.com/media/4737054/ponemon_data_breach_impact_study.pdf) are caused by human error on the part of employees or contractors. That should be a wake-up call. Training is crucial to preventing such attacks.

The most prevalent root cause of human error in this context are phishing emails and other forms of social engineering. Verizon’s annual Data Breach Investigations Report (DBIR) has consistently shown that phishing scams account for [~90% of breach root causes](https://enterprise.verizon.com/resources/reports/dbir/#report). User training is the most effective way to [combat phishing attacks](https://auth0.com/blog/protecting-against-phishing-attacks/) by teaching people what to look for and how to proceed when they fear they may be being phished. There are further options as well; for example, some IAM solutions include [automated anti-phishing](https://auth0.com/blog/how-auth0-automates-phishing-response/) measures that are easy to implement and can dramatically reduce the efficacy of such attack vectors. As you can see, there is some overlap in what you’re communicating, but the language and specifics will change depending on your audience.

## 3 Keys to Successfully Communicating With Your Customers About Data Breaches

As with any written content, voice matters; along with determining the best channels to use in your information campaign, you’ll need to set the right tone as mentioned above while staying in brand voice. With sensitive yet technical information like data breach protection activities, word choice will also be a crucial piece of the puzzle to focus on. There are three primary factors you need to remember when crafting this content: transparency, concision, and empathy.

### Be transparent

Chances are you’ve been busy implementing detailed data protection measures. Some of these measures are likely things your customers will have heard of, like multi-factor authentication, malware protection, and even encryption is part of the lexicon these days. Keeping your customers in the know about the steps you’re taking in these areas will increase their goodwill toward you and the company.

At the same time, there are likely other steps, things like moving to a componentized infrastructure framework, automating IAM, and implementing a bug bounty program that would only serve to confuse the matter in their minds. Not to mention that making things like a bug bounty program public can raise concerns in those who aren’t aware of the beneficial nature of these programs.

So while you want to be transparent about your data security plan, you need to remain cognizant of the line between sharing enough and sharing too much. 

### Be concise

There are two parts to this suggestion. The first is precisely what it sounds like — don’t fluff it up. Data breaches are a subject that most people don’t want to know too much about, while at the same time understanding that they do need to know something. Presenting your content using concise language, without lengthy explanations or paragraphs full of flowery language, will show your audience that you know what you’re talking about and that you value their time.

The second part of being concise is knowing your audience. It’s only in knowing who you’re writing for that you can choose the right words to convey your message so that they’ll both understand and recognize your expertise in the subject. Use too many technical words or acronyms, and they’ll lose focus. Use kindergarten-level language, and they’ll feel you’re talking down to them. Finding the right balance is something that takes experience but is absolutely worth investing the time in.

### Be empathetic

Empathy is something that seems to be lacking in much of the technical communication going around these days. Emotionless jargon isn’t going to engender the trust and confidence you want your customers to have. Sensory language, words that make them feel you truly know where they are and how they feel, that’s what you want to use. Personalize your communications; use the words “I,” “we,” and “you.” Official business communication guidelines will say to the contrary that you should never use these words, but you need your content to resonate on a personal level, and for that to work, you need to connect on that personal level.

Tell your readers a story, the story of how you understand their concerns about data privacy and everything your awesome company is doing to ensure that their information doesn’t end up in the hands of some malicious actor. Use anecdotes include stories from your own life if applicable, and most of all, be empathetic. Powerful, evocative language helps here. Malicious, contempt, fervor, resolute, steadfast; these words evoke strong imagery for most people, and that’s exactly what you’re going for. You want your audience to see that on a deep, personal level, you get it. 

