samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

Innovative companies are reshaping CX with instant gratification, consistency, and hyper-personalization, raising consumer expectations and market standards.

Innovative companies like streaming services and digital marketplaces are setting bold new Customer Experience (CX) standards, redefining consumer expectations around speed, convenience, and personalization. To accelerate and cement their market dominance, these CX powerhouses have raised the bar (and customer expectations) in three key ways:

- **Instant gratification** &mdash; in the form of instant access and seamless experiences such as one-click checkouts
- **Consistency** &mdash; interactions continue seamlessly across channels, devices, products and services
- **Hyper-personalization** &mdash; individualized experiences and recommendations based on preferences and behaviors

## Better Experiences = Better Business

These new CX standards aren’t merely nice-to-haves that customers prefer––they are table-stakes requirements for any business hoping to build and maintain a competitive advantage. Today’s customers *expect* engaging experiences, convenient journeys, and secure digital platforms. Before they give you their business, they need to know that you’re able to cater to their unique needs, provide ease of use across multiple channels, and protect their data and sensitive information.

![Better Experiences = Better Business](https://images.ctfassets.net/23aumh6u8s0i/4uL4F3yqACDm61n5aMiRT1/dfc4ef40b3b83c4ee68705c8ca7e801d/OKTA1067_Auth0_Relaunch_Blog_Image_1_Stats.jpg)

## It All Starts With Identity

Meeting these customer expectations begins with getting Customer Identity right. 

Why? Because Identity orchestration is the backbone of everything — from security to a best-in-class CX.

> **Identity Orchestration** &mdash; is the process of managing and integrating Identity-related functions such as authentication, authorization, security, privacy, and personalization across systems and channels.

**Identity Orchestration** supports every critical aspect of the modern customer journey, from login to omnichannel navigation and continuous threat protection. **Modern Customer Identity** can strengthen security and fraud prevention while simultaneously creating seamless cross-channel continuity and personalized journeys that delight your customers. It also drives privacy by helping protect customer-sensitive data and enabling companies to progressively build customer profiles with consent. This in turn supports key marketing functions like loyalty activation and tracking, driving business growth.

> **In short: Getting the customer experience right begins with getting Customer Identity right**. But this is easier said than done.

## Upgrade Identity, Unlock Customer Loyalty

Here’s the ugly truth: Homegrown and legacy Identity solutions simply cannot support the modern CX and security standards that today’s customers demand.

For example, solely relying on legacy Identity methods like complex passwords, captchas, and rigid multifactor authentication (MFA) policies creates friction that undermines conversion. Identity-powered data-collection tools that burden customers with a million questions at sign-up have the same revenue-tanking effect.

To support customer loyalty and long-term growth, your business needs a modern Identity platform that streamlines experiences, enables personalized interactions, and strengthens security (without adding excessive friction).

Compromising on any one of these points isn’t an option. Today’s competitive landscape requires an approach to Customer Identity that can hit every mark––quickly, efficiently, and continuously.

## Auth0 Is the Answer

Auth0 helps businesses of all types and sizes deliver convenient, trustworthy experiences that customers have come to expect. Designed for both simplicity and scalability, Auth0 empowers companies like yours to adopt a modern, developer-first approach to Customer Identity. In doing so, Auth0 enables your teams to leverage the full power of Identity across every aspect of the customer journey and deliver outcomes that support growth.

![Auth0 Is the Answer](https://images.ctfassets.net/23aumh6u8s0i/396zh0bFmWePy5f5dRY1e0/9529f63ac52dd9fb6523570ad04c9788/Three-speaker_Podcast_Templates__Auth0_Platform__-_1200x628.png)

## Layer 1: Secure Experiences

![Secure Experiences](https://images.ctfassets.net/23aumh6u8s0i/3Ojc09oomw7ENwTB0BWhbF/7dcabdb076f87e0a6538ae764c0c3d2a/OKTA1067_Auth0_Relaunch_Blog_Image_2_Layer_1.jpg)

Auth0 helps secure customer experiences across their entire journey &mdash; before, at, and after login. To keep experiences streamlined, Auth0 leverages context to add additional layers of security when needed and reduce them when not needed. This enables the ideal combination of security and seamlessness.

### Before Login

Spotlight solutions:

* **Bot Detection** &mdash; Continuous, AI-powered monitoring for Identity threats that responds to bad bots in real time 
* **Breached Password Detection** &mdash; Detect compromised credentials and block and notify users in real time to keep threat actors out
* **SCIM** &mdash; Streamlined user management that automates the provisioning and de-provisioning of user access for B2B SaaS applications

![jersey-mikes](https://images.ctfassets.net/23aumh6u8s0i/1BMaeu8xs2ppTl8VaTMdml/543750478b37ce860cd458d0962376b6/OKTA1067_Auth0_Relaunch_Blog_Image_3_Jersey_Mikes.jpg)
Read more about this story [here](https://www.okta.com/customers/jersey-mikes/).

### At Login

Spotlight solutions:

* **Universal Login** &mdash; A customizable toolkit for building robust, branded authentication flows from a variety of login methods
* **Passwordless** &mdash; Convenient, secure sign-in using options including passkeys, email magic links, biometrics and One-Time-Passwords (OTPs).
* **Attack Protection** &mdash; helps prevent account takeover attacks with Brute Force Protection and Suspicious IP Throttling.
* **Token Management** &mdash; A secure framework for issuing, validating, and renewing JSON Web Tokens (JWTs) that streamline API access while protecting sensitive data during transmission
* **Progressive Profiling** &mdash; An easy way to gather customer data over time as they engage with your brand (as opposed to flooding them with questions at sign-up or login and scaring them away)
* **Organizations** &mdash; Enterprise-grade, secure, scalable, branded multi-tenant authentication for your B2B SaaS applications

![moneyfarm](https://images.ctfassets.net/23aumh6u8s0i/1aVC0XqsaxBT0txqkrnVzt/dc401cbe0ecd9d3fa5c7cf348c7b2f13/OKTA1067_Auth0_Relaunch_Blog_Image_4_Moneyfarm.jpg)
Read more about this story [here](https://www.okta.com/customers/moneyfarm/).

![cinepolis](https://images.ctfassets.net/23aumh6u8s0i/2Sh98UZEppi086rLYJTlCr/c1c9a8619ffbffac82187c823035b814/OKTA1067_Auth0_Relaunch_Blog_Image_5_Cinepolis.jpg)
Read more about this story [here](https://www.okta.com/customers/cinepolis/).

### After Login

Spotlight solutions:

* **Auth0 Fine-Grained Authorization** &mdash; A simpler way to programmatically define authorization and access at scale across applications
* **Highly Regulated Identity** &mdash; Powerful protections for highly sensitive information that trigger Strong Customer Authentication (SCA) when necessary
* **Client Initiated Backchannel Authentication** &mdash; Secure and streamlined user authentication for call center, in-person, and online interactions
* **Continuous Session Protection** &mdash; A unified way to monitor and manage user sessions, including the prevention of session hijacking and the revocation of suspicious sessions
* **Universal Logout** &mdash; Terminate users’ sessions when integrated threat monitoring tools identify a change in risk

![cribl](https://images.ctfassets.net/23aumh6u8s0i/2G1znaaE8I8iRjXYSaC9Ib/e99f1efba55465981b4e9e5237c8d81b/OKTA1067_Auth0_Relaunch_Blog_Image_6_Cribl.jpg)
Read more about this story [here](https://www.okta.com/customers/cribl/).

## Layer 2: Orchestration

![Orchestration](https://images.ctfassets.net/23aumh6u8s0i/4Xyqph6V36HBEck0EvCxre/7f8e763c47a09df044bc9ae52d1c492e/Copy_of_OKTA1067_Auth0_Relaunch_Blog_Image_7_Layer_2.jpg)

Your business is one of a kind, and this is evident in the uniqueness of your security needs and CX strategy. 

Auth0 puts customization at the core of your company’s security and CX with a range of offerings that your development teams can leverage to build better products––faster. Low- and no-code tools help developers build and optimize authentication flows faster, while pro-code options enable last-mile customizations tailored to your business’s unique needs. 

### Developer Tooling

Spotlight solutions:

* **SDKs and Quickstarts** &mdash; With a few lines of code, your teams can easily integrate Auth0 with any app written in any language and any framework 
* **Automated deployment** &mdash; Manage Auth0 tenant configuration integrated with your existing CI/CD pipeline using Auth0 Deploy CLI or Terraform provider

![signify](https://images.ctfassets.net/23aumh6u8s0i/4Un8sWHBAdmaQyqGVDtDR5/77c947a4b255b71037e7287de12d0a6d/OKTA1067_Auth0_Relaunch_Blog_Image_8_Signify.jpg)
Read more about this story [here](https://www.okta.com/customers/signify/).

### Custom authentication flows

Spotlight solutions:

* **Actions** &mdash; Empower developers with a drag-and-drop interface and flexible code environment that enables them to customize and extend Identity experiences—no-code for speed, pro-code for precision
* **Forms** &mdash; A no-code visual editor for orchestrating, customizing, and securing sign-up and login flows

![submittable](https://images.ctfassets.net/23aumh6u8s0i/5OavujxBJu2IrT7iCSeCon/2e390cc4ff3bc92730ba0d0e94a760bb/OKTA1067_Auth0_Relaunch_Blog_Image_9_Submittable.jpg)
Read more about this story [here](https://www.okta.com/customers/submittable/).

### Security operations

Spotlight solutions:

* **Security Center** &mdash; helps organizations detect and respond to attacks faster and fine-tune their security posture with intelligent insights and custom threshold alerting for Identity-related events, anomalies, and general efficacy.
* **Log Streaming** &mdash; further supports faster event response by allowing the streaming of relevant Auth0 activity to third-party SIEM tooling.

![Splunk](https://images.ctfassets.net/23aumh6u8s0i/4LgnDhyuTSTFmvIphsmxKt/6ff774c7ddb324f55be62440d10f6c37/OKTA1067_Auth0_Relaunch_Blog_Image_10_Splunk.jpg)

## Layer 3: Extensibility

![Extensibility](https://images.ctfassets.net/23aumh6u8s0i/1FXD0NT7qsqMAxYWIBszDQ/c743dda19d466dc00a6550181785d0d5/OKTA1067_Auth0_Relaunch_Blog_Image_11_Layer_3.jpg)

As your business evolves, your identity solution should seamlessly connect with your changing tech and security stack—it's crucial for long-term success. 

Auth0 is built on the principle of extensibility. By connecting every part of your technology and security ecosystem, Auth0 enables continuous strength of security while also supporting changing customer experience  functions across all channels.

### Marketplace Integrations

Quickly find and add low-maintenance, no-code integrations with applications and APIs. Using an intuitive drag-and-drop interface, it easily addresses a variety of Identity use cases such as Identity verification/proofing, fraud prevention, log streaming, data platforms, and consent management.

![Marketplace Integrations](https://images.ctfassets.net/23aumh6u8s0i/1MMEK4OhC8WgiGHWT9eijc/d50c0e020631562833bdc614ef87cc7a/OKTA1067_Auth0_Relaunch_Blog_Image_12_CLEAR.jpg)

## The Auth0 Difference

Best-in-class businesses adopt modern, developer-first Customer Identity. With Auth0, your development teams get pre-built tools—SDKs, APIs, customizable UI components, and security integrations—that can be activated instantly and extended as needed. This approach enables businesses to:

* Secure every step of the customer journey without adding friction
* Automate and orchestrate Identity flows to accelerate time to market
* Empower developers to integrate Identity their way, providing scalability and future-proofing

That’s exactly what the Auth0 Platform delivers to thousands of businesses worldwide—powering **10+ billion** authentications every month. Yes, that’s** billion with a B! **

Ready to build seamless, secure identity experiences? [Let’s talk](https://auth0.com/contact-us). Want to learn more about why companies like yours choose Auth0? Check out our [ebook](https://auth0.com/resources/ebooks/why-auth0-by-okta).


Designing Apps for Growth: How a Layered Identity Solution Helps You Win

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

For developers tasked with building global applications, choosing the right authentication solution is crucial. Auth0's ability to bridge the gap between enterprise and consumer needs makes it a standout choice in the crowded authentication landscape.

In today's multi-platform world, identity management isn't a one-size-fits-all solution. As developers, we need an authentication system that not only secures enterprise-level applications (B2B) but also delivers a seamless, user-friendly experience for consumer-facing products (B2C). That's why developers across the world turn to Auth0 when they feel it's time to delegate the task of building and maintaining ***authentication and authorization*** to a vendor with deep security expertise and adaptable technical capabilities. 

## The Challenge of Global Scale

Global companies with multifaceted portfolios face a unique set of challenges:

- **Multiple Platforms:** Users access their services via smartphones, PCs, consoles, and more.

- **Diverse Regulatory Requirements:** Compliance with international data privacy and security regulations is non-negotiable.

- **Customization Needs:** Every organization has its own unique workflows and integration requirements, such as compatibility with legacy authentication systems or [support for protocols like SCIM](https://auth0.com/docs/authenticate/protocols/scim).

For developers building at a global scale, the solution needs to be robust enough to handle high security and regulatory demands while remaining flexible for rapid development and global expansion.

## Why Auth0 Stands Out

Auth0's strength lies in its ability to effectively serve both B2B and B2C needs across geographical regions. Here's what makes it a compelling choice:

### Dual capability

Auth0 is built to handle both enterprise-grade integrations and consumer-friendly interfaces. While many competitors specialize in one or the other, Auth0 offers the best of both worlds.

### Robust security

With advanced features like multi-factor authentication (MFA), threat detection, and continuous monitoring, Auth0 meets stringent global security standards—critical for protecting sensitive user data and adhering to mandatory compliance requirements. Don't let regulation get in the way of expansion.

### Scalability

Whether you're serving thousands or millions of users across different regions, Auth0 scales seamlessly. This is vital for companies that operate in a global marketplace.

### Flexible customization

Auth0 allows extensive customization through robust APIs that support multiple programming languages and frameworks. This flexibility means you can tailor the authentication process to meet your specific needs, ensuring a smooth user experience regardless of the platform. Whether you are building the next top-ranking mobile game, a desktop AI application, or a streaming service, Auth0 has a solution that adapts to the user experience you want to attract, convert, and retain paying customers.

### Comprehensive support
 
Transitioning to a new authentication system can be complex. Auth0's professional services and support ensure that even challenges like regulatory compliance or cloud infrastructure migrations (e.g., AWS) are managed efficiently.

## Auth0 Is Ahead of the Competition

While there are strong contenders in the IDaaS space, they often excel in more niche areas. A competitor may be a strong option for enterprise integrations but may require extra effort to tailor it for consumer-facing applications. Some competitor platforms often focus on streamlined, developer-friendly solutions for either simple consumer apps or internal enterprise tools. However, they might not offer the same depth of customization and B2B/B2C functionality required for complex global environments or operations.

Auth0's proven track record in both B2B and B2C scenarios makes it uniquely suited for organizations that need a versatile, scalable, and secure authentication solution.

## See Auth0 in Action

Seeing is believing. Experience Auth0's power firsthand by diving into our developer resources. There, you can quickly set up secure authentication flows for both business and consumer scenarios.

### Interactive demo
   
Try out [our reference B2B SaaS application](https://saastart.app/) to experience features of multi-tenancy support, user management and access controls, security policies, self-service Single Sign-On configuration, and more out-of-the-box. Follow our [guided walkthrough](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/) to see how easily Auth0 can secure B2B SaaS applications. If you prefer to learn while reading code, check out the [Auth0 B2B SaaS Starter open-source repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

### Step-by-step developer guides

Check out our [detailed developer guides](https://developer.auth0.com/resources/guides) on integrating strong authentication using Auth0 with different frameworks and languages. These guides will show you how to implement everything from simple login pages to role-based access control in Single-Page Applications (SPAs), APIs, and web applications. Once you are done with the basics, explore our [developer labs](https://developer.auth0.com/resources/labs) to learn how to extend your authentication solution to include features such as Single-Sign On (SSO) for end-users using Google, GitHub, or X/Twitter, as well as enhancing your authorization models with Fine-Grained Authorization.

### Code samples

[Clone any of our starter projects](https://developer.auth0.com/resources/code-samples) and see practical examples of how Auth0 streamlines the implementation of authentication and authorization. Experiment with the code, tweak it to suit your needs, and accelerate your development process.

