diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Learn which cybersecurity tactics and tools will help you combat today's common cyberattacks.

With more people working remotely or online post-2020, the [FBI reports](https://thehill.com/policy/cybersecurity/493198-fbi-sees-spike-in-cyber-crime-reports-during-coronavirus-pandemic) that cybercriminals are quadrupling the number of cyberattacks they use to disrupt online activities. Research also shows the impact to organizations and their users from a single successful cyberattack is growing each year.

For example, in 2017, nearly [_197 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. In 2020, that number [grew to 37 billion](https://pages.riskbasedsecurity.com/hubfs/Reports/2020/2020%20Year%20End%20Data%20Breach%20QuickView%20Report.pdf), even though the overall number of data breaches had decreased. And IBM reports that the costs are growing for organizations that fall victim to these attacks in countries like the United States, where the average cost of a data breach grew from $7.91M to $8.64M between [2018](https://www.ibm.com/downloads/cas/861MNWN2) and [2020](https://www.ibm.com/security/data-breach).

Many of the methods cybercriminals use to breach organizations rely on human error. Even your sharpest employees can become your greatest weakness if they click on a malicious link without realizing it. However, other cyberattacks exploit gaps in your [data security](https://auth0.com/blog/what-is-data-security/) efforts to gain access to sensitive data.

Below are seven of the most common cyberattacks your organization will face in 2021 and the ways to protect yourself against the data breaches they have the potential to cause.

## 1. Malware Attacks

Malware refers to many different types of malicious software designed to infiltrate, spy on, or create a backdoor and control an organization’s systems or data. This includes ransomware, worms, trojans, adware, and spyware. [Experts report](https://monstercloud.com/blog/2020/03/23/coronavirus-alert-ransomware-attacks-up-by-800/) that malware usage is up almost 800% since early 2020.

Malware has the potential to cause major data breaches and severely disrupt business operations. Microsoft was the victim of a major ransomware attack, where WannaCry [took advantage of a weak spot in their operating system](https://en.wikipedia.org/wiki/WannaCry_ransomware_attack) and displayed the following message to banks, health care providers, manufacturers, and other businesses across the globe:

![image.png](https://images.ctfassets.net/23aumh6u8s0i/1eCk2eoRxo2dlqfakT2rLF/3d36517813cea24b63b795f7fe3a256c/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021)
<p align="center"><i><a href="https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/">Source</a></i></p>

<br /> <br /> 
<p></p>
To regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [Bitcoin](https://bitcoin.org/en/).

Malware is typically downloaded unwittingly by clicking a malicious link or by tricking a user into thinking they're downloading something legitimate when they’re not.

### How to Protect Against Malware Attacks

Teaching your employees how to spot suspicious links and pop-ups that could contain malware will help reduce the chance that it could infect your systems.

Additional ways to protect against malware include keeping your operating systems up to date to ensure known security gaps are patched and using anti-virus software. For example, the [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/) data breach could have been prevented had a known patch been installed in time.

## 2. Phishing Attacks

Phishing attacks attempt to steal information from users or trick them into downloading malware by sending malicious emails or text messages (SMS) that look like real requests but are, in fact, a Scam. Here’s a Dropbox email asking users to verify their email address that’s actually a phishing attack:

![image.png](https://images.ctfassets.net/23aumh6u8s0i/2ISbM89J8qjqwVy4kUpgOf/a1b52597302c386ee8381bfd6f6948d9/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021) 
<p align="center"><i><a href="https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250">Source</a></i></p>
<br /><br />

According to [Verizon’s 2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/dbir/2020/results-and-analysis/), phishing attacks are the most common cause of data breaches globally and have been the root cause of notable instances of cybercrime in the last decade.

The cybercriminals who breached the AP News Twitter account and falsely [tweeted](https://www.bbc.com/news/world-us-canada-21508660) that the White House was under attack used a targeted phishing attack (spear-phishing) to gain access to the account, as did the bad actors who leaked sensitive emails from Hillary Clinton’s campaign chairman [before the 2016 election](https://www.cbsnews.com/news/the-phishing-email-that-hacked-the-account-of-john-podesta/).

### How to Protect Against Phishing Attacks

The best way to protect your organization against phishing attacks is to educate your employees on how to spot a questionable email or text message. The training programs below can help you do this:

* _Digital Defense’s_ [_SecurED training program_](https://www.digitaldefense.com/professional-services/secured-training/)
* _Inspired eLearning’s_ [_Security Awareness_](https://inspiredelearning.com/security-awareness/awareness-c-suite/)

Additionally, CSO has compiled a list of resources that can help you train your teams to spot phishing attacks [here](https://www.csoonline.com/article/3225471/please-dont-send-me-to-cybersecurity-training.html).