![3 Keys to Successfully Communicating With Your Customers About Data Breaches](https://images.ctfassets.net/23aumh6u8s0i/oHFerhauBupFwdc9RM1xk/2df76607817ce8aabc7f11c2bb71efa7/breach-prevention-sep02)
 

## Summary

It’s a fact of our 21st-century connected world that data breaches happen. The COVID-19 pandemic has accelerated the timeline for companies to get their infrastructure up to scratch and seal the holes in their permeable perimeters. Now is not the time to rest on your stellar track record of zero breaches in the past two years. Rather now is the time to be working full-tilt to ensure that the track record continues into the foreseeable future and beyond.

Build your perimeter and communicate with your users to instill the trust they’re looking for and that you need in order to continue growing. Remember how you reacted to those two potential email opening lines in the intro. Which one do you think your users would rather get next week?

[Get in touch with Auth0 today](https://auth0.com/contact-us) to start the conversation.

<include src="asides/AboutAuth0" />

How to Talk About Breach Prevention With Your Customers

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Companies of all sizes are pivoting quickly to remote work. Here are seven lessons from our remote-friendly culture


Due to recent events, hundreds of thousands of people globally have found themselves having to work from home. But what happens when someone now finds themselves out of their daily routine, without structure, and alienated from a lack of social interaction?

Auth0 has been a remote company from Day 1, with our two founders starting the company seven years ago while living in the USA and Argentina. We grew and scaled our workforce by hiring people from all around the world. Below are the key lessons for employers and employees to smooth the transition to remote working.

## 7 Lessons for Successful Remote Working


### Lesson 1: Trust Your Peers

There are two essential components for the success of remote working. Trust is one of them — when you can't work next to each other, trust becomes primordial. You have to trust your peers will continue to give their best while working from home,  that they are doing what they say they are doing, and will deliver quality work on time.

Trust will empower them to thrive.

### Lesson 2: Clear Communication

Communication is the other essential component. Without face-to-face interactions, ensuring clear, constant, and transparent communication is of utmost importance. Maintain regular communications with your peers, whether it's via chat or video, by setting up weekly syncs, 1:1s, or brainstorm sessions.

Tools play a key role in making this an enjoyable and efficient experience. There are plenty of options, but our communications trifecta is [Slack](https://slack.com/), [Zoom](https://zoom.us/), and [Confluence](https://www.atlassian.com/software/confluence) for chat, video, and documentation. We also use [Mural](https://mural.co/) for whiteboarding, [Figma](https://www.figma.com/) for real-time collaboration between our designers, and [Lattice](https://lattice.com/) for feedback, surveys, and 1:1 conversations, just to name a few more.

![The important of clear and constant communication when remote working](https://images.ctfassets.net/23aumh6u8s0i/1a1S0WICPdXHF78I3S3ysT/23b698a239d8a43d7d800794cae2620f/0_hero)

### Lesson 3: Respect Others' Time

Meetings can be tempting when working remotely (it's an opportunity to see a face!) but think twice before scheduling one. Ask yourself, can this be managed via message/email or maybe even a short video call? If yes, then there is no need to schedule a meeting. The meeting is needed? Ok, but make sure to set up an agenda and respect the starting and ending times.

Don't expect instant responses from colleagues. Your messages/emails don't have to be answered instantly. Everyone needs time to focus on their projects, so take into account that your requests can't be answered right away and learn to respect the 'Do Not Disturb' status.

### Lesson 4: Manage Your Time

Making the switch to remote is not easy and can have an impact on your productivity, but many things can help:

* Start by organizing your day — structure is key.
* To-Do lists are your friend.
* Plan in advance.
* Implement a time management technique — we recommend the [Pomodoro technique](https://en.wikipedia.org/wiki/Pomodoro_Technique).
* Block your calendar with focus sessions.
* Setup the don't disturb status.

### Lesson 5: WorkSpace

"It will be amazing to work from my bed or couch" is a common first thought when starting to work from home. Although the idea is very tempting, having a dedicated space for working is essential.

It doesn't have to be a fancy office with 3 screens and full of gadgets, it's about having a space that suits you, where you feel relaxed and happy, and which enables you to focus and set your creativity free.