## Conclusion

For developers tasked with building global applications, choosing the right IDaaS solution is crucial. Auth0's ability to bridge the gap between enterprise and consumer needs—coupled with its robust security, scalability, and flexibility—makes it a standout choice in the crowded authentication landscape. 

If you're developing a platform that must meet both B2B and B2C demands on a global scale, Auth0 is definitely worth a closer look. [Global companies like SEGA have chosen Auth0](https://www.okta.com/jp/press-room/press-releases/sega-auth0/) as a comprehensive and compliant yet flexible authentication solution that not only enhances security and user experience but also streamlines development and operational efficiency: by opting for a ready-to-use IDaaS solution rather than maintaining an in-house system, SEGA was able to lower development friction, allowing their teams to focus more on core game development and innovation.

Authentication and Authorization For Developers Who Build at Global Scale

Ian Hassard

Senior Director, Product Management

Tianyi Qian

I’m a UX Researcher at Auth0. I’m passionate about human behaviors and technology. With a foundation in sociology, I enjoy the process of using research to understand user needs and drive product and design decisions. I enjoy sketching, reading, and indoor climbing!

UX Researcher

Challenging our assumptions around how usability drives modern identity technology adoption

We’re obviously really passionate about identity. Businesses are excited about the potential user experience (UX) and security benefits of modern identity technologies. But what do consumers think?

To gain a better understanding of public attitudes to modern identity, Okta surveyed consumers about their experiences with new authentication options, their enthusiasm for passwordless alternatives, and their existing password security habits. 

## Methodology and Motivation

Before we explore the results, it’s worth talking about _why_ Okta surveyed individual consumers. After all, Okta doesn’t sell technology directly to the public. Our customers are businesses, governments, and nonprofits. 

It’s a valid question. Here’s the answer: individuals ultimately use our products, whether they’re consumers interacting with the Okta Customer Identity Cloud (CIC) or employees using Okta’s workforce solutions. 

Okta wants to protect the digital economy. But to do that, we need to build products that consumers actually want to use. We need to build something that’s meaningfully better than legacy password-based authentication. 

This means we need to test our assumptions about consumer attitudes. We must understand their needs, preferences, and habits. 

By speaking directly to consumers, we can learn their likes and dislikes. We can measure their exposure to modern identity technologies and see which ones they enjoy using. By delivering products that align with the needs of consumers and employees alike, we can start transitioning away from passwords and move towards a more secure future. 

So, let’s talk about methodology. Okta’s Customer Identity Cloud Unit (CICPU) conducted a series of 60-minute Zoom research sessions with consumers from around the globe. These sessions consisted of two parts. 

The first was a discussion about authentication preferences and their attitudes to password security. We asked about their best and worst authentication experiences, as well as their exposure to modern identity technologies. 

The second section consisted of a usability test. Participants were asked to create new accounts on a number of platforms using a variety of modern identity approaches and asked about their likes and dislikes. 

We spoke to 23 participants in total, with those from the Americas representing more than half (55.2%). EMEA and APAC participants accounted for 30.4% and 17.4% respectively. 

Our study didn’t have the largest sample size, but that was by design. We weren’t interested in doing a quantitative study, where we looked at habits in aggregate. Our research was qualitative. We wanted to see the nuances and opinions that aren’t easily identified at scale. 

![Security](https://images.ctfassets.net/23aumh6u8s0i/3X31s04spm3rcZHMbsjkli/3d974e2b7075f5c5ffc3cf4c37fe4f89/adaptive-mfa-sep2)

## Meet The Consumers

Our respondents came from a diverse array of backgrounds. They represented ten different industries, ranging from retail and manufacturing to education and healthcare. All reported a strong level of confidence with technology, with 60.9% claiming to be “very” tech-savvy and 39.1% describing themselves as “somewhat” tech-savvy. 

Despite a high level of self-described tech savviness, the overwhelming majority of respondents failed to adhere to password security best practices. Few reported using a non-browser-based password manager, like 1Password or LastPass. Most said they reuse passwords across devices or apps. 

But there was some nuance. Just because they didn’t necessarily use perfect password hygiene doesn’t mean they were totally unaware of the risks they faced or had no wish to improve.

Many claimed to use separate passwords for their most sensitive accounts, such as with banking or healthcare applications. Some stored their passwords in spreadsheets or in their phone’s Notes app. 

Although this is vastly less secure than using an encrypted password vault, it’s arguably better than re-using potentially weak and compromised passwords. And it indicates an awareness of the risks associated with account compromise and a willingness to improve their security. 

Many of the interviewees described this as a “headache” but weren’t actively looking for alternatives, as they didn’t know where to start. 

## Consumer Attitudes to Identity and Authentication 

During the second phase of the interview, CICPU asked our interviewees to create accounts for a variety of platforms and sign-in with their credentials. These included the social websites Twitter and TikTok, the Washington Post, and Airbnb.

Curiously, the attitudes of our panel were often shaped by how well they trusted a particular company and the general usability of the site in question. 

TikTok was a good example of this. Although TikTok is the fastest-growing social media platform in the world, with over 1bn monthly active users, it’s also embroiled in controversy. The company’s Chinese ownership has invited scrutiny from lawmakers on both sides of the Atlantic, with some leading calls for the app to be banned. 

For many of our participants, their authentication choices were informed by what would share the least amount of personal information rather than security or convenience. 

They increasingly opted to use their phone number or an email address rather than social login options, which may reveal their personal info on other platforms. They believed doing so would limit the amount of personal information a platform like TikTok could obtain.

TikTok offers a wide range of sign-in options (although slightly fewer for registering). But this wasn’t necessarily a net benefit, according to our participants, who felt they added to a cluttered and confusing user experience. 

Our research highlighted other UX shortcomings within TikTok, which lengthened the time required to access the app for many participants. These included the placement of the form fields used to input the one-time password (OTP) code generated when using multi-factor authentication (MFA). Additionally, many participants faced difficulties in understanding where to look for the OTP code.

TikTok had the second-highest sign-in failure rate (33.33%) and the highest sign-up failure rate (38.89%). It also had the longest login completion time (69.09s) and the second-longest sign-up completion times. 

By contrast, the Washington Post had the lowest failure rates across login and account creation flow (7.14% and 5.56%, respectively) and the quickest completion times. It also offered the most popular identity experience of the sites studied. 

So, what’s the secret sauce behind the Washington Post’s success? In short, it’s among the simplest experiences of those surveyed. The Washington Post also required comparatively less information when compared to the registration flows of other sites. 

It’s worth noting that the Washington Post also allows users to authenticate with a one-time “magic link” sent to their email accounts. Our participants overwhelmingly described this as “unnecessary,” as it required additional steps to complete and broke the login flow, with participants opening another page to sign-in.

The context was an unavoidable factor in how our panel chose which identity technologies to use. In the case of Airbnb, the majority of our respondents chose to use their phone number and email address as they were eager to maintain visibility over their bookings. 

## The Factors Driving Authentication Choice

This exercise wasn’t merely about seeing how individuals felt about certain websites’ authentication flows. It exposed our participants to a variety of authentication methods. We could observe which they preferred and which ones they avoided and learn the reasons why they chose the options they did. 

The factors that influence a person’s decision to use a particular authentication technology are multifaceted. They include things like trust, context, and familiarity.

In every website tested, email consistently ranked as one of the top-two authentication methods among our panel. In many respects, this didn’t come as a surprise. It’s something everyone is familiar with. Old habits die hard. 

From a technologist's perspective, email and password-based authentication feel archaic. It’s a method that’s vulnerable to things like credential stuffing and phishing. Our participants, however, saw it as a tool to protect their privacy from organizations they didn’t fully trust. 

Many expressed the belief that email-based authentication limits the amount of personal data shared with a website, especially when compared with other modern methods, like social login. Others avoided using social login and expressed fears about a potential contagion effect, where if one website finds itself compromised, the attacker would be able to access their data on other websites. 

In practice, things are a bit nuanced. These fears, while understandable, don’t reflect the reality of how modern authentication works and how it can protect user privacy and account security. This research illustrates the urgent need for the identity industry — of which Okta is a leading member — to educate the wider public about the relative security of the various authentication methods currently available.

Things are equally interesting when you look at the methods our participants opted not to use. Few, when presented with the opportunity, chose to use “magic links” or QR codes. When asked why, they said it was because they were unfamiliar with them. This is true especially during sign-in when participants want the process to be as seamless and as quick as possible. For many, spending time learning modern/new login options during sign-in is a luxury. 

Naturally, people are inclined to use things they understand over things they don’t. While the adoption of less-common authentication technologies may grow organically, driven by developer and business adoption, it’s not unreasonable to think that education may accelerate this process.

Finally, let’s touch upon the context element. As our interviews showed, people’s choice of authentication technology is heavily influenced by the website or platform they’re using. 

A significant number of participants said they used more secure authentication methods (with biometrics and multi-factor authentication cited as examples) when accessing websites and applications that house sensitive personal information. These include government websites and banking applications. 

This finding is heartening. It illustrates a level of understanding about how some authentication methods are more secure than others and a willingness to adjust their behavior based on the sensitivity of the application. 

![security](https://images.ctfassets.net/23aumh6u8s0i/40V8USPBHCJ0K9SxZHISMw/b7488bb599ce8d9f83a3aeea0e4334fa/adaptive-mfa-sep1)

## Key Takeaways

Our study leaves a lot to consider. Here are our biggest takeaways: 

* Modern identity can improve UX, but if the UX foundations are infirm, it might confound users. A great example is TikTok, which offers a myriad of authentication choices, leaving consumers unclear about what to do. 
* If it ain’t broke, don’t fix it. The Washington Post offers an incredibly fluid authentication and account creation experience, leaving other identity tools looking superfluous in the eyes of consumers. There’s a question to be asked about “diminishing identity returns,” but that’s for another article. 
* People want to do the right thing when it comes to password best practices and hygiene, but they often choose convenience over security. While their execution is sometimes lacking (with reused passwords stored in spreadsheets and notes), their heart is in the right place. 
* The way consumers authenticate is driven partially by the trust. UX is an important factor, certainly, but it’s not the only one. 

We’ve long argued that the human element is among the most important in a business’ security posture. Your safety depends on your customers and employees making the right choice. We can make that choice easier by offering a better UX, but we also need to understand their preferences and fears. We need to understand why people make certain choices. 

This study is, we hope, an important step in understanding that human element. Choices are, by definition, contextual. A myriad of factors influences them, ranging from the UX composition of a website to the customer’s sentiment toward an organization.

Ultimately, when it comes to identity, there’s no such thing as a “one-size-fits-all” solution. And if you want to learn about how Okta can deliver an identity solution tailored to your organization’s unique needs, reach out to the team here.

Understanding Consumer Attitudes Towards Modern Identity

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

Convert and protect customers at the login box and beyond

**TL;DR:** Okta has launched the [Auth0](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/), powered by Auth0, with support for two use cases: Consumer Apps and SaaS Apps. This article explores the Consumer App use case and capabilities, as well as how app builders, digital leaders, and security teams can set their applications up for success with end-users, starting at the login box.

It doesn’t matter if you’re in the public sector or selling pizzas–for every organization, in every industry, digital business is just business now.

As consumers ourselves, we know the best apps are the ones that improve our daily lives, keep us safe online, and are delightful to use. We also know what a terrible login experience feels like: 83% of consumers have [abandoned a cart or signup due to an arduous login process](https://info.auth0.com/expectation-vs-reality), and 48% are frustrated by filling in long login or sign-up forms.

In the identity and access management world, this is called customer identity: Learning about your customers and securely building consent-based trust by understanding who they are and how they want to engage with you.

While managing customer identity is a relatively new concept for marketers, app builders and security teams have been wrestling with the complexity around identity and access for years.

What would happen if we treated identity as the “digital front door”? Could we make end-users more secure, help developers launch the next big app, or put an end to passwords?


## Consumer Identity Without Compromise

Auth0 for Consumer Apps enables app builders, digital marketers, and security teams to give end-users access to everything they need online in a convenient and secure way. Consumer-friendly capabilities like Passwordless, Progressive Profiling, and Adaptive Multi-factor Authentication (MFA) ready to go out of the box help maximize conversion, retention, and loyalty without adding friction or security risk. And our 100% focus on identity means we’re keeping an eye on the latest attacks and technologies for you, too.

“Flo is committed to building a better future for female health with the number one OB-GYN recommended app, a thriving community, and science-backed resources,” said Roman Bugaev, Chief Technology Officer at [Flo Health](https://auth0.com/case-studies/flo-health). “Auth0 allows us to provide personalized insights to our users in a thoughtful and secure way, so they can take control of their health. Improving the authentication experience has also helped us reduce churn during the login process, driving our signups 12 times higher since we made the change.”

Here are a few of the ways our customers are using Consumer Apps today.

### Acquire Customers With Just One Click

Asking consumers to create (yet another) password that meets certain complexity requirements results in lower customer acquisition rates, especially on input-constrained devices. Streamline registration with fewer passwords for users and fewer password resets for your support team with **Single Sign-On (SSO) and social logins**, MFA, and more out of the box. Want to do away with passwords entirely? You can start with multiple passwordless options without adding security risk.


### Personalize Experiences for Long-Term Loyalty

Today, digital marketing teams are effective at personalization and testing around the login box, but very few are doing this within identity. Considering that the login box is the gateway to digital experiences, this is a huge missed opportunity. Features like **Universal Login** make it possible to customize the login experience to your exact audience with any number of authenticators–even without your own dedicated identity team. This is a huge selling point for marketers and the developers they work with, who have a lot on their plates already.


### Collect First-Party Data Without Friction

Have you ever had someone ask for too much information on a first date? Long sign-up forms are the digital equivalent. With web cookies going away, digital teams are turning to features like **Progressive Profiling** to collect first-party data over time as consumers sign up and engage with their website or app. Less creepy? Yes. Even more effective for building trust and personalizing experiences? Definitely.


### Protect Revenue From Bots and Brute Force

[Credential stuffing](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) accounts for 34% of overall login traffic and outpaces normal traffic in some countries (61%) in the U.S. and verticals (more than 80% in retail), according to Okta’s 2022 State of Secure Identity Report. Distinguishing between legitimate users and would-be attackers requires finesse and can quickly become a full-time job. Our **Attack Protection** capabilities like Bot Detection, Breached Password Detection, Suspicious IP Throttling, and Adaptive MFA give security teams the tools they need to fight fraud without damaging the user experience.


## What’s New for Consumer Apps?

New product innovations for Consumer Apps were announced at Oktane22. Okta expects these features to be available by the end of Q2 2023, with support for Highly Regulated Identity as an Enterprise Add-on.

* **Passkeys support:** Passkeys are a replacement for passwords that make it faster and safer to sign into apps and websites on any device. The technology is phishing-resistant and uses a device — usually a fingerprint or facial recognition, or a PIN — to prove a user is who they say they are. We are making it easy for app builders to turn on passkeys with the literal flip of a switch.
* **Highly Regulated Identity:** While we’re enabling app builders to offer the most exciting experiences, we also recognize some of our customers operate in highly-regulated industries like banking or utilities. Highly Regulated Identity is a new toolset that allows customers to safeguard riskier transactions with extra security and policy control. We are taking steps toward enabling customers to reach Financial Grade API (FAPI) compliance with several new product innovations, including:
    * **Pushed Authorization Request (PAR):** A new OAuth endpoint that avoids passing any sensitive information on the front channel (e.g., all authorization details won’t appear in the browsing bar or search history).
    * **Rich Authorization Request (RAR):** A framework that enables fine-grained control over authorization for any use case, including communicating fine-grained details on a transaction (e.g., payment amount) and customized consent gathering (e.g., selecting a bank account as part of the consent step).
    * **Private Key JWT:** An authentication method that improves security posture by signing with a private key rather than a password or secret that can be intercepted and used by someone other than the intended recipient.
    * **Strong Customer Authentication (SCA):** A component of the European Union’s second Payment Services Directive (PSD2) that requires at least authenticating users with at least two factors: something they have (e.g., device or hardware key), something they know (e.g., password or PIN), and something they are (e.g., biometrics).
    * **Mutual Transport Layer Security (mTLS):** A type of authentication where access tokens can only be used by the application they were specifically issued for; thus, if a token is leaked, it can’t be used by the attacker. 
* **Security Center:** At Okta, we have insights from billions of authentications about the threats facing consumer apps. We want to make sure your entire cross-functional team has this same visibility. Security Center is a single pane of glass that enables security professionals to monitor in real-time, detect, and respond to potential identity security events–either directly through your dashboard or by integrating with the security stack of your choice. With comprehensive dashboards, visualizations, and controls tailored to customer identity scenarios, this is a powerful tool for keeping your customers secure and your app operating at the highest level.