## 3. Distributed Denial of Service Attacks

Distributed denial of service (DDoS) attacks disrupt the traffic to a website, application, server, service, or network by overwhelming it with a flood of traffic from compromised computer networks ([botnets](https://usa.kaspersky.com/resource-center/threats/botnet-attacks)) that prevents real users from accessing it. In 2018, GitHub experienced the largest DDoS attack ever when it was hit with 1.35 terabits of traffic per second and was [offline for almost 20 minutes as a result](https://www.wired.com/story/github-ddos-memcached/).

DDoS attacks are common and increased by 50% in 2020 compared to 2019, with a large surge occurring in early 2020 during the pandemic, according to security company [Kaspersky](https://securelist.com/ddos-attacks-in-q3-2020/99171/).

### How to Protect Against DDoS Attacks

DDoS attacks are tricky to identify because they’re often hard to distinguish from legitimate traffic. Some [methods of protecting against DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/) include blocking all traffic for a short period of time, rate-limiting traffic to a website, using a web application firewall to detect suspicious traffic patterns, or scattering traffic across a network of servers to reduce the attack’s impact.

## 4. Man-in-the-Middle Attacks

Man-in-the-middle (MitM) attacks are when bad actors spy on or intercept communication between you and your users or employees. MitM attacks are most commonly used to steal personal or company information or to redirect that information to another destination or in espionage situations, such as when [Russian hackers](https://www.theguardian.com/world/2018/oct/04/how-russian-spies-bungled-cyber-attack-on-weapons-watchdog) attempted to breach the Organisation for the Prohibition of Chemical Weapons (OPCW).

MitM attacks are [not the most common cyberattack](https://www.csoonline.com/article/3340117/what-is-a-man-in-the-middle-attack-how-mitm-attacks-work-and-how-to-prevent-them.html) because many of the same objectives can be achieved using malware. However, MitM attacks do present a threat for organizations because they’re often hard to spot and because [more employees are working remotely](https://www.businesswire.com/news/home/20201215005287/en/Upwork-Study-Finds-22-of-American-Workforce-Will-Be-Remote-by-2025) post-2020.

For example, fake WiFi networks are [easy to deploy](https://hackernoon.com/a-hacker-intercepted-your-wifi-traffic-stole-your-contacts-passwords-financial-data-heres-how-4fc0df9ff152) in public places like coffee shops where remote employees often work. People often connect to these networks without realizing it, allowing bad actors to spy on them while they use the network.

### How to Protect Against MitM Attacks

End-to-end encryption protocols like [Transport Layer Security](https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/) (TLS) are the best way to protect against MitM attacks. Additionally, requiring your employees to use a VPN to access company networks over public WiFi will ensure that any information shared during their session remains private, regardless of whether the network belongs to a bad actor or if their coffee shop’s WiFi is simply unsecured.

## 5. Credential Stuffing Attacks

[Credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) is a type of brute-force cyber-attack where bad actors use stolen usernames and passwords from one data breach to access user accounts at another organization.

![image.png](https://images.ctfassets.net/23aumh6u8s0i/1WPDZfXKzHLheBp0XbP2em/6769d8d365597a77b9de207e48c303d8/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021)

Credential stuffing is possible because, statistically, [65% of all people](https://services.google.com/fh/files/blogs/google_security_infographic.pdf) reuse the same password across multiple accounts. As a result, credential stuffing attacks are one of the [most common](https://enterprise.verizon.com/resources/reports/dbir/) causes of data breaches globally.

### How to Protect Against Credential Stuffing Attacks

The best way to protect against credential stuffing attacks is by either implementing [passwordless authentication](https://auth0.com/passwordless/) or [multi-factor authentication](https://auth0.com/multifactor-authentication) (MFA). Passwordless authentication prevents bad actors from using stolen credentials by eliminating them altogether, while MFA requires bad actors to verify their identity in one or more ways in addition to the stolen credentials they’re using to log in.

## 6. Password Spraying Attacks

Password spraying is also a type of brute-force attack where bad actors attempt to guess a user’s password from a list of common passwords like “123456” or “password.”

Like credential stuffing, password spraying is quite common. For example, Verizon’s 2020 Data Breach Report showed that over [80% of all hacking-related data breaches](https://enterprise.verizon.com/content/verizonenterprise/us/en/index/resources/reports/2020-data-breach-investigations-report.pdf) involved brute-force methods like password spraying.

### How to Protect Against Password Spraying Attacks

Password spraying attacks can be prevented by using passwordless authentication or MFA, just like credential stuffing attacks can be. However, you can also reduce the risk and impact of a data breach via password spraying by following the [NIST Password Guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/), which are considered the best password standards in the world.