Tips to set up a quick workspace: find a space in your house close to the internet (you don't want to lose connection during a video call) where you can work without disruptions, take your most comfortable chair and desk, order nice headphones, and you are ready to work.

### Lesson 6: Work-Life Balance

Working from home can blur the lines that divide personal and professional time. The most important thing is to set up boundaries by implementing office hours. Forget about the typical 9-5 (you are free from that), but choose what suits you best. The important thing is to divide your two lives.

Remember to take breaks during your office hours. Taking breaks doesn't come as easy when working from home, but they are important for your mental health and productivity. Try planning and scheduling your breaks in advance and most importantly: *get away from your desk*.

Another big one is exercise. Sedentarism is one of the few cons of remote working, but there are plenty of great routines you can do right there in your house.

Now you can't justify not doing exercise because of the lack of time... you have hours free because you are not commuting anymore.

![7 lessons from beignn remote working for 7 years](https://images.ctfassets.net/23aumh6u8s0i/1823ottXfMNiYotVUDWb32/8b1944d65d45be3594d1f386ddbfb79f/culture2)

### Lesson 7: Don't Overlook Security

The sudden growth of remote working comes with an increase of cybersecurity challenges: new devices to be hacked, networks to be probed, credentials to be stolen, and targeted phishing attempts, to name just a few

Here are 3 tips that can help overcome these challenges:

- *Cybersecurity Guidance*: education is the main way to overcome these challenges. Educate your organization about security by creating best practices guides and setting up training sessions.

- *Single Sign-On*: reduce password fatigue, mitigate credential theft, and make life easy for everyone by [setting up Single Sign-On](https://auth0.com/single-sign-on).

- *Multi-factor Authentication (MFA)*: the much needed extra layer of security. [Implement MFA](https://auth0.com/multifactor-authentication) and safeguard your data from unauthorized access.

## Conclusion

Welcome to the remote club. We hope these lessons based on our experience of 7 years as a remote company can help you get the best of your remote time and maintain the same productivity as working from an office.

Are you a remote worker specialist and want to share some of your lessons? Or you just started remote work and have some questions? Please go ahead and leave a comment.


Welcome to the Remote Club: 7 Lessons From 7 Years

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Tips for a secure and organized data migration process. 1. Workflow and project management tools 2. User identity and access management 3. Clear customer communication

Data is the foundation of a company's success. It provides the basis for customer insights, corporate strategy, and operational efficiency. As more companies embark on [digital transformation](https://auth0.com/app-modernization), migrating this critical information — particularly sensitive customer data — to a new platform(s) can be a burden. Moving data can unearth inaccuracies, unknowns, and/or duplicate entries, making it insufficient to use and requiring significant changes. 

The tips below will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users.

<include src="TweetQuote" quoteText="Data is the foundation of a company's success. This post will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users!"/>

---

## Issues That Can Arise with Data Migration
Before we dig into strategies for success, it's important to understand the issues that can arise in data migration. The process can be thorny for several reasons.

### Lack of Consideration for the Process
Teams are generally focused on selecting and configuring their new system. Testing potential tools and comparing the models are generally more exciting and inspiring than the mechanics of lifting data out of the legacy package. If data is uploaded in its current state, any errors or irrelevant aspects could become amplified and increase the information's exposure to risk. Because of this, it's important to be sure your team is on the same page about the nuances of the process and has a specific roadmap marked with individual roles and responsibilities.

### Improperly Tracking Users
It's critical to manage user identities and monitor for suspicious activity when you're migrating sensitive information. Companies that rely on consumer data, in particular, must validate all entries against new regulations — [GDPR](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data), for example, along with more specialized industry standards such as Sarbanes-Oxley (SOX) for financial institutions and the Health Insurance Portability and Accountability Act (HIPAA) for many healthcare providers.

### Poor Communication of Updates
Making sure your end users understand how you are securing their data after you've updated your apps is important for maintaining their trust. If you can't articulate what you are doing with their information, it's unlikely they will stick around. Documenting your work and developing a clear communication strategy are essential to making sure your data migration supports your company's overall goals for growth.