Learn more about the Auth0 and how to turn your login box into an engine for growth at [https://www.okta.com/customer-identity](https://www.okta.com/customer-identity/).

**Footnote:** _Any unreleased products, features, or functionality referenced in this blog post that is not currently available, may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and customers should not rely on them to make purchase decisions._

Inside Auth0 for Consumer Apps

dean-scontras

Dean Scontras has spent the last two decades in public sector sales roles at high-growth cybersecurity and technology companies, including Duo Security, MobileIron, and Hewlett-Packard. Currently, Dean sits on the advisory board of Advanced Technology Academic Research Center (ATARC) and DiversifyIT. Prior to joining Auth0, he served as the vice president of U.S. Public Sector at Duo Security (acquired by Cisco), leading federal, state, local, and education sales initiatives, alongside securing the company’s successful FedRAMP certification.

VP, State and Local Government and Education, Okta and Auth0

Dean Scontras

Consumers expect seamless, high-value digital experiences, including with the public sector.

What does it mean to build digital services that citizens both use and trust? From the local to the national, generating effective digital transformation and [getting citizens onboard with digital public services](https://www.sciencedirect.com/science/article/pii/S0740624X18304131) has been a challenge. The promise of digital government has often been muddled by institutional inertia and perceptions of government as slow-moving and bureaucratic. At the same time, positive initiatives, such as the [Tallinn Declaration on eGovernment](https://ec.europa.eu/newsroom/document.cfm?doc_id=47559), which embrace objectives as wide-ranging as improved service delivery, greater efficiency, increased transparency, interoperability, and citizen satisfaction, have begun to remove entrenched ambivalence about e-government. Modern GovTech is where these barriers collide, creating the opportunity to address newly accelerated consumer demand in the face of private-sector conveniences and the [consequences of the Covid-19 pandemic](https://www2.deloitte.com/us/en/insights/industry/public-sector/government-digital-transformation-strategy.html). 

GovTech, according to public sector entities such as [the World Bank](https://www.worldbank.org/en/programs/govtech), is a technology-based “government approach to public sector modernization.” The same definition emphasizes three core areas for modernization: universal accessibility, citizen-centric services, the delivery of efficient and transparent government systems, and finally, digital transformation, all of which rely on overcoming long-cited barriers to adoption and success, such as [citizens’ willingness to use and trust services](https://doi.org/10.1145/2096140.2096142).

GovTechs, an umbrella term for technology-based solutions (and the companies behind them) that power the technical aspects of digital transformation, can be a bridge between use and trust and learning to [see citizens as customers](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/building-the-tech-enabled-government-of-the-future-a-day-1-list-of-common-pitfalls).


## Changing User Expectations 

In a pure consumer context, choice and convenience rule: you can easily go online and search, comparison shop, and buy a desired product in a few clicks without thinking about any of the complexity of the transaction. Consumers naturally transfer their positive consumer expectations to all of their digital experiences,[ according to McKinsey, raising the bar for government entities](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/digital-public-services-how-to-achieve-fast-transformation-at-scale). 

But how many consumers have enjoyed the convenience of one-click (or similarly easy) citizen services, such as reviewing and paying utility bills, filing income taxes, or having a streamlined, one-stop car-and-driver licensing experience? Or, for example, registering for unemployment benefits digitally, making the physical queue at the unemployment office shorter and more efficient for those going through the process in person? 

Rapid change has led to the expectation that public sector services offer private-sector-rivaling availability, choice, and convenience, which overrides previous consumer doubts about public sector readiness. 

Driving GovTech strategy in complex public sector environments demands a delicate balance between overarching strategic questions and the nitty-gritty of implementation. For example, this balance could be examining the[ underpinnings of transformation](https://www.accenture.com/_acnmedia/pdf-90/accenture-govtech-pov.pdf) strategically, such as public expectations, financial considerations, accessibility, demographics, and sustainability, against the competing operational demands of introducing new technology into hierarchical, political, and often change-resistant environments. Practically, such implementations involve extensive political and stakeholder management and support, consideration of legacy investments and programs, and a well-defined plan for rolling out proposed changes and the downstream effects these may have, whether positive or negative. 

Ultimately, the strategy for selecting and implementing GovTech solutions and providers rests with public sector employees who are responsible for the strategic and tactical approaches described and for meeting consumers’ increasingly private-sector-style expectations. This is redefining how governments interact with citizens. 

Three core considerations highlight how uniquely demanding delivering on these expectations can be for government agencies:

### 1. Deliver on citizens’ demands and expectations. 
Government digital transformation is different from its private-sector counterpart. Historically,[how consumers perceive and use public and private sector services has differed](http://dx.doi.org/10.4018/IJIDE.2019010102). However, societal changes stemming from the Covid-19 pandemic and the attendant shift to living life almost 100% online have resulted in heightened citizen expectations for public services to be available digitally in the same way as online shopping and food delivery. As a result, old barriers against citizens' willingness and ability to use e-gov services have declined significantly. 

### 2. Balance privacy and user experience. 
More fundamentally, the private sector is driven by consumer demand and choice, incentivized by increasing profit and reducing cost. While the public sector shares these concerns, because citizens often do not have a choice in deciding whether to interact with the government, the government’s primary aim is to provide services to citizens efficiently while building trust, safeguarding citizens’ data privacy, and ensuring compliance with regulations, mandates, and standards to which government agencies are tied. Trust remains an important issue for consumer-citizens, who[ perceive a level of risk in exposing their private data to public entities in ways they don’t when dealing with private entities](https://www.ey.com/en_no/government-public-sector/how-can-digital-government-connect-citizens-without-leaving-the-disconnected-behind). For public sector agencies, privacy concerns have historically taken precedence over user experience, but they need to prioritize privacy and security over user experience and convenience is beginning to change as GovTechs offer secure solutions leveraging modern infrastructure and economies of scale that facilitate both outcomes at a lower overall cost.

### 3. Make public services accessible to all citizens. 
The rapid digitization of society champions convenience above all, but digital-only approaches can create [accessibility blindspots](https://www.openaccessgovernment.org/accessibility-making-government-work-better/55530/) and [exacerbate the digital divide](https://www.ey.com/en_au/government-public-sector/how-can-clever-governments-choose-to-close-the-digital-divide). Government agencies must serve _all_ citizens, which means designing for everyone or else disenfranchise citizens who do not have access to digital services, devices, or connectivity. 

## How Can GovTech Enable These Citizen Experiences? 

Government agencies want to deliver on these citizen expectations because the agency benefits by achieving its mission, improving efficiency, and reaching all of its citizens — ultimately benefiting citizens. 

“A valuable function of government is providing all constituents with equal opportunity to access different services. By enhancing government with modern technologies, citizens are presented with multiple paths to the same services. These paths can now be both digital and in-person avenues, allowing the government to be more efficient in providing the right access to the right group of people,” Auth0’s Jeet Shah, Identity Architect, and Senior Solutions Engineer explains. “GovTechs introduce options for how citizens are served, allowing governments to dedicate resources more effectively. Citizens who prefer interacting with their governments online allow in-person services to be more accessible and can ultimately improve the quality. GovTech vendors and what they provide to governments ultimately leads to better services for all constituents.” 

GovTech grows from two branches: the first is the services governments offer to their citizens, the second is the vendors that enable those services. Governments furnish services in line with citizen expectations, which brings together these two branches.

### Government services to citizens: Focus on usability and trust

At the heart of delivering efficient public services is the ability to unify disparate, siloed departments and functions under a single sign-in. Forcing citizens to keep track of and maintain access to multiple portals and sites creates friction and disincentivizes use while also introducing the greater potential for security vulnerabilities and data privacy breaches. 

At the same time, maintaining this fractured setup is less efficient, potentially open to fraud, and forfeits opportunities for fostering citizen trust and personalizing user experiences. For example, imagine being able to offer all citizen services through a centralized digital portal or app with a single sign-on experience. From license renewal to viewing existing permits to paying bills, governments can leverage GovTech that enable these features and gather user analytics simultaneously to feedback into personalization efforts and a deeper understanding of citizen needs and wants.

## Identity Jumpstarts GovTech Services

[Various barriers have slowed technology-driven public sector transformation](https://doi.org/10.1007/978-3-030-57599-1_4) over the past two decades. Many of these barriers, such as embedded organizational and cultural issues, existing processes, and legacy structures and infrastructure, persist regardless of technology. The impetus to accelerate the pace of change, however, has positioned GovTech to play a key role in helping to overcome some of these barriers. 

Identity enables all levels of government to bring their services to more citizens via the channels they prefer and already have access to. If the barrier faced is the difficulty of use, unified identity simplifies usability for both the government agency and the citizen user. If the barrier is trust, secure and transparent identity technologies can breakthrough. 

### Vendor service enablers: Auth0 for unifying identity

Auth0 is a GovTech vendor that, in this case, acts as an umbrella, freeing government agencies from service and platform fragmentation by bringing them together under a single, flexible sign-on solution. By reducing infrastructural complexity and providing options government agencies can use to offer services across multiple vectors, Auth0 helps public sector entities to expand the base of citizens who can access their services. 

By doing the heavy lifting of the platform and digital identity consolidation, Auth0 enables governments to reorganize and reprioritize resource allocation for more efficient processes – dedicating resources to digitizing what is possible and improving those that cannot be digitized.

If you’d like to learn more about how identity can accelerate digital change and invite citizens along for the journey, please get in touch with the [team at Auth0](https://auth0.com/contact-us).

What is GovTech?

MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

Security leaders will increase visibility and diversity of thought to meet consumer (and business) expectations

From the Colonial Pipeline attack, which resulted in fuel shortages across much of the East Coast, to the devastating breach on Microsoft Exchange, it’s safe to say 2021 was a tumultuous year for cybersecurity. But what will the next year look like?

I reached out to Auth0’s leading security and privacy experts to hear their predictions for 2022, and to learn how organizations will grapple with a changing threat landscape and the ongoing pandemic.

![Predictions](https://images.ctfassets.net/23aumh6u8s0i/e8LLSbz9kUTIssTNzD33k/1c58e52ea17e0bf67b104322e8ade137/cybersecurity-prediction-sep1)

## 1. The Visibility Challenge

It’s been almost eighteen months since the Covid-19 pandemic forced us to rethink everyday life. The workplace was no exception. States ordered tens of millions to work from home, as they sought to limit the virus’ spread. To accommodate this flood of remote working, IT departments raced against the clock to build the necessary technology infrastructure.

Now, the dust has settled. The pressure has eased slightly. It’s time to take a breath. But don’t get too comfortable.

The next challenge for IT leaders — and CISOs in particular — is in securing the newly acquired devices and services underpinning remote working. Monitoring and threat detection will likely prove to be the biggest headache.

> “Visibility is fundamental to security,” explained Cassio Sampaio, Senior Vice President of Product at Auth0. “You can’t stop attacks you don’t see. It’s always better to see attacks in progress, rather than after they’ve occurred.”

Many workplaces deployed new hardware and software in record time to ensure the continuity of the business, leaving little time to integrate them into existing security workflows. Sampaio says the big priority for 2022 will be to bring this infrastructure into view.

> “With teams working remotely for the foreseeable future, now’s the time for IT teams to start focusing on security, with monitoring and threat detection both high priorities,” Sampaio added. “Hybrid working, as well as the growth of BYOD and cloud computing, has shifted the definition of a security perimeter. It now includes identity systems, as well as firewalls and IPS tools. It’s critical organizations extend their visibility to include these.”

## 2. Secure by Default Becomes the Norm

Security breaches can occur because of simple user errors. In some cases, vendors inadvertently facilitate that by issuing products with insecure default configurations, putting the onus on the customer to harden them.

> “Far too often, security is treated as the user’s responsibility. This approach has arguably contributed to several high-profile incidents,” said Shiven Ramji, Chief Product Officer at Auth0.

In August, researchers at Upguard learned some apps running on a popular infrastructure provider were leaking sensitive customer and business data totaling 39m records. This included Covid-19 contact tracing details, payroll records, and biographical customer data.

UpGuard attributed the issue to a default configuration that allowed unauthorized third parties to remotely query the underlying data source. But instead of considering it a bug, the provider described the issue as a well-documented feature.

In the face of massive data breaches and other unwelcome security lapses, we expect vendors will take a more proactive approach in creating guardrails for their customers. A Secure by Design approach will become the default. This philosophy sees products shipped with the most cautious settings by default, accompanied by other vital protective features, including Multi-Factor Authentication (MFA) and Privileged Access Management (PAM)

## 3. Malicious Actors Will Exploit Supply Chain Woes

Global supply chains are in disarray. The cost of shipping products between continents spiked during the pandemic, with ships and containers both in short supply. Meanwhile, soaring demand for semiconductors has resulted in widespread shortages of graphics cards, games consoles, and cars, with the “chip drought” expected to last until 2023.

Amid this turmoil, we can expect to see malicious actors take advantage of the situation, exploiting the widespread sense of desperation among businesses and consumers. There is evidence this has already started to occur, with the FBI reporting an increase in Business Email Compromise (BEC) attacks at the start of the year.

> “If you’re a school awaiting a shipment of Chromebooks for remote learning, or a retailer expecting stock from overseas, you might not question an unexpected invoice, especially if it comes from someone you know. The urgency may override your skepticism,” said Annybell Villaroel, Security Awareness and Culture Manager at Auth0.

## 4. Diversity of Thought and Skill Becomes Regarded as an Asset

The security landscape continuously evolves. In the past decade alone, we’ve witnessed the emergence of malware-as-a-service (MaaS), threat actors expanding by franchising their brand and technology to others, and attacks upon national infrastructure. Deepfake technology and bulk SMS messaging have been used to devastating effect. 

IT teams now face increasingly sophisticated opponents, with attacks delivered in greater volume over a variety of mediums. Combatting this will require organizations to draw from a wider range of skills when filling cybersecurity roles.

> “Bad actors have already diversified their thinking. Businesses must do the same,” said Jameeka Aaron, CISO at Auth0. 
> “I’ve always argued for a holistic approach to information security,” she added. “Technical skills are important, but so are the soft skills.”

To find candidates with these skills, organizations will have to broaden their hiring criteria and recruit from places they didn’t previously.

> “To respond to this new threat landscape, businesses will have to shift their focus away from GPAs and certifications. You need people who can build bridges within the organization and evangelize good security practices. And going forward, I can imagine hiring managers will recognize communication and language skills as assets, too,” said Aaron.

## 5. Consumer patience wanes over privacy breaches

Five years ago, Have I Been Pwned — a service that allows members of the public to check whether their personal credentials have been leaked — held records on 1.4 billion accounts. Today, that figure is almost 11.5 billion.

Coinciding with that almost tenfold rise is a greater awareness of security breaches among the general public, and signs their patience has begun to wane. According to Auth0’s latest CIAM survey, 92% of consumers expect businesses to keep their personal information safe.

> “A decade ago, security breaches were smaller and less likely to be headline news,” said Sampaio. “Now, they’re front-page news, and they’ve ensnared some of the largest brands in the world. People are tired and scared, and they want businesses to raise their game.”

Perhaps surprisingly, the survey showed that a larger percentage of businesses, 97%, believe they are obligated to protect their customers’ personal information.

> “This figure likely has its roots in many places. Security breaches are bad PR and are hugely costly for the company involved,” said Sampaio.
> “Recent legislation, most notably GDPR, LGPD, and APPI, introduces significant monetary penalties for organizations that experience a security breach. That raises the pressure further.”

## 6. Consumers Begin Expecting Data Portability & Interoperability

From healthcare and financial services to social networks, consumers increasingly recognize the value of data interoperability and portability. It allows you to seamlessly share medical records between practitioners, to see your banking and credit card information from a single central hub, and port your playlist between streaming services.