## 7. Mobile Device Attacks

[Many organizations are working to increase the mobility](https://www.t-mobile.com/content/dam/tfb/pdf/T-Mobile-for-Business-2020-Workplace-Mobility-Report.pdf?icid=TFB_TMO_P_TFBFTRWRKS_7LCBNVDVYBXY27WF321599) of their workforce because it improves operational efficiency and productivity. However, cybercriminals are well aware of this fact and are targeting mobile devices more frequently [year](https://www.zdnet.com/article/mobile-malware-attacks-are-booming-in-2019-these-are-the-most-common-threats/) over [year](https://www.mcafee.com/content/dam/consumer/en-us/docs/2020-Mobile-Threat-Report.pdf) with a variety of attacks on this list, which puts organizations at risk for a data breach through more devices than before.

[The Pegasus attack](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message. Clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. And once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

### How to Protect Against Mobile Device Attacks

Protecting your organization against mobile security threats requires a strong enterprise mobility management (EMM) program, as well as mobile device management (MDM) tools that help you protect any company data that may be on your employees’ personal or work devices. Identity and access management tools like multi-factor authentication can also help secure any work applications that contain sensitive information from unauthorized access.

## Create Additional Layers of Security at the Login Stage

The impact of many cyberattacks on this list (as well as [others that many companies face](https://www.google.com/url?q=https://auth0.com/resources/whitepapers/state-of-security-identity-report&sa=D&source=editors&ust=1624045583510000&usg=AOvVaw0jtWJoRiARLi1pwCySdu1J)) can be mitigated or prevented with strong authentication protocols.

First and foremost, this means good password policies and sound employee education. However, taking the next step to [secure login procedures](https://www.google.com/url?q=https://auth0.com/login-security&sa=D&source=editors&ust=1624045583512000&usg=AOvVaw2FeIurZ9Qr026LNUW7RDFZ) with security functionality like multi-factor authentication, [brute-force protection](https://auth0.com/docs/attack-protection/brute-force-protection), or passwordless authentication can add a new dimension of safety to your system.

Auth0 makes it easy to build secure authentication for the right people without compromising on user experience — [learn more about Auth0’s platform here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The 7 Most Common Types of Cybersecurity Attacks in 2021

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 acquires Apility.io to integrate IP reputation in Anomaly Detection capabilities; and launches Auth0 IP Signals, a free standalone API



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>.</b><br> 
</div>

**BELLEVUE, Wash. – March 12, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Auth0 Signals](http://auth0.com/blog/new-ways-to-combat-automated-attacks-auth0-signals), a collection of threat intelligence tools and product capabilities designed to protect customers from identity attacks. Auth0’s acquisition of Apility.io, an anti-abuse company, provides a crucial source of IP threat intelligence to Auth0’s Anomaly Detection engine, which detects malicious and risky login traffic to protect customers from automated attacks, such as credential stuffing and fake account creation. [Auth0 IP Signals](http://auth0.com/signals/ip) is a free tool available for anyone to use, and will be fully integrated into Auth0’s core authentication platform in Q2 2020. 

Auth0 Signals provide important new sources of threat intelligence to Auth0’s Anomaly Detection engine, which already thwarts attacks from more than [50,000 unique IP addresses](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) every day. The continual analysis of numerous risk signals – such as IP reputation, use of breached passwords, and failed authentication volume – assesses the risk of a transaction, login attempt, or session. The collective data gathered from Auth0 Signals produces a Confidence Score that Auth0’s platform then uses to prompt adaptive authentication, or intelligent and dynamic enforcement of controls, such as multi-factor authentication or blacklisting, based on risk.  

Auth0 IP Signals is a curated and constantly updated IP address reputation search engine and API. Its threat database is constantly maintained via a variety of data sources across the web and deep web, including Open Source Intelligence (OSINT). It provides security practitioners with a comprehensive way to proactively identify fraudulent IP addresses and verify IP and email reputation, which can be used to prevent credential stuffing attacks and synthetic account creation. These types of attacks result in an average of more than [$6 million a year in costs per company](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). Auth0 IP Signals is an extension of the company’s history of providing valuable resources for free to its loyal developer community.

“Security and availability are the top priority for our business. We integrated the Auth0 IP Signals API in just hours, and it started blocking abuse right away,” said Guillermo Rauch, CEO of Vercel. “Auth0 Signals helps us ensure a great service to our customers, and helps save money and resources. The best part is that it continues to improve behind-the-scenes on its own.” 