To address these potential issues, the following strategies focus on workflow, user access, and communications.

<include src="ebook-ads/UserMigrationYourWay" />

## 1. Organize Your Workflow and Project Management
To clearly understand and outline the steps required for a successful data migration, take time to consider the following:

- What will cause the least disruption to the daily operations of your system? That is, when are the best times to work on and/or migrate data sets of highest sensitivity or usage?
- What aspects of your strategy can you tag to teammates in-house, and where might you need to bring in outside expertise?
- How will you document your process, ensuring that all information is accounted for?
- Will you enrich your files after they have been moved with further information (e.g., customer names and/or account numbers)?

While this list is not exhaustive and each strategy will be unique, depending on an organization's current systems and future goals, it should aid in understanding the depth of thought required for an efficient data migration.

It can be helpful to use a workflow tool to organize your team and define your process. [Airtable](https://airtable.com/product) has a proven track record for improving internal organization. When mapping out your data migration strategy, Airtable can help define your project scope, set deadlines, and assign individual responsibilities.

For any task that you're organizing, Airtable will help prioritize tasks and ensure that you adhere to your overall goals:

![Airtable](https://images.ctfassets.net/23aumh6u8s0i/38brOxQrTQvBu8Pa8BBQ17/df355af7ec95291c2abff6758ccb9694/1-airtable)

> [Source.](https://airtable.com/product)

Within the grid view, you can check to see which tasks have been completed and quickly note whom to reach out to in case of a question or concern. Airtable also has a [calendar view](https://airtable.com/product) to better visualize the timeline of your data migration, which can quickly become lengthy and arduous without clear monitoring. Both views can help break down the potentially opaque data migration process into a concrete series of steps.

Additional tools to consider for managing the task of data migration include:

- [Asana](https://asana.com/guide/examples/company/project-management): Highly customizable, popular tool for engineering teams
- [Trello](https://trello.com/): Visual workflow; bulletin-board format
- [Jira](https://www.atlassian.com/software/jira): Supports distributed collaboration

Taking time to think through your steps at a granular level and selecting a tool that will hold your team accountable will help you succeed.

## 2. Clearly Track Who Accesses Customer Data
Understanding who is accessing and updating portions of sensitive customer data at any given time during the data migration process is critical to maintaining integrity. In today's environment of [increasing industry regulations](https://auth0.com/gdpr) around consumer data, this core function must be up-to-date and as tight as possible. 

Because of the complexity and urgency of this task, many teams choose to outsource their [identity management](https://auth0.com/app-modernization) when migrating data, particularly as part of a larger [digital transformation](https://auth0.com/learn/identity-management-drives-digital-transformation/).

[Auth0's user management dashboard](https://auth0.com/b2e-identity-management-for-employees) allows a systems administrator to authorize new users, track their behaviors, and evaluate their performance according to the company's policies.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/5IwuLEHPTS1w1q7UhTcUPk/277cb0224267a945a4265e0984263142/2-auth0-manage)

> [Source.](https://auth0.com/learn/cloud-identity-access-management/)

In the Auth0 dashboard, an administrator will have a clear view of users at any point. In addition, Auth0's identity platform offers enhanced options like multi-factor authentication, anomaly detection, and advanced logging. For example, if the administrator notices a certain user has a series of failed login attempts, they can [block access](https://auth0.com/docs/anomaly-detection) to investigate further. 

From a user perspective, this function is an invisible and painless part of their workflow. 

## 3. Explain Your Data Policy Changes
If you can clearly communicate your data migration and updated data usage policies to your users, you will gain their trust — and an edge over your competitors. At the moment, very few company blogs or statements spell out the details of data usage in a digestible format — as we've recently seen with Facebook's [confusing policies](https://www.wired.com/story/mark-zuckerberg-congress-day-one/). 