> “One of the most popular apps in the App Store is Mint, which lets users track spending across their accounts. In the US, FHIR (Fast Healthcare Interoperability Resources) is making it easier for doctors to see the information held on their patients by other medical professionals. From a consumer’s perspective, interoperability is something that makes their lives easier, and data portability allows them to make real choices about who they do business with,” said Lucy McGrath, VP of Privacy at Auth0.

![Interoperability](https://images.ctfassets.net/23aumh6u8s0i/11v4gylcGVWijlKWnhibFw/f7e091c1883197d00af99737574c649d/cybersecurity-prediction-sep2)

Data portability is already a consumer right in Europe thanks in part to GDPR and a number of global sectoral laws - particularly in finance and banking. McGrath expects demand for both portability and interoperability to increase in 2021 and beyond. The OECD has outlined the detailed benefits and challenges in its report _Data portability, interoperability and digital platform competition, OECD Competition Committee Discussion Paper,_ [here](https://www.oecd.org/daf/competition/data-portability-interoperability-and-digital-platform-competition-2021.pdf).

> “It’s likely that we’ll see consumers’ expectation for choice - data portability and interoperability - enshrined in more global laws. It’s an exciting space that is spurring innovation - it’s essential the technology supporting the choice continues to protect the privacy of consumers and security of their data in these complex ecosystems” McGrath said.

Top 6 Cybersecurity Predictions for 2022

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Desire for ease and security driving consumers to seek out modern identity technology

> Editor's Note: The Login Experience Customers Want study has been expanded to include 12 markets and is now available as part of The Log Inn campaign. To learn more about the campaign and read the full study please visit: https://info.auth0.com/expectation-vs-reality

**LONDON – June 1, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced findings from its international research into Customer Identity and Access Management (CIAM), ‘[The Login Experience Customers Want](https://info.auth0.com/expectation-vs-reality).’ The study, conducted by Auth0 and YouGov, reveals that most organizations fail to meet consumer expectations around login technology, highlighting how a login box can impact the user experience of a brand.

The study found that consumers around the world want greater choice in login technologies, and actively seek them out. Half (47%) of consumers surveyed say they are more likely to sign up to an app or online service if a company offers Multi-factor Authentication (MFA). More than four in ten (44%) are also more likely to sign up if they can log in with [Single Sign-On (SSO)](https://auth0.com/case-studies/siteminder/) – using a single ID and password for multiple related services, followed closely by demand for biometrics (42%), [social logins](https://auth0.com/case-studies/flo-health/) (34%), and passwordless (32%). 

Most businesses don’t offer these login options, despite the demand, and general [frustration with using traditional passwords](https://info.auth0.com/expectation-vs-reality). While 45% of businesses surveyed do offer SSO capabilities, less than [one-third offer MFA](https://auth0.com/case-studies/siemens/) (28%), biometrics (21%), social logins (31%), or passwordless (20%). Across the six markets surveyed, 11% of the IT and marketing decision makers said they don’t offer any of these login technologies.

“Clearly, there’s a gap between consumer and business expectations, but it really comes down to convenience. Consumers want to use digital services, but if the login process is clunky or frustrating, they will take their businesses elsewhere,” said Steven Rees-Pullman, SVP, International at Auth0. “With the proliferation of online threats, organizations are challenged to find the right balance between ease and security, and it’s really an ‘aha moment’ when they realize how identity management can help.”

Comparing the results internationally, European organizations are on par with their Asia-Pacific counterparts in offering SSO for their customers; however, they’re well behind the curve when it comes to biometric login adoption vs. consumer expectations. UK businesses are falling especially short when it comes to biometrics, where only 14% of businesses offer biometrics, MFA (28%), and passwordless (13%). 

APAC organizations are ahead of their European counterparts in offering technology such as social logins, biometrics, and MFA. Australian and Singaporean businesses are twice as likely to use biometric login, with 34% of IT and marketing decision-makers surveyed saying their companies currently offer customers the ability to log in with the use of biometrics, compared to Germany (17%), Japan (15%), France (14%), and the UK (14%).

“MFA and SSO are still relatively new technologies for the vast majority of organizations, and developing biometrics or passwordless is a heavy lift,” adds Rees-Pullman. “With a modern identity platform, businesses can not only offer the easiest and most secure user experience possible, but they can also experiment with different login options to find what works best for their audience.”

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

## Methodology

‘The Login Experience Customers Want’ study was conducted online by Auth0 and YouGov between 23 February and 1 March 2021. The research consisted of two surveys, questioning more than 8,000 consumers and 1,200 IT and marketing decision-makers who work for businesses that offer an app/online service to customers (excluding sole-traders) across six global markets: the UK, France, Germany, Australia, Singapore, and Japan. The data for the consumer study was post-weighted by age, gender, and region to reflect the latest population estimates in each market.

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com)

Businesses Fall Short of Consumer Expectations for Login Experiences, Auth0 Survey Reveals

jameeka_aron

Jameeka has over 20 years of Information Technology and Cyber Security experience. She is a versatile leader, successfully leading teams as both a CISO and CIO across various industries including; Aerospace & Defense, Apparel, Retail, and Manufacturing at both Fortune 100 and privately held companies and many spaces in between. 
She is highly skilled in Business Engagement (International and U.S. based) Audit, Compliance, Vulnerability, Risk and Identity Management, Digital Transformation, Mergers, Acquisitions, Divestitures, and leading Cross-Functional and Matrixed teams.

CISO

Jameeka Aaron

The consumer speaks — how readiness to scale wins the security and privacy battle for the customer

If you sped through your digital road map during the pandemic and are looking to fill security and privacy gaps right now, go back and check out my earlier posts:

* [Accelerated Your Road Map? Go Fix Workforce and App Security](https://auth0.com/blog/accelerated-your-road-map-go-fix-workforce-and-app-security)
* [Workforce and App Privacy Have Changed, So Should You](https://auth0.com/blog/workforce-and-app-privacy-have-changed-so-should-you)

 
This post is about making the shift from reaction to preparation so that you are ready for the next moment that requires speed – and set up to scale.

## Find Your Balance

In all of these posts, we mention speed and imply pressure. There is always going to be a business reason to get an app to market as quickly as possible. You will discover vulnerabilities that require your immediate attention. And regulations will set deadlines for you. 

So there is always going to be more you could do to improve security for your customers, your business, and the rest of the internet. Even for veteran security professionals, the pandemic was a reminder that we still need to pick and choose priorities. If you have an internal security team, lean into their expertise. Give them the time and space to guide you on priorities. Listen to their assessments of risk and let them set a pace that works for your business.

Longer-term security and privacy improvements can have big payoffs. Like the previous posts, these things require action. You’re also going to need to support your existing security team or create one. By support, I mean backing conversations about risks with budget for tools, external vendors, and hiring internal talent.

If you don’t currently have security or privacy teams, we’ll cover a bit of advice on what to look for as well.

## Consumers Expect and Deserve Strong Security and Privacy

Let’s also set some context.

There was a time when businesses leaned heavily into just shipping the product. Speed often won over security or privacy.

> Consumers are telling us that time is over.

In a [recent global survey](https://www.mckinsey.com/business-functions/risk/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative), McKinsey found that 87% of consumer respondents said security practice concerns would mean they wouldn’t do business with a company, and 71% would stop doing business if it gave away sensitive data without their permission. 

> The more secure and private app is now the one that keeps and attracts customers. 

## Security: Longer-Term Planning

If you’re looking to make a dramatic improvement in your cybersecurity, these best practices will help get you there.

* **Increase pen test frequency.** Penetration testing (pen testing) includes hiring an external vendor to test your application and site for vulnerabilities and provide you with a report cataloged by severity. Many companies do this once a year and call it good. In today’s evolving threat environment, that’s not enough. If you can up your pen testing to every quarter — and take action on what you learn — you’ll see a big increase in security. Adding a pen test after every major operating system upgrade, library update, or major code push will do even more.
* **Improve your software development life cycle (SLDC).** Many shops are still doing security after the product is completely coded, but this creates an automatic security backlog that can not only slow getting your product to market it can put pressure on your execs to allow unnecessary risks into the wild. Involving security and privacy teams as software is being developed allows them to raise questions that influence architecture before burning hours of engineering time. Few people like to put hours and hours into something only to have to take it apart, so your devs are rarely pleased to see this analysis tacked on at the end of the SLDC., which leads me to my next point.
* **Encourage ownership and collaboration between devs and security.** How you introduce the idea of static and dynamic code analysis as well as overall participation of security in the SLDC matters. Explaining that humans are fallible, so all code is going to have vulnerabilities, and there are going to be remote code executions (RCEs) is a good place to start. As a dev, they don’t want RCEs creating headaches, and they don’t want to get paged and work nights because problems have been discovered and exploited. You can encourage ownership by asking your dev team to review the security team handling analyses. Ultimately, this can go a long way towards establishing security-dev collaboration, leading to apps that get to market more securely as well quickly.
* **Create a golden image.** A [golden Image](https://www.cisecurity.org/cis-hardened-images/)is a single machine image that has been tested and hardened. When there is an operating system or library update, the AMI gets updated and tested. This allows you to see how your customers might be impacted before you push that patch update out to thousands of users. It also provides an approved starting point for new business units or apps. The time it takes to create and maintain this image pays off in protected services and reduced downtimes. Using [hardened](https://en.wikipedia.org/wiki/Hardening_(computing)) images also increases reliability and consistency.

## Hiring Security Talent

Security can seem like an area that is purely technical — and your team does need to have a deep understanding of your product and how it works, but sooner or later, a human is going to touch or use your product. Strong security talent needs to understand human behavior from bad actors to customers. Your chief information security officer (CISO) also needs to be able to explain technical risks and benefits to non-technical executive teams.

There’s a cybersecurity talent shortage globally. According to an International Information System Security Certification Consortium (ISC)² [report](https://www.isc2.org/Research/Workforce-Study#), that shortage shrank slightly during the pandemic, from 4 million open jobs in 2019 to 3.1 million. You’re going to need to compete for talent.

Your new CISO also needs to understand your industry because threats are often industry-specific. Here are some questions to ask your hiring team when considering a potential candidate:

* Are they passionate about not only security but also your company?
* Do they have experience in your industry? If not, how adept are they at cross-applying knowledge?
* Areas of expertise? If you need them to be a generalist, do they understand how to source third-party support (and are you willing to fund that support)?
* Do they welcome diversity? 
* Do they contribute to open source security? 
* Do they regularly attend and speak at conferences?
* Can they explain the business case for your product?

## Privacy: Longer-Term Planning

Consumers are demanding a secure and contextual private experience — and we’re seeing regulators back them up with a variety of data privacy regulations.
 
"_By industry, consumers are most comfortable sharing data with providers in healthcare and financial services, though no industry reached a trust rating of 50 percent for data protection,_” notes [McKinsey](https://www.mckinsey.com/business-functions/risk/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative).

This isn’t one of those things that is going away, says Auth0’s Vice President of Privacy Lucy McGrath. Globally, we’re seeing consumer groups becoming more vocal about data privacy concerns and violations with filings against companies like [What’sApp](https://www.beuc.eu/publications/consumer-groups-file-complaint-against-whatsapp-unfairly-pressuring-users-accept-its/html). 

“_Data privacy is going to continue to evolve with consumers’ awareness and expectations,_” says Lucy. “_To adapt, companies are going to have to think beyond just meeting the bare minimum of legal requirements. They need to ask themselves hard questions about what protections are appropriate given the context and the humans you’re interacting with and work through the answers. We need to be building proactive privacy programs that reflect these data privacy conversations. Creating consumer trust requires listening and deliberate action._”

Start with these questions:

* Have I taken the time to understand the relationship my digital properties (app, site) create with my customers? How do I want them to feel at login? What about as they continue through my app or site? 
* Am I encouraging or discouraging trust by how I gather consent and data? 
* Have I created a transparent customer experience (CX) with clear consent and options? 
* If I am really honest with myself, do I need to change something? Do I really need this data?
* Who are my customers? What does privacy mean to them in the context of my services? 
* Do I have appropriate basic security and data governance processes in place? 
* Have I invested extra resources and time to protect the most sensitive/high-risk data such as health, financial, religious, or sexual orientation information? 
* Do I have any customers in regulated jurisdictions such as the European Union (EU) or California? If so, when was the last time I checked in with my legal counsel to make sure I’m in line with current requirements?

## Provide Cues for Safety and Trust

[Apple’s nutrition labels for data privacy](https://www.wired.com/story/apple-app-privacy-labels/) make good on efforts that have been around since the 2010s. If your new app is going to be in the App Store, Apple requires that you report publicly on data you’re using to track your customers, data linked to them, and data gathered but not linked to them. Even though Apple is relying on app developers to self-report, the labels increase consumer awareness and expectation, says Lucy. Given Apple’s size ($274.5 billion reported revenue in 2020 makes it the world’s largest company), these nutrition labels signal that data privacy is now an everyday consumer concern.

“_Businesses who don’t respond could miss out_”, says Lucy. “_The threats of data privacy fines and unhappy customers are real, but so is the opportunity to create customer experiences (CX) that drive brand loyalty. The entire tech industry is coming together to work on these data privacy challenges. Companies that act on the side of the consumer stand out._”

## Hiring Data Privacy Talent

Like security, data privacy professionals need to understand and express the intersection of humans and technology. They need to be able to communicate risks and benefits across an entire organization, with an emphasis on engineering, marketing, and senior leadership. Critical and analytical thinking, empathy, and consideration of different motivations and perspectives are key. Technical knowledge around privacy laws can be taught, but an ability to engage, listen and understand the context of the business and their customers is essential. Privacy isn’t “done” by privacy professionals - they support all parts of the business to build privacy protections into their individual business processes.

Lucy recommends that you ask candidates questions to show how they think about privacy issues in the context of the businesses in which they work. Examples of such questions include: 

* How would you demonstrate the value of good privacy practices to the chief financial officer (CFO)?
* How do you respond to the statement: privacy slows the business down? 
* What can you do to support developers to integrate privacy controls into their development lifecycle?
* Provide examples of when you have translated legal obligations into plain English requirements that the business can implement?
* Which company does privacy well? Why? How would you implement similar standards here?
* What are the key privacy risks that need to be prioritized? What actions are required to mitigate these risks?

## You’re Helping Make the Internet Safer

Thank you for checking out this series. One of the things that came up while working on this content is how the pandemic has made everything even more connected. The [threat landscape](https://auth0.com/resources/whitepapers/state-of-security-identity-report) and regulatory requirements can seem overwhelming, but taking the time to secure your personal data, your customer’s data, and your businesses make it harder for bad actors.

Identity can be a weak spot for both security and privacy if it’s not handled by experts. A strong Customer Identity Access Management (CIAM) solution like Auth0 can increase your security, support your data privacy strategy, and comes with certifications for various compliance requirements like [ISO 27001:2013](https://auth0.com/blog/what-is-iso-27001-2013-a-guide-for-businesses/) and [ISO 27018:2019](https://auth0.com/blog/what-is-iso-27018-2019-everything-executives-need-to-know/) and [CSA Star](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/). If you’d like to learn more about how Auth0 can help make your business more secure and stay ahead of your customers’ evolving expectations, please [reach out to the team at Auth0](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales).

<include src="asides/AboutAuth0" />

Time to Prepare: Be Ready to Scale Your Workforce and App

chris-adriaensen

Chris is a Lead Solutions Engineer at Auth0 and has been in the digital identity industry for about 10 years. He works with clients to build successful and trusted solutions using Auth0's platform. Prior to joining Auth0, Chris was a Solution Architect at ForgeRock, as well as Verizon, where he worked on various strategic identity projects.

Lead Solutions Engineer

Chris Adriaensen

A look at four different authorization models to map users to the correct permission

> EDITOR’S NOTE: Welcome to the EMEA Blog Takeover, where our EMEA employees take over the Auth0 blog to share success stories from the region. This week, you’ll meet our thought leaders across the pond, discover some of our most compelling use cases, and read about the trends that influence how we do business.

## The Scene

Online media includes a vast world of mostly free and some exclusive paid content, consumed through a plethora of devices. We read the news and listen to music on our phones or smart assistants, skim articles and books on our tablets, and watch movies on our laptops or TVs. More and more, the shape of our devices is changing — from hand-held and large-screen TVs to standalone speakers and connected cars.