Gartner has introduced a Trusted Identity Corroboration Model (TICM) in its September 2019 Market Guide for Identity Proofing and Corroboration. According to Gartner, “TICM is a conceptual framework that assists SRM (Security & Risk Management) leaders to choose a set of tools and techniques that maximizes the collection of multiple risk indicators to identify fraudulent and malicious activity during account creation, access, and maintenance.” Further, “the continued reliance on static data, public records, or credit bureau data alone to either establish or substantiate trust in an identity is no longer simply unadvisable; it has become negligence. Likewise, a refusal to invest in the gathering and assessment of negative and positive signals puts the burden of security on customers, which is increasingly unacceptable in a world that demands frictionless and secure interactions with businesses and organizations.”

As a central authentication and security service securing more than 100 million logins every day for enterprises around the globe, Auth0 has a unique vantage point for observing trends, where they originate from, and more importantly, knowing how to identify and block them before any damage is done. Recent internal data from Auth0 revealed that up to 67% of traffic going through Auth0 at any given time is suspicious, and 6% of IPs sending traffic to Auth0 are known to be blacklisted on the web, yet they are sending 50% of the total traffic to Auth0. Auth0 Signals will help block that fraudulent traffic from breaking into user’s accounts.

“Credential stuffing, password spraying, phishing, and other malicious attempts are constantly multiplying, and customers need more risk signals than any one company can provide, which is why we’ve created Auth0 Signals,” said Matias Woloski, CTO and co-founder of Auth0. “We have always been a developer-centric company, and wanted to provide a free resource to the application builder community for added value and security. By inserting threat intelligence and risk analysis into the IAM system, we’re reducing identity attack opportunities, offering a frictionless experience, and saving critical time and money for our customers.”

Apility.io is Auth0’s first acquisition, bolstering the company’s security strategy to protect against automated cyberattacks, and underscoring its focus on best security practices to keep customers’ information safe and their experiences seamless. 

Additional Auth0 Signals threat intelligence tools will be launched in 2020, and will be freely available to security practitioners for proactive abuse prevention and incident investigation. To learn more, please visit: [http://auth0.com/signals/ip](http://auth0.com/signals/ip).

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Hannah Carroll<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)<br>


Auth0 Signals: New Threat Intelligence to Protect Customers from Cyberattacks

0cd73f2f2f39709bd03646e9225cc3d3?s=200 avatar

0cd73f2f2f39709bd03646e9225cc3d3?s=200

I’m an engineer with a passion for building frictionless products. I’ve built effective teams and have grown them into successful engineering organizations. I like to forge a culture.

CTO and Co-founder

Matias Woloski

We acquired Apility.io, an anti-abuse API company that will help us bolster our security strategy to protect against automated cyberattacks.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>.</b><br> 
</div>

Today we are announcing the acquisition of Apility.io, an anti-abuse API company. This is our first acquisition, bolstering our security strategy to protect against automated and targeted cyberattacks, including credential stuffing and sophisticated phishing attacks.

Apility.io is now a part of Auth0 Signals, a new collection of dynamic data feeds that fuels [Auth0's Anomaly Detection Engine](https://auth0.com/learn/anomaly-detection/) to detect and prevent sophisticated cyberattacks. In addition, part of Auth0 Signals will be made available as a community version via free APIs to help anyone better protect themselves from threat actors.

**To try out Auth0 IP Signals, our first free Signals API, visit [auth0.com/signals/ip](https://auth0.com/signals/ip)**

## What is Auth0 Signals?

Auth0 Signals is a collection of dynamic data feeds that enable our adaptive authentication pipeline to produce high-quality user confidence scores.

Our authentication pipeline processes an ever-expanding number of Signals to assess the risk of a login attempt, account creation, token refresh, or elevation of privilege. It then produces a confidence score. Using this score, Auth0 and our customers can perform risk-based adaptive authentication decisions.

<script src="https://fast.wistia.com/embed/medias/h5fqhdgsep.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:74.37% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_h5fqhdgsep videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>

## Introducing Auth0 Signals Community Version

Today we are introducing a standalone community version of part of the signals we use in our pipeline. More specifically, the **IP reputation signal**. This comes from our acquisition of Apility.io and provides a continually curated and accurate IP, email, and domain reputation data. It takes the hard work out of consuming Open-Source Intelligence (OSINT) by curating, parsing, and normalizing numerous blacklists from across the dark web. We use this data to protect our own infrastructure.

![DIAGRAM](https://images.ctfassets.net/23aumh6u8s0i/5hDiy0cE8lezc61zjwTGnt/168830a9782a26dc67f38d74db746504/diagram-blacklist)

## Why Did We Build Auth0 Signals?

Auth0 Signals and anomaly detection are the foundation of developing a robust adaptive authentication system, ultimately enhancing our continuous authentication capabilities. The goal of adaptive authentication is to continually adapt to a changing threat landscape instead of using a simple rules-based system to block specific interactions.