You have an enormous opportunity to distinguish yourself in the field if you can fill this information gap. A major data migration is a perfect opportunity for you to document previous work and latest updates. Making this information immediately visible, user-friendly, and clearly accessible is key:

![Facebook](https://images.ctfassets.net/23aumh6u8s0i/7mn6vdZtybE6e5Rlg1dSNa/10c9a53747ac05ec8598251b03153990/3-zuck)

> [Source.](https://www.recode.net/2018/3/28/17171496/facebook-settings-redesign-cambridge-analytica)

While hopefully your team will not be recovering from a data leak like [Facebook's](https://auth0.com/blog/cambridge-analytica-and-facebook/), the tech titan provides an excellent example of how to communicate a change in policy to users. Three key points to include when explaining your updates are:

1. Place a brief summary of the information on the front of the app where users will see it immediately without any digging.
2. Include a clear CTA or way in which users can click to read further details.
3. Make sure any actions your user must take to delete or update their data settings are very simple.

You must make your user feel as though they are well supported and in full control. Both sets of information — your summary and fine print — should feel friendly and encouraging. Employ your best writers and incorporate welcoming images or a set of bullet points to truly put your best foot forward.

## Don't Be Afraid to Change
[90%](https://auth0.com/learn/how-auth0-uses-identity-industry-standards/) of businesses today state that legacy software systems are keeping them from achieving their goals. Despite increasingly strict regulations, you should not be afraid to scale and innovate. Just be sure you take the process of data migration seriously as you search for your new platform. Make sure the right people access the correct pieces of data at the proper times during the migration and then seize the opportunity to demonstrate how bulletproof your new strategy is with excellent customer communications.

<include src="TweetQuote" quoteText="90% of businesses state that legacy software are keeping them from achieving their goals. Scale and innovate while paying attention to data migration to succeed!"/>

Three Strategies to Streamline Your Data Migration Process

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Access to information is valuable but it is also dangerous. Auth0 CISO Joan Pepin explains why information warfare is a big deal

## How Critical Thinking Skills Can Protect You From Malicious Actors

From the outside, my job as Chief Information Security Officer for Auth0 might look like it’s about devices, apps, protocols and procedures, but those are just my tools. Access to information is valuable but it is also dangerous. My job is really is about balancing the opportunities and risks that information presents.So information warfare is a big deal for me.

The thing is, information warfare didn’t start with the [Russians](https://www.washingtonpost.com/news/the-fix/wp/2018/02/16/3-things-we-just-learned-from-the-indictment-of-13-russians-in-the-mueller-investigation/).

**An Ancient Strategy for Modern Encryption**

“All warfare is based on deception.”
— Sun Tzu, The Art of War (550 BC)

Back in 550 BC, Sun Tzu recommended sharing false information as a means of attack.
Granted, back then, a single human was limited to face-to-face and hand-transported written communication. In the time it would have taken one of Sun Tzu’s spies to share a sentence, false information can now reach thousands via the internet, each of them geometrically expanding the reach of a single message.

Even thousands of years ago, during the time of Alexander the Great, an ancient general on the hill would see the battle and would get one of his chariot commanders to flank to the east and summon a trusted messenger.

He’d use his secret encoder ring to craft a message on a piece of papyrus, then he’d roll it up and seal it with wax, hand it to that trusted messenger, and send him down the hill.
The chariot commander would recognize the messenger and know that he was a trusted source information.

He’d also recognize the seal authenticating the message.

And since he’d be the first to crack the seal, he’d validate that it had not been intercepted.
Using his own secret encoder ring, the chariot commander would decode the message. For safekeeping, he would also kill the messenger and burn the papyrus.

That ancient strategy also describes modern encryption and privacy on the internet. Those fundamentals have not changed.

We still need to know that the sender is in fact who the message claims it to because this implies that the content of the message could be genuine.

We still need to ensure that the message has not been intercepted or used inappropriately. And, finally, similar to the killing of the messenger and the burning of the papyrus, we need to know that at the end of its life cycle a message was destroyed in a way that rendered it unable to be reproduced.