In the highly-competitive world of media, understanding the consumer can make the difference between going under or keeping your head above the water. Users need to be able to find media on their devices and consume it at the time they prefer. Keeping the user engaged by offering additional media choices builds loyalty and increases consumption, making room for additional revenue streams.

<include src="TweetQuote" quoteText="The shape of our devices is changing — from hand-held and large-screen TVs to standalone speakers and connected cars."/>

Understanding the consumer’s [social graph](https://www.google.com/url?q=https://en.wikipedia.org/wiki/Social_graph&sa=D&ust=1559296160314000&usg=AFQjCNETRz-kST9SoFHeZgzwLticknD59A) can provide a competitive edge, as it allows media providers to differentiate between different consumers sharing a subscription. This is critical to avoid mixing up personalization efforts, while correctly tailoring media access and subscription usage according to a user’s location, role, and age (e.g. restricting content for younger audiences). Knowing how the consumer relates to others in their network also helps to provide more relevant media recommendations.

Many established media providers are still grappling with [digital transformation](https://auth0.com/blog/solving-5-media-industry-challenges-with-auth0-identity-solutions/). While there are innovative ways to design a [paywall strategy](https://auth0.com/blog/the-role-of-ciam-in-implementing-a-sound-paywall-strategy/), paywalls can be challenging as content has increasingly become abundant and often free. A frictionless consumer onboarding process with a low barrier to entry is key, as well as an outstanding initial, and continued, digital customer experience. For this you need a minimal amount of effort needed to setup an account as well as a low commercial threshold, such as a 1-month free or low-entry monthly subscription.

Lots of providers today merely focus on a subscriber account, and perhaps attach some profiles, missing out on truly understanding their consumers. We all know how subscriptions are shared — even with attached profiles it doesn’t provide good separation — and consumers get annoyed when personalisation engines get confused. Furthermore, children grow up, employees move companies, users can become full-blown subscribers themselves, people move across countries … starting with a blank digital profile is painful for all parties involved.

<include src="TweetQuote" quoteText="A frictionless consumer onboarding process with a low barrier to entry is key."/>

## Authorization Models

As we’ve discussed, it’s important for every user to have his or her own account, or data gets mixed and becomes useless very quickly. Let’s imagine a simple traditional family setup: **mom** and **dad** manage the subscription (`1234`), also used by two children, an adult (`child_adult`), and a minor (`child_minor`). We also have a partner of the oldest child using the subscription (`partner_child_adult`). All of them have seperate accounts and we assume they can be recognized seamlessly by all the devices. We’re going to focus on how users are mapped to permissions, i.e. the authorization model used.

> **Note:** The examples below are simplified for illustrative purposes. Please reference the linked documentation for more information about the specific features can be used to implement these models.

## Discretionary Access Control (DAC)

In a DAC model, all permissions are assigned directly to users, so the model is basically a direct mapping between users and permissions. It holds little information as to why permissions are assigned they way they are, and hence makes it extremely inflexible and hard to manage. In our family example we have five permissions, administration of the subscription (`sub_admin`), access to minor-approved content (`content_minor`), access to High Definition streaming any content (`content_hd`), access to content for 18 years of age or older (`content_adult`), and access to admin-only content (`content_admin`). 

![Discretionary Access Control](https://images.ctfassets.net/23aumh6u8s0i/7kn3G5wVhONPOg2SyKCbZA/b2b348844ef44f90f79bc0ded46a22d1/dac)

Our example using DAC:

```javascript
// RULES: DAC
// set subscription
context.accessToken[`subscription`] = user.subscription;
	
// collect permissions
for (permission in user.permissions) context.accessToken.scope.push(permission);

// USER: MOM
“subscription”: 1234,
“permissions”: [“sub_admin”, “content_minor”, “content_hd”, “content_adult”, “content_admin”]

// USER: DAD
“subscription”: 1234,
“permissions”: [“content_minor”, “content_hd”, “content_adult”]

// USER: CHILD (ADULT)
“subscription”: 1234,
“permissions”: [“content_minor”, “content_hd”, “content_adult”]

// USER: CHILD (MINOR)
“subscription”: 1234,
“permissions”: [“content_minor”, “content_hd”]

// USER: PARTNER (CHILD ADULT)
“subscription”: 1234,
“permissions”: [“content_minor”, “content_adult”]
```

The amount of static decisions to make in this DAC model would be:

```javascript
complexity_dac = users * (subscriptions + permissions)
[users: 10.000, subscriptions: 5.000 & permissions: 5 => 50.050.000]
```

When faced with an extremely small number of users, subscriptions, and permissions, it might still be manageable. At Auth0, we provide support for DAC by [allowing permissions to be stored directly in the user’s account](https://auth0.com/docs/users/concepts/overview-user-metadata) in the `metadata` fields, which can store generic JSON information.

## Role-Based Access Control (RBAC)

In an RBAC model, an abstraction layer is introduced using the concept of roles or groups. Each role or group can be attached to multiple users on one side and multiple permissions on the other side. In other words, instead of having permissions directly assigned to users, they’re now assigned to roles, which in turn get assigned to users.

![Role-Based Access Control](https://images.ctfassets.net/23aumh6u8s0i/23aOZR4SybM4AtiLhtF6aY/e275fd5129f75e6afaf986754aea8c77/rbac)

Our example using RBAC:

```javascript
// RULES: RBAC
// set subscription
context.accessToken[`subscription`] = user.subscription;

// collect roles and permissions
for (role in user.roles)
	for (permission in role.permissions) context.accessToken.scope.push(permission);
	
// ROLE: ADMIN
“permissions”: [“sub_admin”, “content_admin”]

// ROLE: FAMILY (MINOR)
“permissions”: [“content”, “content_hd”]

// ROLE: FAMILY (ADULT)
“permissions”: [“content”, “content_hd”, “content_adult”]

// ROLE: FAMILY (EXTERNAL)
“permissions”: [“content”, “content_adult”]

// USER: MOM
“subscription”: 1234,
“roles”: [“admin”, “family_adult”]

// USER: DAD
“subscription”: 1234,
“roles”: [“family_adult”]

// USER: CHILD (ADULT)
“subscription”: 1234,
“roles”: [“family_adult”]

// USER: CHILD (MINOR)
“subscription”: 1234,
“roles”: [“family_minor”]

// USER: PARTNER (CHILD ADULT)
“subscription”: 1234,
“roles”: [“family_external”]
```

The amount of static decisions to make in this RBAC model would be:

```javascript
complexity_rbac = users * (subscriptions + roles) + roles * permissions
[users: 10.000, subscriptions: 5.000, roles: 4 & permissions: 5 => 50.040.020]
```

When there are significantly fewer roles than permissions, it can vastly reduce the complexity. With Auth0, RBAC can be implemented through the use of [roles](https://auth0.com/docs/authorization/guides/manage-roles) — permissions can be assigned to roles and roles to users in a static way, either using the Administrator UI or the Management API.

## Attribute-Based Access Control (ABAC)

In an ABAC model, policies are introduced that can dynamically determine how permissions are assigned to users based on attributes of the user, but also whatever information is available to the policy engine (like request or context information). 

![Attribute-Based Access Control](https://images.ctfassets.net/23aumh6u8s0i/6rUta5WyLMmZSoL4Q7pxM6/33a1a814369958b0df2121b70e5c7a5a/abac)

Our example using ABAC:

```javascript
// RULES: ABAC
// set subscription
context.accessToken[`subscription`] = user.subscription;

// check if admin and add permissions
if (user.admin) context.accessToken.scope.push(["sub_admin", "content_admin"]);

// check if family and add permissions
if (user.external) context.accessToken.scope.push("content");

// check if adult and add permissions
if (user.age >= 18) context.accessToken.scope.push("content_adult");

// check if not external and add permissions
if (!user.external) context.accessToken.scope.push("content_hd");

// USER: MOM
"subscription": 1234,
"admin": true, "external": false, "age" : 45

// USER: DAD
"subscription": 1234,
"admin": false, "external": false, "age" : 47

// USER: CHILD (ADULT)
"subscription": 1234,
"admin": false, "external": false, "age" : 20

// USER: CHILD (MINOR)
"subscription": 1234,
"admin": false, "external": false, "age" : 16

// USER: PARTNER (CHILD ADULT)
"subscription": 1234,
"admin": false, "external": true, "age" : 21
```

The amount of static decisions to make in this ABAC model would be:

```javascript
complexity_abac = users * (subscriptions + attributes)
[users: 10.000, subscriptions: 5.000, attributes: 3 => 50.030.000]
```

When the number of attributes is significantly lower than the number of roles or permissions, it can vastly reduce the complexity. Of course, now a dynamic component of policies is introduced. At Auth0, we provide support for ABAC through [rules](https://auth0.com/docs/rules), which are JavaScript snippets that run after login and allow customizing the permissions returned to the applications.

## Relationship-Based Access Control (ReBAC)

In a ReBAC model, a graph-based model is introduced between users and subscriptions, and policies dynamically determine how permissions are assigned to users based on relationships of the user. This allows for a lot more expressive and powerful policies, enabling the business to truly understand the user’s environment and act accordingly. 

![Relationship-Based Access Control](https://images.ctfassets.net/23aumh6u8s0i/4ijiLd7E4K6FbKLYzfKVku/76e6faa1377b5e6f6311bae7d66e0518/rebac)

Our example using ReBAC:

```javascript
// RULES: REBAC
// if subscription is managed by user …
if (sub:subscription--managed_by-->user:user)
	context.accessToken[`subscription`] = sub:subscription.number;
	context.accessToken.scope.push([“sub_admin”, “content_admin”]);

// if user is related to admin of sub with max 2 hops …
if (sub:subscription--managed_by-->--related_with(2)--user:user)
	context.accessToken[`subscription`] = sub:subscription.number;
	context.accessToken.scope.push(“content”);

// check if adult and add permissions
if (user:user.age >= 18) context.accessToken.scope.push(“content_adult”);

// if user is related to admin of sub with max 1 hop ...
for (sub:subscription--managed_by-->--related_with(1)-->user:user)
context.accessToken.scope.push(“content_hd”);

//RELATIONSHIPS
sub:1234--managed_by-->user:mom
user:mom--related_with-->user:dad
user:mom--related_with-->user:child_adult
user:mom--related_with-->user:minor_adult
user:child_adult--related_with-->user:partner_child_adult

// USER: MOM
“age” : 45

// USER: DAD
“age” : 47

// USER: CHILD (ADULT)
“age” : 20

// USER: CHILD (MINOR)
“age” : 16

// USER: PARTNER (CHILD ADULT)
“age” : 21
```

Notice that we’ve now stated that everyone who’s related to the admin of the subscription within one hop is considered “close family” and is able to stream content in HD, and everyone who’s related to the admin of the subscription within two hops can access content, allowing all “in-law family” to access content as well, not only **child_adult_partner**.

The amount of static decisions to make in this ReBAC model would be:

```javascript
complexity_rebac = users * attributes + subscriptions + users * (users - 1) / 2
[users: 10.000, subscriptions: 5.000, attributes: 1 => 50.010.000]
```

When the number of attributes is significantly reduced through a small number of possible relationships, it can vastly reduce the complexity. Although harder to quantify, it’s clear it provides more power to define generalized policies. As with ABAC, Auth0 supports ReBAC through the use of rules, which can call out to external sources such as a graph database, where the model can be stored and queried efficiently.

The same model could also be used to enrich the information provided back to the application for improved personalization. This allows for a smoother migration of accounts, as social graphs don’t need to change, and can handle more complex setups. For example, an admin on one subscription could also have non-admin access to another subscription.

## Conclusion

We looked at four different authorization models to map users to the correct permissions:

1. **Discretionary Access Control** (DAC) where permissions are statically assigned to users directly and only proven manageable with extremely small amounts of users, subscriptions and permissions. Supported by Auth0 using [metadata](https://auth0.com/docs/users/concepts/overview-user-metadata) on accounts.

2. **Role-Based Access Control** (RBAC) where permissions are statically assigned to roles/groups which in turn are assigned to users, vastly reducing complexity when less roles than permissions. Supported by Auth0 using integrated [roles](https://auth0.com/docs/authorization/guides/manage-roles).

3. **Attribute-Based Access Control** (ABAC) where permissions are dynamically assigned in policies to users based on the attributes or roles/groups of the users, vastly reducing complexity when less attributes than roles/groups and permissions. Supported by Auth0 using [rules](https://auth0.com/docs/rules).

4. **Relationship-Based Access Control** (ReBAC) where permissions are dynamically assigned in policies to users based on the relationships or attributes of the users, vastly reducing complexity when attributes are significantly reduced through a small number of possible relationships. Not only does it provide some complexity gains it also allows for far more complex scenarios to be modeled. Supported by Auth0 using [rules](https://auth0.com/docs/rules), calling out to an external graph database.

<include src="asides/AboutAuth0" />

---

Understanding a Media Consumer’s Social Graph

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

How the economy, kubernetes vulnerabilities, and consumer complacency could equal more regulation.

Some argue that the [_number of reported data breaches in 2018_](https://www.forbes.com/sites/kateoflahertyuk/2018/12/19/breaking-down-five-2018-breaches-and-what-they-mean-for-security-in-2019/#735992841c4f) is the result of [_GDPR_](https://auth0.com/gdpr/)’s requirements. Still, the cascade of recent breach reports suggests that 2019 might be a tough year for cybersecurity. I asked our [_CISO/VP of Operations Joan Pepin_](https://www.linkedin.com/in/joanpepin/) and [_Security & Engineering Operations Director Duncan Godfrey_](https://twitter.com/duncangodfrey) about what we might expect.

<include src="TweetQuote" quoteText=".@auth0’s @CloudCISO_Joan and Security & Ops Eng. Dir. @duncangodfrey share their Top 5 Cybersecurity Predictions for 2019."/>

![Reduced Security Spend Will Lead to Economically Motivated Cybercrime](https://images.ctfassets.net/23aumh6u8s0i/45sm4mVBhnx0sbpZGkzhUg/fd99c7aaa6f3e407989cca122cc6ddd7/reduced-security-spending)

## 1. Reduced Security Spend Will Lead to Economically Motivated Cybercrime

[_Economic indicators in the US and globally do not look good_](https://www.theguardian.com/business/2018/sep/13/recession-2020-financial-crisis-nouriel-roubini), with tech companies having borne the brunt of recent market corrections, says Auth0 CISO/VP of Operations Joan Pepin. “I predict that 2019 will be a difficult year for security funding, and companies across the spectrum will freeze or reduce Information Security spending. An increase in economic hardship and a reduced defensive posture will therefore probably lead to more economically motivated cybercrime in 2019.”

![Information Warfare Around the Globe](https://images.ctfassets.net/23aumh6u8s0i/1Cug9bge9KqWfBDXABTtkq/80a2b903b524834e70397a3a4489972e/information-warfare-around-the-world)

## 2. Information Warfare to Target U.S. Companies, Specifically Defense and Communications

“[_We may be entering a new cold war with China_](https://www.washingtonpost.com/opinions/the-us-and-china-are-on-the-brink-of-cold-war-20-this-is-how-to-avoid-it/2018/11/29/24105fb6-f409-11e8-aeea-b85fd44449f5_story.html), as the trade war continues, now inflamed by actions taken against Huawei by Canada and the US,” says Joan. “I expect this to lead to increased cyber activity by the already rather active Chinese government, which may expand its operations to include more Russian-style disinformation and [_information warfare_](https://auth0.com/blog/information-warfare-offensive/). Look for major U.S. companies, especially large defense and communications providers to be the targets of this activity in 2019.”

![Kubernetes Vulnerabilities Lead to the Year of the Big Container Escape](https://images.ctfassets.net/23aumh6u8s0i/PNPKw8C7NEczARd71Ypg4/e46d0c07b0a306f2093ad3605ee4339e/kubernetes-vulnerabilities)

## 3. Kubernetes Vulnerabilities Lead to the Year of the ‘Big Container Escape’

When [_ZDNet reported a major security vulnerability with Kubernetes containers_](https://www.zdnet.com/article/kubernetes-first-major-security-hole-discovered/) early in December 2018, they noted that “[_Kubernetes_](https://kubernetes.io/) has become the most popular cloud container orchestration system by far, so it was only a matter of time until its first major security hole was discovered.”

That nothing in software is perfect is accepted news for devs and enterprises, but it’s also becoming an accepted thing for consumers (see prediction #4).