For example, simple brute force protection usually relies on blocking high-velocity requests above a certain threshold, such as 100 authentication attempts per minute for a single IP address. The problem with this approach is threat actors can create scripts to identify this threshold and then adapt their botnet to operate below it. Effective adaptive authentication takes other risk signals into account, such as IP reputation data.

One of the most pressing threats Auth0 Signals will help address is [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/). In credential stuffing attacks, threat actors use stolen credentials from one breach to break into users' other accounts. [This is effective because 65% of people reuse passwords across multiple accounts, according to Google](https://www.forbes.com/sites/daveywinder/2019/02/05/google-reveals-a-big-problem-with-passwords-on-safer-internet-day/#297a05f85e0b). Even the largest companies are vulnerable if they don't have the right preventative measures in place.

As a central authentication service that processes billions of logins per month, we are in a good position to observe trends in credential stuffing attacks targeting our customers' identity implementations. [On some days, these attacks originate from more than 50,000 IP addresses and may account for as much as half of all login attempts using our platform](https://auth0.com/resources/whitepapers/credential-stuffing-attacks).

Auth0 Signals, coupled with the Anomaly Detection Engine, will detect these attacks with a high degree of efficacy early in the authentication pipeline. IP addresses identified as participating in a credential stuffing attack will be forced to solve a CAPTCHA, which addresses the vast majority of these attacks.

## Try the API Now. It's Free!

Auth0 IP Signals will assist security analysts with incident response and forensic investigations, as well as provide application security engineers with proactive abuse prevention accessed via an API.

<script src="https://fast.wistia.com/embed/medias/v6ilxd3jhu.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:60.83% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_v6ilxd3jhu videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
 <br>
 
### Incident response and forensics 

When a security incident is identified, security analysts begin investigation and response processes to determine if a legitimate security incident occurred, the scope of the incident, and the best way to remediate the threat.

Using the _Auth0 IP Signals_ tool, security analysts can submit IP addresses involved in such incidents to quickly identify traffic from known threat sources.

### Abuse prevention

Using _Auth0 IP Signals API_, security professionals can detect malicious activity proactively, not reactively. For example, automatically checking IP reputation during the authentication flow can help prevent common threats, such as credential stuffing attacks.

## Final Thoughts

Last year, I wrote about [our vision for our identity platform](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/) and how we want to help security professionals by providing them with a single pane of glass that alerts them and self-remediates any sort of identity attack. This is a step towards fulfilling that vision. I am very excited about what's coming this year to help you all making your applications safer.

**To try out Auth0 IP Signals, our first free Signals API, visit [auth0.com/signals/ip](https://auth0.com/signals/ip)**


New Ways to Combat Automated Attacks: Auth0 Signals

Customer identity and management technology helps utilities reshape how they interact with users, improve their services, and tighten security.



Utility companies are in a unique position because of the sheer amount of data they collect and the number of users they manage. This affords them opportunities to generate value in ways that other companies can't.

But this wealth of information comes with several challenges. Users have [high expectations that many utility companies have yet to meet](https://www.powerengineeringint.com/articles/print/volume-26/issue-1/features/three-challenges-for-utilities-in-2018.html), and the [prevalence of inefficient customer management systems](https://www.appcues.com/blog/3-customer-engagement-strategies-that-make-users-feel-like-one-in-a-million) leaves many teams vulnerable to service outages and even cyberattacks.

Using customer identity and access management (CIAM) technology can help utility companies avoid three of the industry’s most common issues:

1.  Inefficient trouble-shooting
2.  A lack of personalized service
3.  Security

Instead of tackling each with a separate set of tools and processes, a CIAM approach offers a single way to improve all three.

## 1. Quickly Fix Customer Access and Use Issues With a Central Dashboard.

Many utility companies have [decentralized and poorly planned processses](https://www.nccoe.nist.gov/sites/default/files/library/sp1800/es-idam-nist-sp1800-2a-draft.pdf) to let users access their power platform. Without a clearly defined system, utilities are more likely to feel the burden of service interruptions and suffer longer and more expensive delays in resolving them.

This can also make it difficult to help users in real time both with larger issues, such as power outages, and with simple fixes, such as password resets. Disorganization can diminish customer satisfaction and threaten a company's reputation in the industry as well as its ability to manage a large volume of users, obstructing productivity, and growth.

For companies looking to avoid these issues, a central dashboard can help [consolidate previously disparate streams of information](https://auth0.com/user-management) within an organization. In addition, if it's high quality, this product can, at any given moment, show which customers are logged in and provide their locations and current behavior.

![Central utility customer dashboard consolidates information streams](https://images.ctfassets.net/23aumh6u8s0i/4GgUoZRC73okir7MpR0W1w/7a588a02e3dac5fbf20311b66064e487/central-dashboard-consolidates-information-streams)

A robust dashboard will offer several ways to visualize the information, such as with a heat map of logins, along with pictures and users' personal details to help verify and learn more about them.