This is the full life cycle of safe information.

If you’re going to base a business decision on information, you want to validate these same basic things and verify them. And when you delete the message, you want it to be gone forever.
Today, after the very end of tax season, I have a friend who goes through a shredding ritual. He goes through his filing cabinet and shreds everything he doesn’t need, since information is both an asset and a liability. Deleting was just as valid in Alexander’s time as it is today, but much the way the methods for making [Greek fire](https://www.ancient.eu/Greek_Fire/) have been lost to time, we are losing the ability to validate and verify information.

**Swaying Public Opinion through Volume**

By the time the Klondike Gold Rush came around, person-to-person verification still occurred, as did accurate message sharing through the newspapers, but the volume of communication available through mass printing offered a new opportunity to control the story.

While promoting Seattle during the Klondike Gold Rush, Erastus Brainerd used newspaper advertising and feature stories to [sway public opinion](https://www.nps.gov/parkhistory/online_books/klse/hrs/hrs2.htm) in a way that had never been done before. His stories appeared in the local papers, in advertisements across the U.S., and again in letters sent directly to various chambers of commerce offering Seattle as the pathway to riches — which proved extremely convincing in the wake of one of the United States’ greatest economic depressions, the Panic of 1893.

People sold everything they had and rushed to Seattle. But travelling across the country (or globe) took time and money and snail mail delivering personal stories was equally slow. By the time the story of Seattle was proven to be more propaganda than truth, many didn’t have the funds or the heart to head home to share their stories. Of the 100,000 who rushed to the Klondike, only 30,000 made it, and only 4,000 found gold.

Historians often say the 1893 depression made people more vulnerable to stories of riches. But newspapers had evolved into a trusted source of information. These stories were reportedly “true,” which encouraged people to shift their critical thinking responsibilities to the papers.

This public opinion campaign established Seattle as a primary city in the Northwest. Companies like Nordstorm and Filson got their start as a result of the Klondike Gold Rush, eventually seeding the start of companies like Microsoft and Amazon. Clearly, opinion campaigns can have lasting effects on the real world that end up impacting global history.

Today, the machinery of our society runs on information and spreads it far faster than Brainerd’s stories. There’s far more information made daily than Brainerd produced in his entire campaign. There’s more machinery to produce it, distribute it, and consume it. Now more than ever, we need that ancient skill of being able to quantify and qualify our information.

![Information warfare infographic](https://images.ctfassets.net/23aumh6u8s0i/4dgBv709nq0eiwi0R429nE/4b9f19a1aa428d57e6643815e052b694/information-warfare-infographic)

<include src="TweetQuote" quoteText="There’s more machinery to produce, distribute, and consume information. Now more than ever, we need skills that helps us quantify and qualify our information."/>

## Why People Should Think More like Spies

*“…there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don't know we don't know.”*

Back in 2002, the U.S. Secretary of State Don Rumsfeld caught a lot of flak about his unknown knowns statement. The reporter was after a direct answer about the lack of evidence linking the government of Iran to terrorist groups with weapons of mass destruction.

“Unknown knowns” and “known unknowns” came across as gibberish to both the right and the left. But for the spooks and spies tasked with analyzing and understanding information from a globe of sources, Rumsfeld’s Unknown Knowns statement actually described a taxonomy of information.
Let me break down with an example about a suspected danger — maybe a bomb or a shooter — in a building and whether or not that intel can be validated:

**There are known knowns**: We have intel that tells us something bad might occur in a specific building in a specific city.

**There are known unknowns**: While we know the city and the building, we don’t know when the bad thing might happen or what it is.

**Unknown knowns**: Because we’re not entirely certain we can trust the source of the information, we might know additional information without realizing it’s a salient detail. For example, April might be a critical month one source. May might be a critical month for another.

**There are unknown unknowns**: Because we lack complete information, there may be additional things — like the number of bombs or shooters — that we aren’t able to determine.