The Kubernetes privilege escalation flaw is a big deal, but it’s only the latest in the system’s [_discovered flaws_](https://www.twistlock.com/labs-blog/deep-dive-severe-kubernetes-vulnerability-date-cve-2017-1002101/), says Auth0 Security & Engineering Operations Director Duncan Godfrey. “Continued vulnerabilities to be found in Kubernetes infrastructure and the big one in 2019 is the Year of the Container Escape.”

![Cybercrime Accepted as Cost of Doing Business by Consumers](https://images.ctfassets.net/23aumh6u8s0i/foaom10ipH3jQBufHbbSc/c38ec328a63d0cc4ad50eb0a20639441/cybercrime-accepted-as-cost-of-doing-business)

## 4. Cybercrime Accepted as ‘Cost of Doing Business’ by Consumers

Despite multiple open investigations into [_Facebook’s series of breaches and sharing of personal data with other corporations without users’ permission_](https://www.nytimes.com/2018/12/18/technology/facebook-privacy.html), Joan doesn’t predict a permanent impact for the company — because consumers are reacting more like businesses (and Facebook’s attorneys will do their jobs).

Joan offered an example from her years as an outsourced security provider for an incident response company for Fortune 100 and Fortune 500 companies.

A major investment bank was having a massive issue of being dossed and having public-facing servers being breached. While on a conference call with all their vendors, including Cisco and Checkpoint and 30 bank vice presidents, the bank’s CTO said he had one question: “Is this happening to anybody else?”

Before Joan answered, she asked if he was going to divert the team to answer the question and if the answer was “yes,” what did he plan to do differently? He said if the answer was “yes,” he would “feel better” — a prime example of an enterprise settling into the cost of doing business online (although whether or not he needed to accept that particular cost could be debated).

“Having your identity stolen is horrifying for the individual, but my observation is that it’s perceived differently when lots of people are affected. After a breach, people don’t change their habits. People still shop at Target, stay at Marriott, and share information on Facebook. I’m not a psychologist or neuroscientist, but these facts lead me to believe that the trend of consumers accepting cybercrime as a cost of being online will continue into 2019.”

Because companies are not economically motivated to change and consumers may not feel empowered (let’s face it, [_the tiny payout from a class-action lawsuit_](https://www.consumerreports.org/data-theft/class-action-lawsuits-against-marriott-data-breach/) won’t pay for the damage and heartache of having your identity stolen), Joan expects regulators to step in, which leads us to Prediction #5.

![Expect More Data Privacy Regulation in 2019](https://images.ctfassets.net/23aumh6u8s0i/3rJMQ4kQiwVdRbwXuyouCj/dac8b3d32b2c2c2e3cba383fd02dba10/more-data-privacy-regulation)

## 5. Expect More Data Privacy Regulation

Shortly after the [_Marriott Mega Breach_](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/), the [_UK, the FBI, and three U.S. states opened investigations_](https://www.forbes.com/sites/thomasbrewster/2018/12/03/revealed-marriotts-500-million-hack-came-after-a-string-of-security-breaches/#13788844546f). The Marriott stock dip identified in many news stories, parallels that of the U.S. stock market, says Joan. Fines can function as a partial deterrent, but investigation and regulation move at a much slower pace than the agile tech lifecycle — the business consequence often lags far behind the technological changes needed.

GDPR is delivering an increase in reported breaches, but not clearly within the regulation’s [_72-hour breach-reporting requirements_](https://www.cnbc.com/2018/10/02/facebooks-muddy-account-breach-response-could-be-the-new-norm.html) and recent regulation in Australia demonstrates more than a sync problem — the way that [_Australia’s new backdoor requirements_](https://www.wired.com/story/australia-encryption-law-global-impact/) are written cripple tech’s ability to function securely, says Joan. [_Recent U.S. Senate hearings_](https://thehill.com/policy/technology/420838-google-ceo-responds-to-steve-king-concerns-about-granddaughters-iphone) demonstrate that many of the legislators in charge of regulating tech require greater understanding and education.

The answer, says Joan, would be for the tech industry to have greater input into educating those in charge of the regulations, followed by rational debate, and empowered law enforcement.

Regardless of whether or not the tech industry can influence these ideal conditions, [_all signs suggest we should expect greater regulation in the U.S. in 2019_](https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/12/03/the-cybersecurity-202-senators-call-for-data-breach-penalties-tougher-privacy-laws-after-marriott-hack/5c0436431b326b60d12800d2/?utm_term=.e0c757791fde).

<include src="TweetQuote" quoteText="The economy, kubernetes vulnerabilities, and consumer complacency could equal more regulation in 2019 says CloudCISO_Joan and Security & Ops Eng. Dir. @duncangodfrey."/>

<include src="asides/AboutAuth0" />

Top 5 Cybersecurity Predictions for 2019

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 “leads the pack” in Product, Market, and Innovation categories

**BELLEVUE, Wash., – December 20, 2018 –** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that it has been selected as an Overall Leader in the KuppingerCole Leadership Compass for Consumer Identity Access Management [(CIAM)](https://auth0.com/b2c-customer-identity-management). This research report takes a thorough look at the overall CIAM industry, leading vendors, and the importance they play in managing millions of identities, and processing potentially billions of logins and other transactions per day. To download the full report, please click [here](https://auth0.com/resources/whitepapers/leadership-compass-for-ciam).

The Leadership Compass provides an overview of the industry and evaluates vendors based on the use cases, experiences, business rules, and technical capabilities required by B2C companies today, and their anticipated needs in the future. The criteria also involved evaluating overall functionality, security, partner ecosystem, licensing models, as well as specific features such as authentication options, APIs, IoT integration, and Single Sign On (SSO).

Auth0 is positioned as an Overall Leader in the industry, and is also featured in the Leadership category for the Product, Innovation/Technology, and Market categories. According to John Tolbert, lead analyst and author of the report, “Auth0 offers a full set of CIAM capabilities that can be integrated with customers’ existing IT infrastructure, including legacy applications. Auth0 has a high DIY value.”

Tolbert adds, “They identified a previously untapped segment in CIAM: developers. Auth0’s successful business model challenges traditional IAM and CIAM delivery models. Auth0 is a strong contender in the CIAM space, especially for organizations that need quick-to-deploy CIAM solutions. Those that have programming expertise alongside major consumer-facing applications should strongly consider Auth0 when doing RFPs.”

“Recognition of our unique value proposition for consumer enterprises from an analyst firm as well-regarded as KuppingerCole is incredibly gratifying,” said Eugenio Pace, CEO and Co-founder of Auth0. “We are thrilled with our placement in this report, and look forward to continuing to provide B2C customers with the product innovation and technology partnership they expect from a market leader.” 

The company’s developer-centric Universal Identity Platform and its extensibility options are why major [consumer enterprises](https://auth0.com/customers) rely on Auth0 for their identity needs. For more information about Auth0’s B2C offering, please visit: [https://auth0.com/b2c-customer-identity-management](https://auth0.com/b2c-customer-identity-management).

<include src="asides/AboutAuth0" />

## **Media Contacts:**
Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898

Auth0 Named Market and Technology Leader in KuppingerCole Leadership Compass for Consumer Identity Access Management

Auto buying and selling is made easier for consumers across Australia and New Zealand.

**BELLEVUE, Wash. &mdash; November 5, 2018 &mdash;** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that it is powering the authentication and login experience for [Autotrader in Australia](https://www.autotrader.com.au/). Auth0’s Universal Identity Platform was built into the site’s foundation to create a secure transactional environment and facilitate a seamless user experience.

Launched recently, Autotrader, a subsidiary of Cox Automotive Australia, aims to be the de facto trusted resource for anyone looking to trade their automobile. With providing an optimal consumer experience and securing user identity as main priorities, Autotrader knew that identity management was a core element of its platform. Integrating Single Sign On to securely authenticate its users across Autotrader and its sister site CarsGuide, is just one example of how Auth0 is being used.

Another critical factor in selecting Auth0 was its ability to support Autotrader’s go-to-market strategy. Recognizing that its development teams are not experts in identity provided them with the freedom to outsource and focus solely on developing the product to its potential.

“Whereas building something internally would have taken weeks or months, we've used Auth0 to go to market with a really premium consumer experience for Autotrader in days,” said Jeremy Gupta, CTO of Cox Automotive Australia. “By reducing that overhead, we can focus effort towards initiatives that allow us to be quicker-to-market and are potentially revenue-generating. And the second business challenge is the brand and protecting it, which is why securing identity data is crucial.”

Speed of implementation is one of Auth0’s many competitive differentiators, enabling companies to quickly integrate identity management in a way that eases developer resources. The end result is an end-to-end authentication platform that offers key features, such as security, usability, and a fantastic customer experience.

“A large part of our [growth in Australia](https://auth0.com/blog/auth0-announces-growth-in-australia-and-new-zealand/) is attributed to invaluable partnerships with innovative companies like Autotrader and CarsGuide,” said Eugenio Pace, CEO and Co-founder of Auth0. “Their decision rely on us for identity management and free up internal resources enabled them to get to market quicker, and also ensure they are providing their customers with a secure and seamless experience. We are excited to scale with them as they continue to gain market share.”

<include src="asides/AboutAuth0" />

### **Media Contacts:**
Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898

Autotrader Australia Relies on Auth0 to Optimize Security and Digital Experience for Users

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Consolidate and categorize your critical consumer data for better insights and enhanced security.

The world is obsessed with data. Companies, governments, academics — everyone is racing to collect and compile the largest data sets, believing the hype about their enormous value. While it's true that data can provide shrewd insights and help in directing an organization's strategy, [research is beginning to show](https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html) that more data isn't always better. In fact, there can be serious diminishing returns if your organization isn't set up to handle the volume of information, ranging from botched business analytics to irreversible damages from a data breach. 

Master data management is a set of tailored processes and techniques that allow teams to consolidate their critical streams of information into a single file. This helps ensure that each IT system, platform, and architecture across your entire company can view and work with data in a coherent way. Moreover, a centralized management system allows for broader and tighter security measures to mitigate the risk of hackers acquiring user information in certain formats.

<include src="TweetQuote" quoteText="Master data management is a set of tailored processes and techniques that allow teams to consolidate their critical streams of information into a single file."/>

## What Is Master Data Management?

Consider an example: You’re a fast growing e-commerce company. Every time a customer makes a purchase you collect their basic personal information, credit card information, a log of what they purchased, when, and occasionally from what device (e.g., mobile or desktop). This is all in addition to data you’ve already amassed on how often this user has visited your site, clicked through items, and placed items in their online cart. 

Since you're continuing to expand, you’ve also cataloged all of your products—how many you’ve sold, how many are back-ordered, what your top sellers are, and during what time(s) of year you have the highest turnover. As you continue to scale, you’ve brought on new employees and store their credentials to determine their access to the company's sensitive information. You keep records of other physical assets, such as equipment and inventory. These inputs keep multiplying as you grow.

In an organized format, this information should underpin a deep understanding of your customer base and support the development of targeted marketing campaigns. It should provide the foundation for calculating your inventory turnover rate and return on assets (ROA) and display a host of growth metrics to stakeholders, such as customer acquisition cost (CAC) and monthly recurring revenue (MRR). However, at the moment, it's decentralized and in a variety of formats, including separate databases, spreadsheets, and even physical reports.

Well-orchestrated master data management sets clear protocol for how data is amassed, in what formats, and sets firm policies for who can access sensitive information.

## Consolidating User Data With Auth0's Social Login

Auth0's social login feature provides an initial access point for master data management. Auth0 integrates with [30+ social providers](https://auth0.com/learn/social-login/) to streamline the collection of user data, incorporating specific security measures throughout the process.

Social Login requires three simple steps:

1. A user enters your application and selects their desired social network provider (e.g., Facebook).
2. A login request is sent to the social network provider.
3. The social network provider confirms the user’s identity, allowing new registration and access to your application. 

Integrating with social network providers allows your organization access to additional up-to-date information, such as the new user's interests and recent events attended, location and check-ins, birthday, and even shopping history. This rich stream of information is located in a single place and format. 

With streamlined information, you can create a comprehensive view of each of your customers:

![Consolidating User Data With Auth0's Social Login](https://images.ctfassets.net/23aumh6u8s0i/4QBUhWDjRe0EeeJLfIa0lb/b4c52da794dd0878f9df360331237730/Screen-Shot-2017-07-12-at-11)

A detailed understanding of your users will form the basis for showing them more personalized content. 

Social Login also includes email verification. This means that the onus is on the social network provider to deliver you real email addresses, mitigating your risk of allowing dishonest users into your application. In 2016, Deloitte fell victim to a [fake account](https://www.forbes.com/sites/thomasbrewster/2017/10/05/facebook-fake-hacks-deloitte-employee-iran-cyber-spies-suspected/#72914004188c). This made-up persona lured a Deloitte team member to open malicious documents, introducing malware designed to steal credentials into its system.

Employing a vetted identity access tool like Social Login will automatically streamline and secure an enormous volume of customer data. It will store the information in a standard format and create a cohesive view for your administrators to manage and for other team members to use for company insights.

## Master Data Management and Complying with GDPR

Master data management is even more important now that [GDPR finally entered into force](https://auth0.com/blog/data-privacy-doesnt-stop-at-the-eu-border/). These new rules apply to all those in the EU who control data and/or undertake data processing. Consumers have greater rights under GDPR including:

* A new Right To Data Portability (i.e., the ability to copy and transfer personal data easily from one IT environment to another)
* An expanded Right To Be Forgotten (also called the Right to Erasure)
* A more comprehensive Subject Access Right (i.e., a clear means of requesting and obtaining all personal data from an organization)

Even if you're located outside of the EU, [several related policies](https://auth0.com/blog/gdpr-effect/) are taking shape worldwide to dovetail with these stringent guidelines. In particular, Argentina, Australia, Canada, Japan, California, and New York have all [forged ahead with rules of similar intensity](https://auth0.com/blog/gdpr-effect/). 

In order to be in compliance with fast-approaching regulatory changes and avoid [fines](https://auth0.com/blog/get-ready-for-gdpr/) in the event that your team is audited and not up to code, it's important to adopt a strategy for master data management. Regulators will want proof that you are organized, that you can quickly locate personal data when a customer requests it, and that you have efficient procedures in place to remove portions or entire personas.

<include src="TweetQuote" quoteText="In order to be in compliance with fast-approaching regulatory changes and avoid fines in the event that your team is audited and not up to code, it's important to adopt a strategy for master data management."/>

You will also have an enormous advantage over your competitors if you can explain how you manage their personal data. As users increasingly understand that they have the ability to determine what companies see and how they use sensitive information, they will likely have more questions about the process and how it relates to their security. [Few companies](https://www.mediapost.com/publications/article/315652/how-gdpr-could-benefit-publishers-educate-with-op.html) are positioned to describe their techniques in detail. If you are one of the few who has implemented a tight and well- functioning master data management strategy, you can distinguish yourself and build user trust.

## Conclusion

Master data management will be unique to each company, based on its structure, supply chain, the categories of data it collects, and the ways in which team members use it. However, starting with a strong and secure access point into your system will go a long way towards streamlining highly sensitive points, complying with stringent regulations, and consolidating layers of rich information into a practical view for more targeted strategies.

Breaking Down Master Data Management

Amazon's bold play for Whole Foods isn't just about the impending automation of the retail sector, it's about the increasing importance of IAM in redefining consumer behavior.



Amazon is poised to reinvent the grocery store from the ground up. They've been experimenting with cutting-edge retail automation through their Amazon Go experiment, leading to strong speculation about how they're going to enter the brick and mortar grocery market. Now we've got our answer: with Whole Foods.

The high-end organic retailer is likely going to be a pilot for applying the highly anticipated Amazon Go model: a way for consumers to shop without ever waiting in line for a register — a massive shift that brings identity to the center of the retail experience. This is a bold play that is going to change the way [IAM works in retail](https://auth0.com/blog/jda-standardizes-iam-with-auth0/), and forever change consumer expectations and behavior.

In this article, we're going to break down the underlying architecture of Amazon's retail automation model, its impact on consumers, and highlight the ways in which [identity management](https://auth0.com/b2c-customer-identity-management) stands as the keystone of this entire [retail revolution](https://auth0.com/retail/).