### Make Password Resets More Efficient

Internet users average [37 password resets a year](https://blog.dashlane.com/wp-content/uploads/2015/07/MailboxSecurity_infographic_EN_final1.jpg). Without an efficient process to tackle these, a simple fix can become frustrating and time-consuming. For utilities, a dashboard is an easy way for system admins to connect directly with end users on tasks like these.

In addition to greater overall user management, a dashboard allows admins to create a specific [password-reset page](https://auth0.com/docs/hosted-pages/password-reset), which they can tailor to their company's specific needs:

![Hosted login page for better password management](https://images.ctfassets.net/23aumh6u8s0i/5pvz5OyXVoS4npg1snIKE6/e27fe6683509cfc5c07518645ee91dd9/hosted-login-page-for-better-password-management)

The tool will enable users to change their passwords independently, without the added burden of IT support. It also allows a company to maintain consistency in the appearance of all associated pages—from login through password reset and more.

This approach can also help a team track the number of password resets happening at any given moment or determine how frequently specific users are requesting resets, helping admins identify and solve larger problems, including suspicious behavior.

## 2. Get to know your customers.

Many believe that [utilities are falling short in meeting customer needs](https://www.publicpower.org/periodical/article/utilities-missing-out-personalized-marketing-opportunities). As many [startups push the bar higher for customer success](https://www.forbes.com/sites/matthunckler/2017/08/23/the-top-3-strategies-for-customer-success-for-high-growth-tech-startups/#73ff49206805), a strong CIAM system can help buck the stereotype that established utilities aren’t innovative.

Being able to understand and meet the expectations of your customers is critical to [customer retention](https://www.appcues.com/blog/proven-customer-retention-strategies). CIAM technology will help you paint a fuller picture of each customer. In addition to incorporating data on their logins, devices, and utility usage, you can you can use [progressive profiling](https://auth0.com/blog/progressive-profiling/) to pull details like their location and their email addresses and even the interests they indicated at the login stage.

![Utility customer progressive profiling flow](https://images.ctfassets.net/23aumh6u8s0i/35XPMAPBa8EcYYET3tFRWI/44496d8d82c815206fbe3d512475805d/progressive-profiling-flow)

With a more comprehensive collection of data, teams can proactively match the right users to the right promotions. It can help organizations develop new services, boost engagement, and avoid being branded as a company that sends irrelevant spam messages and push notifications.

## 3. Block Suspicious Behavior.

On top of helping utility companies better understand and anticipate customer needs, a secure CIAM setup is crucial in an [industry facing an increase in cyber threats](https://www.bloomberg.com/news/articles/2018-04-04/cyberattack-bleeds-into-utility-space-as-duke-sees-billing-delay).

A recent IBM report found that the [average cost of a data breach for a utility company](https://www.ibm.com/blogs/insights-on-business/energy-and-utilities/security-breach-energy-utilities/) was approximately $3.5 million per incident in 2016. For companies based in the United States, that number jumped to an estimated $7.4 million, and just this year, an [American power company was fined an unprecedented $2.7 million](https://www.bankinfosecurity.com/us-power-company-fined-27-million-over-data-exposure-a-10715) for leaving customer records publicly exposed for 70 days.

CIAM offers simple but effective solutions that can help you quickly respond to suspicious behavior in your system and prevent a breach. Features like [anomaly detection](https://auth0.com/docs/anomaly-detection) will instantly block users with unknown addresses or repeated failed login attempts.

Not knowing who is in your system or what information they are accessing can cause more than just fines and lawsuits: Without a strong user-management system, companies are forced to inefficiently use IT resources and even take systems off-line while searching for the source of a breach. On top of losing money, these interruptions in service can draw even more attention to your failure to secure user data.

## Consolidating customer data will shape the future of utilities

The utilities industry is set to experience major shifts in the coming years thanks to new technologies and energy sources. As competition increases, companies that embrace strong access and identity technology will emerge as leaders that avoid costly mistakes and create deeper connections with their customers.

<include src="asides/AboutAuth0" />


How Utilities Can Use CIAM to Avoid 3 Common Problems

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Japan’s public cloud spend is expected to reach $5.8 billion by the end of 2018, but cyberattacks are on the rise. Auth0 authentication can help.



## Rising Cyber Attacks Push Need for Stronger Defense

Shedding legacy systems through digital transformation is increasing the global spend on public cloud services, according to a recent [IDC forecast](https://www.idc.com/getdoc.jsp?containerId=prUS43511618). By the end of 2018, worldwide spending on public cloud is expected to reach $160 billion — a 23.2% increase over 2017. While the United States is still spending the bulk of those billions, Japan’s rapidly growing market is expected to contribute at least $5.8 billion to that spend.