<include src="TweetQuote" quoteText="Like a station chief looking to decide which intel to trust, an era of information warfare should lead you to ask similar questions."/>

## Thinking Beyond the TV Box

When I was growing up, public opinion could be swayed by the fact that the majority of us were tuning into the same TV shows at the same time on the same channels.
Maybe because TV was a relatively young medium or because Americans had become significantly more jaded since the Klondike, my mother would warned me not to believe most anything I saw on TV.
But I liked all the voices on TV. I liked them so much that my mother put me on a TV budget. I was allowed a half an hour in the morning and another half an hour in the evening.
For my evening budget, I chose the evening news with Walter Cronkite.
Why? Because even though my mother had warned me against all the other voices, Walter Cronkite was a bit different. With his voice and later Tom Brokaw, there was an understanding that the media might have a certain bias, but it was also understood that one could easily compensate for that bias by using your own brain.
I understood that someone had crafted the story I was watching. Maybe Walter is a little more on the left than the right, but they weren’t lying.
Typically, it was easy to find another reasonable POV to use as a check. You could watch the slightly left-leaning evening news and pick up the slightly right-leaning newspaper and between those two you could easily determine the truth, as well as gain a deeper understanding of both sides. Now information has become so divergent that picking two sources and triangulating between them is not good enough.

## The Risk of Unqualified Trust

Current frustrations can make it sound like the media is in full control of all the stories. Back then, my mom drilled into my head that I had to figure out **what** someone was really saying and **why** someone might be saying it, the media actually held more power than it does today because people got the majority of their news from television, radio, and the newspapers. With the social media we’ve gained voices we might never have heard, but lost the vetting and some of our individual critical thinking skills — and allowed untrustworthy sources direct access.
Within this context, the trust that resided with journalists has been transferred to our network of friends and colleagues.
If my mom reads something on Facebook she accepts it as truth because it’s been shared by people she trusts, which is why rapid sharing without fact checking and validating sources can be so dangerous.

Everyone knows fake news is out there, but if everyone trusts the people in their feeds, who are trusting the people in their feeds and so on, it gives malicious actors an easy way to sneak in.
We need a web of trust to make this internet thing work, but that also means that each of us has the responsibility to make sure that the message we’re amplifying is an accurate one, because regardless of your political position, inaccurate info does no one any good.

## Vetting Info in the Era of Divergence

Although spooks and spies gather information, it’s the station chief who decides its value.
In the absence of a Cronkite or a Brokaw, that responsibility when reading a news story has shifted to you.
We are each our own information qualifier — and qualifying a news story today is harder than it was when I was a kid watching the evening news.
Instead of having to adjust for tone or delivery, thanks to information warfare, you could be staring at something from an untrustworthy or highly motivated source that was shared to gain a specific reaction — [like influencing presidential elections](http://www.businessinsider.com/cambridge-analytica-boasts-won-trump-election-facebook-data-2018-3).
Even if you try the old trick of triangulating with multiple voices, you might realize you’re in a social media echo chamber, where multiple people or companies you respect have reposted information from the same source. In this environment, it’s spectacularly easy for a single individual to reach out to multiple sources to control the narrative.
During the Cronkite era, information consumers regularly enjoyed vetted stories told with the help multiple validated sources. Consuming structured information made it easier to look for and recognize the most reliable patterns.
Since we’re consuming so much unstructured information, we have to work harder to ask the questions that help us know if the information before us is genuine and to validate and authenticate before sharing.
Because information is now so divergent, the burden is on you.

Information Warfare Offensive

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Find out how to add TLS to the Particle Photon to secure your communications.

JavaScript for Microcontrollers and IoT: SSL/TLS

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Protobuf, the binary format crafted by Google, surpasses JSON performance even on JavaScript environments like Node.js/V8 and web browsers.

Beating JSON performance with Protobuf

How to Embrace Remote Working and Still Be Productive

"communication"