## How Amazon Rethinks Shopper's Identities

Amazon has well-established forays into the grocery space with its Prime Pantry and Amazon Fresh services, but its first brick and mortar entry is the Amazon Go beta store in Seattle. As an entirely cashierless store, customers scan their phones as they enter the store, shop for the items they want, and leave the store without waiting.

![Wholefoods](https://images.ctfassets.net/23aumh6u8s0i/0rAvRGZ0WdOucQf3XEUnf/d9f816ec8e6bf2c9a3f9929bdd41deab/new)
_[Source](https://www.engadget.com/2016/12/05/amazon-go-grocery-store/)_

The technology is an ingenious combination of computer vision, sensor fusion, and Amazon's ability to assign these datapoints to specific customers. Cameras observe, track, and identify customers as they make purchases, and these are matched up with their Amazon accounts, allowing them to simply leave the store knowing that their purchases have been attributed to their accounts.

This is possible due to Amazon's 2014 [patent filing](http://bit.ly/2tWF8gB) for “Transitioning Items From a Materials Handling Facility”, which reveals the underlying systems at play that enable sensor data to be applied to specific customer identities.

According to the patent, an item identifier list — a customer's cart, so to speak is said to use skin tone identification to keep a customer's carts distinct from one another while in-store. Upon exiting the store, the user is identified so this internal store shopping list can be attributed to a customer's Amazon account. This reveals that identity is the key to seamlessly merging back-end stock logistics to front-facing customer billing.

Amazon Go is clearly a new benchmark for IoT retail. With its system, a store can at once know the real-time status of every item, attribute these items to individuals, and then instantly bill them for it.

The behavioral analytics potential of linking all stages of the supply and purchasing funnel is immense, allowing Amazon to pursue a more agile and responsive brick and mortar retail strategy. Customers might even be able to get real-time suggestions based on their shopping lists, or even get coupons for items they're mulling over — all because of identity.

## Implications for Whole Foods

Amazon's announcement of its intent to purchase Whole Foods not only has the potential to upend the grocery sector, it also promises to radically alter the retail sector in terms of identity management and employment policy.

![Whole foods Market](https://images.ctfassets.net/23aumh6u8s0i/2GiMCCBpLnwQt0sdgLnhLl/7dc8751c4acb1a46c19bea59cd9c5157/foods)
_[Source](http://www.wholefoodsmarket.com/stores/southlakeunion)_

Amazon's blueprint for a hyperconnected identity and authentication management system is in many ways unchartered territory. Grocers already do track shopping analytics through [reward card incentives](https://www.theguardian.com/money/2013/jun/08/supermarkets-get-your-data), which allow them to develop a complex view of their customer's behaviors. However, Amazon's novel unification of these backend analytics with specific customer identities increases the value of this data collection.

The consolidation of both front-end analytics and back-end logistics may be able to offer a whole host of new efficiencies in the grocery sector. Whether it be through a more agile inventory management system that reduces waste and spoilage, or by automation-led workforce reduction, Whole Foods may be able to pursue a more targeted and lean approach to its operations.

Additionally, given Whole Food's affluent and aspirational demographic reach, the experimental appeal of a new, automated shopping experience could prove to be a huge draw, not only for those who are excited to try the latest tech, but for those who will benefit from a more effortless shopping experience.

## Implications for Customers

It's still unclear as to how Amazon intends to scale its Amazon Go technology across hundreds of much larger stores across the US. Even murkier is how customers will react to these large, systemic changes in consumer behavior. Amazon will have to work to ensure that the friction of getting customers up and running in an Amazon Go-style store isn't prohibitive.

### Advantages for Customers:

The advantages of this shift to identity-centric IoT retail are pretty clear:

* Eliminations of lines, shoplifting, and cashiers could lead to savings that are passed along to consumers.
* Customers can access new insights into their spending and consumption patterns.
* The personalized experience of online shopping with hyper-targeted discounts and suggestions can now be experienced offline.
* Store stock can be more responsive to the needs and preferences of customers.

### Disadvantages for Customers

With all this flexibility that comes with identity-centric automation, there also comes the sense that Amazon is seeking to expand its walled garden ever outward.

* Consumers may not be comfortable with the accuracy of automated cashierless stores, or they might reject attempts to customize their shopping experience based on identification.
* Given Amazon's recent patent filing for [blocking comparison shopping-in store](http://tu9srvbirvvtmtukd3d3lnbhddjwzgyub3jn.g00.pcmag.com/g00/2_d3d3LnBjbWFnLmNvbQ%3D%3D_/TU9SRVBIRVVTMTUkaHR0cHM6Ly93d3cucGF0MnBkZi5vcmcvcGF0ZW50cy9wYXQ5NjY1ODgxLnBkZg%3D%3D_$/$/$), it seems like the overall approach isn't simply to make shopping more effortless for its customers, but also to proactively shape buyer behavior.
* While the convenience and hyper-targeting afforded by the Amazon Go model is a draw, there's also a chance that it alienates customers who already feel overly reliant on Amazon's retail ecosystem.

As retail automation becomes more reliant on customer identity to function, retailers should keep in mind that customers are willing to play along if there's a net benefit to them. Once they start to feel walled in or beholden to a monopolized retail experience, things can go awry, so it is in the best interest of retailers to not visibly commodify customer identity when developing IAM-centric automated retail platforms.

## The Road Ahead

Amazon's bold acquisition of Whole Foods indicates its willingness to radically upend one of the most staid and reliable sectors of consumer spending. While Amazon Go is a clear model for what Amazon wants to do in the grocery space, it's still unclear as to how it will apply this model to Whole Foods.

Regardless, it is clear that the future of retail is just as much about identity management as it is about the waning days of the cashier age. Amazon is betting that consumers are willing opt-into the necessary identity procedures that enable them to take advantage of seamless checkout and billing procedures. With Whole Foods now in its portfolio, Amazon will surely have plenty of room to experiment and refine this new paradigm of the retail experience.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Why Amazon and Whole Foods Will Change How You Shop

A unified strategy can help you understand your customers, and identity is the key to making it happen



The relationship between brands and consumers has fundamentally shifted in the digital age.

Consumers are more connected to commerce than ever before. They can shop from their bed on their smartphone, ask sales questions on social networks and read hundreds of product reviews before purchasing. They have multiple devices to purchase anything from wholesale to discount distributers and can ship almost any good to almost anyone across the world.

How can brands keep track of consumers that flit so easily between platforms and devices? What is the best framework for keeping up, especially with millennial and Gen Z consumers, who get from platform to platform at lightening speed?

The best answer we have right now is a unified commerce strategy, one where all of a brand's channels are connected in real time. By looking at the way consumers are behaving and looking at the weaknesses in previous brand efforts to track consumers, we'll discuss unified commerce strategy, and show why identity is the key to a unified strategy.

## Consumers of today are ahead of retailers

The consumer of today is steeped in technology, and it can be a nightmare for [retailers](https://auth0.com/retail/), because consumers don't care about how hard they are to track.

They might sign up on your site with an [email one day but use social login five months later](https://auth0.com/user-management) when they forgot their password. They put things in their cart that they end up purchasing in-store. They browse on their phone during their commute but make that purchase when they get to their job on their work computer (who hasn't?).

![Sephora social media following](https://images.ctfassets.net/23aumh6u8s0i/15YDAU8Yz6RgCExQzNhfhM/461477a434cd7355c8ea72991cf532fb/social-media)

Mapping out the shopping journey means stitching together so many actions across so many channels that even with big tools like Facebook's [in-store purchase tracker](https://www.facebook.com/business/news/drive-and-measure-store-visits-and-sales), companies still have a hard time figuring out how people are making purchase decisions — especially if they're an SMB.

### Millennials and Gen Z: Challenging Demographic

Millennials alone are expected to spend [$200](https://www.forbes.com/sites/micahsolomon/2014/12/29/5-traits-that-define-the-80-million-millennial-customers-coming-your-way/#3d26711e25e5) billion in 2017, and Gen Z currently hold around [$44](https://www.forbes.com/sites/ibm/2017/01/12/move-over-millennials-generation-z-is-the-retail-industrys-next-big-buying-group/#6898a4d32f0a) billion in purchasing power for 2017, but both are *so* steeped in technology that they pose a particular puzzle for businesses.

They expect their brands to be all over digital channels, and for them to present authentic, consistent content from website to Twitter to Insta influencers. They want to shop where it's most convenient, even if the platform isn't set up for eCommerce (think Instagram). They're the first ones to adopt new platforms and they're the most comfortable with new tech, meaning they're going to continue to purchase more devices and make more accounts.

It's important for all retailers to conquer digital tracking to better serve all consumers, but it's especially important for acquiring and retaining Gen Z and millennial consumers.

## Shift from omnichannel strategy to unified commerce strategy

What most companies have been doing up to this point is cobbling together their various channels to create what's been termed an “omnichannel” strategy. Existing infrastructure is used to collect information from the various ways customers interact, and those are retroactively stitched together.

But the omnichannel strategy has some pitfalls. It's not a real-time, flexible solution. It does not offer an easy way to compare information across channels to look for larger trends. It has thus far been doing an adequate job of helping brands present a unified experience across channels, but the effort that coordination takes is a drain.

![Shift from omnichannel strategy to unified commerce strategy](https://images.ctfassets.net/23aumh6u8s0i/vN3ZEmAUMxaqDE4nEV1y0/7b6fc53ae315423794c1bbcec38c4ace/omni-single)
_Source: [Fabacus Symphony](https://fabacus.com/symphony-api-eai/omnichannel-vs-unified-commerce)_

Unified commerce is a way to circumvent some of these problems while still giving customers that sleek, consistent brand experience that customers want. It provides the single source of truth that omnichannel lacks by plugging every channel into one integrated system.

This one system allows for better consistency of data, it lets people from across the company tap into cross-channel metrics in real time, and it simplifies the process of putting together customer information. So, while the customer might not be able to tell the difference in what you're doing, the internal process for looking at customer data, interacting with customers, and tracking purchases across channels gets much smoother.

This will only be more important as more technology and more platforms come along. Companies will need to get into new ways to sell to and connect with customers to keep up with millennials and Gen Z to sell to them where they live online.

## Identity's role in unified commerce

[Identity management](https://auth0.com/user-management) is a key component of putting into place a unified commerce strategy. Sophisticated identity management systems like [Auth0](https://auth0.com/) are central to getting all digital streams routed to one place because they:

* **Enable a single view of the consumer in real time.** IAM systems can store customer information in their unique profiles, allowing activity across different devices and channels to be consolidated in one place. From their preferences to their login history, and many other details that you can augment profiles with, customers become one person in one place, no matter how many different ways they interact with you.

* **Help streamline customer acquisition.** Good identity management will keep your customers happy by creating a near-frictionless experience with social login for customers and it will store their social information for you to use later. It should also help you streamline your data-gathering by enabling you to progressively profile customers — that is, to gather information from them over time rather than flooding them with information requests at signup. And, of course your IAM should keep you up-to-date on the latest login, so when customers expect magic links, biometrics, and whatever future logins that may appear, you won't lose customers who expect the most streamlined, safest, and most cutting-edge digital experience.

* **Drive efforts to engage customers, especially on digital platforms.** When all customer data is being collected and tracked in one place, whoever is involved in shaping the customer experience can have richer, deeper insights into patrons. This means that whether customers log onto their rewards center or step into a store they'll receive personalized attention. Even small details like recommendations for free samples based on order history can go a long way to deepening customer engagement through personalization.

Especially for companies looking for a way to easily consolidate customer information, starting with identity management makes sense. When you're backed by a powerhouse for identity like Auth0, you will be able to quickly scale these consolidation efforts to kickstart your unified commerce strategy.

## The future of retail with Auth0

As we grow more digital, with more devices to interconnect and more ways to buy than ever before, identity will only continue to grow as one of the central pieces to the puzzle that is tracking your customers. Whether you're trying to better engage with them, get better metrics for customer engagement, or better plot how people are getting to purchase, using identity as a central component of your unified commerce strategy is a good strategic move.

In order to take advantage of all that identity has to offer, you need a robust and flexible platform for identity, and that's where Auth0 comes in. With the flexibility to tailor your back-end system to your needs, but the robustness to support you on every platform, Auth0 is ready to launch into the [future of retail](https://auth0.com/retail/).


How To Keep Up With Hyper-Connected Consumers

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The new body of rules promises to tighten up data security for consumers in Europe.



We are happy to announce that effective today Auth0 is part of the EU-US Privacy Shield Program and publicly committed to comply with its requirements.
This certification enables Auth0 to transfer personal data from the European Union to the United States while complying with EU data protection requirements.

## Understanding Privacy Shield

The European Commission decided last year that the [Safe Harbor Principles](https://auth0.com/blog/safe-harbor-still-matters/), which outlined rules for the security of data transferred between the United States and EU by companies, were no longer robust enough. So they replaced Safe Harbor with the [EU-US Privacy Shield Framework](https://www.privacyshield.gov/welcome).

The Shield isn't a law, it's a system of rules that companies can comply with and get certification for. Therefore it's not a government mandate, but companies that comply will be authorized to transfer personal data from the EU to the U.S. 

This new body of rules promises more stringent protection of data and more oversight for those companies transferring data across the Atlantic.

## What's The Difference Between Safe Harbor And The Privacy Shield

The new EU Privacy Shield was agreed on in August this year with the intention of patching up the holes in Safe Harbor but also upgrading the security that American companies had to ensure.

The Shield is different from Safe Harbor mostly because it calls for the US Department of Commerce to play a larger role in monitoring and supervising compliance, including carrying out reviews and investigations of companies that participate. The Shield is pushing data legislation above and beyond Safe Harbor:

* Participating US companies are now required to post detailed privacy policies on their sites.
* US companies must allow EU citizens to opt out of data sharing with third parties.
* US companies can only process data that is “relevant” to the reason it was collected and must delete personal data that is no longer being used for the purposes it was collected for.
* EU citizens can file complaints via multiple avenues, more than under Safe Harbor.
* If a US company is found in violation by the Fair Trade Commission it has to publish the nature of its non-compliance.
* Even if they withdraw from The Shield, US companies might still have to comply with certain obligations.

Like Safe Harbor, American companies have to self-comply with the Privacy Shield. Doing so allows them to receive certification that their data transferral to the EU is secure. Auth0 is in the process of complying with the brand new EU-US Privacy Shield Framework. 

Auth0 follows the rules laid out in The Shield. In our [privacy policy](https://auth0.com/privacy) we demonstrate how discerning we are with data collection—we only ask for personal information we need to deliver our services and to ensure our site is running properly. We may also analyze your data through aggregated data pools, so that no individual is highlighted in our studies. This protects the privacy of our users.

## Why Was The Shield Introduced

With the constant business that flows between the European Union and the United States, sensitive data is moving back and forth across the two unions continuously. The goal with both Safe Harbor and the new EU Privacy Shield is to protect the data of [individual European consumers](https://medium.com/@nichchung/eu-u-s-privacy-shield-how-snowden-and-schrems-led-the-eu-to-armor-up-94207ee96702#.248ekl938). 

Safe Harbor was implemented in 2000. It was established after Google was launched and before Facebook came on the scene. Despite the fact that it was born before the internet looked anything close to what it does today, Safe Harbor wasn't updated until recently.

![A brief safe harbor history](https://images.ctfassets.net/23aumh6u8s0i/7iEDm5ew1NOoSfcwn214xN/0a5d48a52c242229249da431472d1d6b/safe-harbor-history)

*Source: [iapp](https://iapp.org/resources/article/a-brief-history-of-safe-harbor/)*

Safe Harbor was overturned after Edward Snowden demonstrated how the [NSA was collecting and tracking data](http://www.wired.com/2015/10/tech-companies-can-blame-snowden-data-privacy-decision/). These revelations were compounded by Max Schrems, an Austrian law student who [brought a complaint to the European Court of Justice](http://www.businessinsider.com/ecj-safe-harbor-ruling-bots-expected-2015-10) about Facebook's data collection. He asked the Irish Data Protection Commissioner to stop allowing Facebook, an American company, to transfer data from EU citizens to America. 

It soon became clear to EU citizens that their data could also be mined by the American government body without the consent of EU citizens.

After that one-two punch from Snowden and then Schrems, the European Commission was determined to create a new body of rules that would improve on Safe Harbor and make it even more transparent. And so the EU-US Privacy Shield Framework cracks down on insecure data collection and increases government oversight. 