With increased reliance on cloud services, comes an increased awareness of the potential for cyberattacks, especially since Japan’s government cloud faces consistent attacks. On April 3, Japan’s [National Center of Incident Readiness and Strategy for Cybersecurity](https://www.nisc.go.jp/eng/) warned that official email addresses for about 2,000 government officials had been leaked, reports the [Japan News](http://the-japan-news.com/news/article/0004351856), noting that each year, government agencies face more than one million attacks.

“Without the right protections,” says Auth0 CISO Joan Pepin, “government cloud can be at least as vulnerable as public cloud. Authentication — making sure that users are who they claim to be — is a foundational security control.”

Certain industries, like the discrete manufacturing, manufacturing, and professional services industries that will take up to 43% of Japan’s spend, are turning to IoT to increase their capabilities, according to IDC. While these devices offer rapid, non-touch action as well as the collection of massive amounts of data, they also open organizations to various vulnerabilities, since the [IoT industry lacks a consistent set of standards and protocols](https://www.gov.uk/government/publications/secure-by-design).

More than [20 billion connected devices](https://www.gartner.com/newsroom/id/3598917) are expected to be online globally by 2021, according to Gartner, bringing with them the potential for [geometrically increasing risk](https://auth0.com/blog/security-risk-20-plus-billion-iot-devices-by-2020/). These vulnerabilities are easily exploited by hackers — [botnet controllers increased by 140% in 2017](https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924).

<include src="TweetQuote" quoteText="“Without the right protections,” says Auth0's @CloudCISO_Joan, “government cloud can be at least as vulnerable as public cloud. Authentication — making sure that users are who they claim to be — is a foundational security control.”"/>

Given all the cybersecurity risks, Japan, [like several other governments around the globe](https://auth0.com/blog/gdpr-effect/), took significant steps to protect personal data when the [Act on the Protection of Personal Information (APPI)](https://iapp.org/news/a/matchup-gdpr-and-japans-act-on-the-protection-of-personal-information/) came into force last May. Although focused on data protection and privacy like the EU’s GDPR, APPI focuses on protecting the rights of individuals and extends protections to include personal identifier codes, and aggregated information in the "business operator’s" database. The EU and Japan are currently in discussions regarding mutual "whitelisting."

Based on these regulations and stricter policies around data management in the region, the need for enterprises in Japan to prioritize identity management is undeniable. We addressed this demand by establishing a formal Auth0 presence in Tokyo last year, and launching our [website in Japanese](https://auth0.com/blog/auth0-japanese-localization/): [https://auth0.com/jp](https://auth0.com/jp), and are continuing to dedicate significant resources to this region. Auth0 is uniquely suited to address the challenges of Japan-based and global companies looking to expand in this growing market. If you’re based in Japan and would like to learn more about how Auth0 can create a first line of seamless and secure defense, please reach out to [yuichiro.kuwano@auth0.com](mailto:yuichiro.kuwano@auth0.com).

<include src="TweetQuote" quoteText="Auth0’s authentication can help protect industries like discrete manufacturing, manufacturing, and professional services expected to take up to 43% of Japan’s $5.8B public cloud spend spend in 2018."/>


Japan's Digital Transformation Driving Public Cloud Spend

With 93% of breaches found to be preventable in Q3 of 2017, Auth0 offers concrete ways to protect patients against rising cyberattacks.



## Block Medical Identity Thieves with Cyber Hygiene

Cybersecurity attacks increased in number and sophistication in 2017. But the Online Trust Alliance (OTA), a global nonprofit dedicated to promoting online innovation and trust, found that [93% of breaches through Q3 could have been prevented](https://otalliance.org/system/files/files/initiative/documents/ota_cyber_incident_trends_report_jan2018.pdf). Only 52% of those breaches were caused by actual hacks. Internal issues that resulted in accidental or malicious events instigated by employees accounted for another 11%.

This is good news for healthcare organizations charged with protecting large quantities of personal health information (PHI) attracting data thieves.

Medical identity theft brings more than standard identity theft horrors. It allows criminals to pose as patients, securing prescription drugs or even medical treatment.

Victims of medical identity theft can even find themselves paying the thieves’ deductibles. An [Accenture study](https://www.accenture.com/us-en/insight-accenture-health-2017-consumer-survey) found half of U.S. victims were stuck with an average of $2,500 in out-of-pocket costs after an attack. Plus they have to clean up a medical history that can lead to serious treatment errors.

That kind of patient experience can send a customer doctor shopping. A [2018 PwC report](https://www.pwc.com/us/en/health-industries/assets/pwc-health-research-institute-top-health-industry-issues-of-2018-report.pdf) noted that 26% of consumers would change doctors, hospitals, insurers, or medical organizations after a hack.