## What Do I Have To Do To Join The Shield

The Privacy Shield requires self-compliance. That means there's no law demanding that you follow the rules set out by Shield, rather your company can opt to do so and receive certification. In complying with The Shield, organizations will be authorized to transfer the personal data of EU residents to the U.S. 

There are four requirements to joining Shield:

1. The company must be under the authority of the FTC or another U.S. agency (i.e. should be an American company or doing business in America) so these groups can ensure compliance
2. The company must make public its commitment to follow the rules laid out in Shield
3. The company must publicly post its privacy policy
4. The company must implement the Principles laid out in Shield

Any company that wants to be certified by the Department of Commerce for Shield must give them a very detailed description of how the company will be using the personal data of EU citizens. The certificate has to be renewed annually.

Auth0 is now part of the EU-US Privacy Shield Program and we are [already SOC 2 Type II certified](https://auth0.com/security). We also conform to the OpenID Connect protocol and offer HIPAA BAA agreements for companies transferring sensitive personal health information.

We follow a series of verified identity standards and have built our services around them, including LDAP, SAML, OAuth, and JSON Web Tokens. We also maintain the integrity of the data we collect and ensure [security](https://auth0.com/security) through encryption and password hashing. With Auth0 you can ensure up to five levels of password complexity and even opt into custom rules that implement the [OWASP recommendations](https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls). Through Auth0 you can harness these powerful standards to protect your own applications. When we receive Shield-certification, that too will be available.

## The Future Of Data Protection

As soon as Shield landed on August 1, companies like [Microsoft](https://blogs.microsoft.com/eupolicy/2016/08/01/microsoft-signs-up-for-privacy-shield/) and [Workday](http://blogs.workday.com/workday-self-certified-on-day-one-of-privacy-shield/) were already signed up. But Shield is just the beginning for the new generation of data legislation in the EU. 

The EU-US Privacy Shield Framework promises to improve on current data collection practices and companies that get certified within it are signaling to their consumers that they value privacy and data protection. In 2018, data legislation within the EU is scheduled to expand again with the [General Data Protection Regulation](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation). Shield is almost a primer for the new Regulation.

Data flow should always be secure no matter where in the world you're located. We are stringent in ensuring all the data we're trusted with remains protected. The EU-US Privacy Shield Framework will make sure that American companies are responsible for all the data they collect so consumers remain safe.


Announcing Auth0's Certification in the EU-US Privacy Shield Framework

2ffc83fcccf746c783f921f186d1e619?s=60 avatar

2ffc83fcccf746c783f921f186d1e619?s=60

Former Auth0 Employee

Kelsey Flittner

What customers and developers think of IoT security

_**TL;DR**: Auth0 recently surveyed both developers and consumers and it turns out everyone has concerns over device and application security when it comes to the Internet of Things._

---------

While IoT is one of the world’s fastest growing technology sectors, it is also poised to become one of the fastest growing sources of security vulnerabilities for both consumers and enterprises. Here at Auth0, we were curious about both developer and consumer sentiment when it comes to the current state of IoT security, and what people think about the future (especially with the upcoming holiday season where folks are more likely to make bigger IoT purchases), so we decided to find out.

We started with consumers that were either familiar with or currently use an IoT connected device. When asked about IoT devices on the market right now, we found that **nearly 52 percent of consumers believe that these products do not have the necessary security in place**.

In a separate survey, we also polled our own network of subscribers (developers) to determine what they thought about the state of IoT security. **When asked if they’ve ever felt pressured to rush an application to market despite security concerns, over 85 percent of developers admitted that they had**.

With data breaches from major companies appearing constantly as headline news, we believe consumers are cognizant that security is a major issue, but they may not have insight into why that is. According to developers we surveyed, one reason for this is because IoT devices are often pushed to market too quickly, forcing developers to cut corners. If adding security components is resulting in a slower time-to-market, the chances are greater that they won’t be implemented at all. The best security measures are the ones you actually deploy, so simplicity in implementing strong security is critical (hint: ***Auth0*** can help with that 😉).

Developers echoed and amplified the consumer concern for better security, with **a majority 90 percent of respondents believing that the IoT devices on the market currently don’t have the necessary security in place**.

![Do you believe that IoT devices are secure?](https://images.ctfassets.net/23aumh6u8s0i/43Z5eryum1VacHZxnch7JM/b89916c018c26d4726c71bbd1bed9eab/do-you-believe-iot-devices-are-secure-2)

What’s most interesting, though, is that we found the concern over security isn’t stopping consumers. We found that **nearly half (49 percent) of respondents don’t trust having their personal and private data tied to IoT applications, but continue to use these devices nonetheless**. Consumers are aware of the general security vulnerabilities that have been associated with this category of products and applications, but are still willing to put their personal data at risk – showcasing how the demand for these technologies is compromising the need for proper security.

Interestingly, millennials (ages 18-34) were nearly split on future use, with **54 percent claiming that they did not plan to purchase or regularly use IoT devices within the next two years**. Participants aged 35-54 were slightly more skeptical, with **nearly 63 percent not interested in buying IoT devices over the next two years**.

Statistics like these would typically slow progress, innovation and growth in the IoT space, with consumers and developers hesitant to use and support these technologies due to the lack of security offered for their personal and private health, home and financial data. However, even the recent breaches that large companies have experienced (e.g., Chrysler, JP Morgan, Ashley Madison, Anthem Health, Target, Home Depot) have not had a massive impact on consumer trust or interest.

**Nearly 35 percent of consumer survey respondents claimed that the breaches of major brands have not had much of an effect on the trust or consumer interest in these brands.**

<include src="TweetQuote" quoteText="The best security measures are the ones you actually deploy"/>

As consumers continue to question the security of Internet of Things devices, developers and CIOs will need to find ways to simplify the implementation of strong identity security (hint: use ***Auth0***! 😉) and be well equipped to stay up to date on the latest security vulnerabilities - keeping their devices, applications and, ultimately, their consumer and enterprise data safe.

![Do you trust your personal data tied to an IoT device?](https://images.ctfassets.net/23aumh6u8s0i/4fzx4Tgxetbu1jwnrfcWET/239b94449039d867270a6cbe611aa7eb/do-you-trust-your-personal-data-to-iot-devices)

## Summary of results from the consumer and developer surveys:

- **52%** of respondents believe that most IoT devices on the market right now DO NOT have the necessary security in place
- **49%** of respondents don’t trust having their personal/private data tied to IoT devices – but still use them
- Only **18%** of people trust having their personal data tied to IoT devices
- **Nearly 35%** claimed that the breaches of major companies have not had much of an effect on the trust or consumer interest in these brands
- **85% of developers** surveyed have felt rushed to get an application to market due to demand/pressure in the last 6 months
- **90% of developers** surveyed do not believe that IoT devices on the market currently have the necessary security in place

Surprised? Turns out, consumers don’t trust IoT security

Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
 
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
 
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

Most APIs today use an API Key to authenticate legitimate clients. API Keys are very simple to use from the consumer perspective:  You get an API key from the

Most APIs today use an **API Key** to authenticate legitimate clients. **API Keys** are very simple to use from the consumer perspective:

1. You get an **API key** from the service (in essence a shared secret).
2. Add the key to an `Authorization` header.
3. Call the API.

It can't get simpler than that, but this approach has some limitations.

The last couple of months, we've been working on our [API v2](https://docs.auth0.com/apiv2). We wanted to share what we've learnt implementing a more powerful security model using [JSON Web Tokens](http://jwt.io).



Using a JSON Web Token offers many advantages:

* **Granular Security**: API Keys provide an all-or-nothing access. JSON Web Tokens can provide much finer grained control.
* **Homogenous Auth Architecture**: Today we use cookies, API keys, home grown SSO solutions, OAuth etc. Standardizing on JSON Web Tokens gives you an homogenous token format across the board.
* **Decentralized Issuance**: API keys depend on a central storage and a service to issue them. JSON Web Tokens can be "self-issued" or be completely externalized, opening interesting scenarios as we will see below.
* **OAuth2 Compliance**: OAuth2 uses an opaque token that relies on a central storage. You can return a stateless JWT instead, with the allowed scopes and expiration.
* **Debuggability**: API keys are opaque random strings. JSON Web Tokens can be inspected.
* **Expiration Control**: API keys usually don't expire unless you revoke them. JSON Web Tokens can (and often do) have an expiration.
* **Devices**: You can't put an API key that has full access on a device, because what is on a phone or tablet can easily be stolen. But you can put a JWT with the right set of permissions.

If you'd like an in-depth introduction to **JSON Web Tokens**, check out our **free** ebook below.

<include src="ebook-ads/JwtHandbook" />

## Granular Security

One of the most interesting benefits of using JWTs is the first one listed above. Back in the old days, when databases were at the center of our client-server applications, we could create users with specific permissions on the database:

<a href="https://images.ctfassets.net/23aumh6u8s0i/2paJRM6vdAq4RO2k6ypich/b960d3ab0c364b327b2d4a2f1afc66c4/permissions-sql" target="_blank"><img src="https://images.ctfassets.net/23aumh6u8s0i/s9tyvnrUrUjg7i39zWBOn/db84bd0b3a904e879c3484841d34cd1a/permissions-sql.png"/></a>

_Remember this?_

APIs are becoming central pieces of our distributed systems architecture. They are now the "gatekeepers" of our data. But in contrast with what was available in databases, virtually all API keys provide all-or-nothing access. Readers will likely be familiar with the `scope` parameter of OAuth2 based systems that offers this finer grained consent to access.

There are many situations in which you want to keep the simplicity of an **API Key** but only for a subset of all possible API operations.

[GitHub acknowledged this requirement](https://help.github.com/articles/creating-an-access-token-for-command-line-use/) and now provides a way of creating a token with the scopes you need (mimicking the OAuth2 consent):

![](https://images.ctfassets.net/23aumh6u8s0i/6fdGKpvxjgD7seKbyvjb9O/4d82a5cb332aa836d93cb7e3044b5707/token_scopes)

In the next section, we will go through the details of how this can be implemented.

### How to implement it?

We don't know how GitHub implemented it (they probably used Ruby), but we will use it as an example. Let's say we want to implement an endpoint in the API to **create new repos**. You could model this with the following **JSON Web Token** payload. If you provide any of those scopes, then you can create repos:

```
{
 iat: 1416929109, // when the token was issued (seconds since epoch)
 jti: "aa7f8d0a95c", // a unique id for this token (for revocation purposes)
 scopes: ["repo", "public_repo"] // what capabilities this token has
}
```
_Look at this token in <a href="http://jwt.io?value=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE0MTY5MjkxMDksImp0aSI6ImFhN2Y4ZDBhOTVjIiwic2NvcGVzIjpbInJlcG8iLCJwdWJsaWNfcmVwbyJdfQ.XCEwpBGvOLma4TCoh36FU7XhUbcskygS81HE1uHLf0E" target="_blank">jwt.io</a>_

The API endpoint would simply check for the presence of the right **scope** atribute (this example is written in node.js but any language would work):

```
// intercept all calls to API and validae the token
app.use('/api', express_jwt({secret: SECRET, userProperty: 'token_payload'}));

// for POST /user/repo validate that there is a scope `repo` or `public_repo`
app.post('/api/user/repo',
 check_scopes(['repo', 'public_repo']),
 function(req, res, next) {
 // create a repo
 ....
});

```

Notice the `check_scopes` middleware on the `/api/user/repo` route. This is how the `check_scopes` function is implemented:

```
function check_scopes(scopes) {
 return function(req, res, next) {
 //
 // check if any of the scopes defined in the token,
 // is one of the scopes declared on check_scopes
 //
 var token = req.token_payload;
 for (var i =0; i<token.scopes.length; i++){
 for (var j=0; j<scopes.length; j++){
 if(scopes[j] === token.scopes[i]) return next();
 }
 }

 return res.send(401, 'insufficient scopes')
 }
}

```

> Notice that no one can change the scopes variables. JWTs are digitally signed, so its content cannot be tampered with. 

Documenting an API is equally important. What would be a good way for surfacing this on an API explorer?

For Auth0, we decided to build our own documentation using [swagger](http://swagger.io/). Since we are a multi-tenant system, each tenant has an API Key and Secret that is used to sign the token. As a developer, you mark which scopes you need and a token will be auto-generated. You can copy and paste it to [jwt.io](http://jwt.io) to see the structure (this is the __debuggable__ piece, by the way).

<a href="https://images.ctfassets.net/23aumh6u8s0i/33kBdPt5Hlzt2UEt0yoRQp/e7227bdb1d82dc16fed9a145dc64896b/api-explorer3" target="_blank"><img src="https://images.ctfassets.net/23aumh6u8s0i/7uKm8Sq6OiHUEs5v9AoKT7/3550cf71dfa93c43bbd0eb2b2b2c2191/api-explorer3.gif"/></a>

Scopes required by each operation are clearly identified:

<a href="https://images.ctfassets.net/23aumh6u8s0i/4FDPqZmzwJWGdg9YGSUcEf/5f6ecef62c9d7f3ae0f64edad904a3a1/api-scopes2" target="_blank"><img src="https://images.ctfassets.net/23aumh6u8s0i/4FDPqZmzwJWGdg9YGSUcEf/5f6ecef62c9d7f3ae0f64edad904a3a1/api-scopes2"/></a>

Our token format is a bit different from the one in the example we showed for GitHub. The good thing about JWTs is that they can contain _any_ data structure:

```
{
 iat: 1416929061,
 jti: "802057ff9b5b4eb7fbb8856b6eb2cc5b",
 scopes: {
 users: {
 actions: ['read', 'create']
 },
 users_app_metadata: {
 actions: ['read', 'create']
 }
 }
}
```

The string representation of the scope is `read:users` but in the JSON Web Token, we are using a more structured representation (note the hierarchy), this allows us to be more consistent. It also allows us to have an easy way to extend it for other scenarios.

## Conclusion & Resources

We have shown a new way of securing APIs based on JSON Web Tokens. This approach has some interesting benefits, in particular around _granular security_. In future posts we will go over other aspects, starting with how to revoke tokens.

Below are some of the resources that we used in our node.js backend implementation:

* The [hapi.js](http://hapijs.com) framework to create the API.
* A [fork](https://github.com/auth0/hapi-auth-jwt) of [hapi-auth-jwt](https://github.com/ryanfitz/hapi-auth-jwt) with [support for multitenant apps](https://github.com/ryanfitz/hapi-auth-jwt/pull/10) to handle authentication with JWTs.
* The awesome [ratify](https://github.com/mac-/ratify) library to both validate API input using [JSON schemas](http://json-schema.org) and automatically generate [swagger](http://swagger.io/) from said schemas for our docs.
* Swagger's support for arbitrary [authorizations objects](https://github.com/swagger-api/swagger-spec/blob/master/versions/1.2.md#514-authorizations-object) and a slightly [customized swagger-ui template](https://github.com/swagger-api/swagger-ui#customize) to render the scopes per operation.

If you want to see an example of this working, you can check out our API v2: <https://docs.auth0.com/apiv2>

We would love to hear your thoughts about this approach!

[Discuss here](https://ask.auth0.com/t/using-json-web-tokens-as-api-keys/357)

<include src="asides/Jwt" />

Using JSON Web Tokens as API Keys

Jose-Romaniello

I started working at Auth0 before the first line of code for our authentication platform existed. I’ve been able to go through the journey of seeing our ideas go from prototype to living production code that impacts millions of people. It’s satisfying to know that my actions here are having a positive impact in solving problems for developers like me.

Head of Engineering

Jose Romaniello

Auth0 is now available on Heroku as an add-on (private beta for now), making it incredibly easy to add Enterprise SSO, Consumer Logins, Directories queries

Auth0 is now available on [Heroku as an add-on](https://addons.heroku.com/auth0) (private beta for now), making it __incredibly easy__ to add Enterprise SSO, Consumer Logins, Directories queries, user access audit and many advanced identity management to any app hosted there. [See here for a complete list of supported identity providers in Auth0](http://docs.auth0.com/identityproviders): Consumer and Enterprise.

A 3 min video is worth 1,000,000 words. Take a look:



<iframe width="710" height="533" src="//www.youtube.com/embed/Q0MVRgC-ptg?rel=0&vq=hd1080" frameborder="0" allowfullscreen></iframe>

[Try Auth0 yourself!](https://auth0.com)

"consumer"