<include src="TweetQuote" quoteText="26% of consumers said they would change healthcare providers after a hack. Cyberattacks may be rising, but 93% of hacks are preventable. Auth0 offers concrete ways to keep your patients safe."/>

"Healthcare organizations are just starting to realize that cybersecurity is not a cost center,” says Auth0 CISO Joan Pepin, speaking from more than twenty years experience handling cybersecurity, “It's actually adding value by placing the focus on the well-being of their end customers."

<include src="TweetQuote" quoteText="Healthcare organizations are just starting to realize that cybersecurity is adding value by placing the focus on the well-being of their end customers. —Auth0 CISO Joan Pepin"/>

And 2018 is already laying out challenges and consequences.
Half of Norway’s entire population — 3 million people — was already exposed in a [professional healthcare hack](https://www.scmagazineuk.com/half-of-norways-population-have-medical-data-leaked/article/738079/) in January. Although swift by current standards, breach notification fell well outside GDPR’s 72-hour requirement. After May, that lag will mean stiff fines.

Even outside the EU, breaches can have expensive consequences. Last year U.S. health insurer [Anthem paid a $115 million settlement](https://www.nbcnews.com/news/us-news/anthem-pay-record-115m-settle-lawsuits-over-data-breach-n776246) on over 100 consolidated lawsuits due to a 2015 cyber attack.

![Healthcare cybersecurity](https://images.ctfassets.net/23aumh6u8s0i/73bOR9hNS3ww9qRI6yTIjS/847eb9ef2e2b53769fabf1c7fc508053/med)

## Creating Your Cyber Hygiene Protocol

There is no such thing as a 100% vaccination against cyber attacks, but there are several steps you can take to protect your patients and your organization.

Pepin often mentions the protective strength of regular cyber hygiene. Like asking healthcare professionals and visitors to scrub in before visiting intensive care units, regularly following a set of logical protocols and actions can reduce cyber-attack risk.

### 1. Backup and Patch

Backups, regular patching, and third-party risk assessments can provide insights into areas in need of attention.

### 2. Instill Screen Locking

For situations where patients could access monitors, its best for healthcare professionals to follow the practice of locking the screen whenever they need to leave the room.

### 3. Retire Unsupported Devices and Applications

Making the argument to retire an older device can be challenging, especially when the device appears fully functional, but a device that runs on software that’s no longer updated leaves your entire network open to attack.

Unsupported applications and operating systems offer similar points of entry for hackers. Part of good cyber hygiene is putting together an end-of-life plan for these devices and applications.

### 4. Educate Your Staff In Social Engineering

Educating staff to recognize increasingly sophisticated spoofing, spear-phishing, and malware attempts can help stave off ransomware attacks and their potential economic impacts.
The FBI rates Business-Email Compromise (BEC) attacks as a “serious threat on a global scale.” Since 2015, the FBI’s Internet Complaint Center (IC3) has seen a [1,300% increase in identified exposed losses totalling more than $3 billion](https://www.fbi.gov/news/stories/business-e-mail-compromise-on-the-rise).

Pepin points out the need for regular maintenance and backups so you have the option of rebuildingand restoring rather than suffering a cessation of services in the case of a ransomware attack — and it means you retain access to your data. As [one in three Australian companies](https://www.theguardian.com/technology/2017/may/15/dont-pay-ransomware-demands-cybersecurity-experts-say-wannacry) surveyed by Telestra in 2017 discovered, paying the ransom doesn’t automatically get it back.

### 5. IoHT Devices: Inventory, Authorize, and Authenticate

Thousands of internet of health things (IoHT) devices are already in use in the form of patient monitors, imaging and x-ray devices.

Part of the draw is a large ROI. According to Aruba’s [2017 State of IoT study](http://www.arubanetworks.com/assets/infographic/Aruba_IoT_Healthcare_Infographic.pdf), healthcare organizations expect to a see a 40% ROI on the devices, despite the fact that 89% say they’ve already experienced a breach because of an IoT device.

But that ROI could be at risk. Reported medical device cybersecurity vulnerabilities in the U.S. climbed by [525%](https://www.pwc.com/us/en/health-industries/assets/pwc-health-research-institute-top-health-industry-issues-of-2018-report.pdf)  in 2017 according to PwC. Increasing vulnerabilities combined with heavy adoption rates has [IDC](https://www.brighttalk.com/webcast/15909/275931) expecting the world’s first USD $100 million lawsuit as the result of a cyber security attack on a medical device by 2021. Given regulatory trends like GDPR that lay responsibility for third-party vendor compliance at the feet of hiring organizations, the device manufacturer wouldn’t be the only one facing fines and possible lawsuits.

In an effort to reduce vulnerabilities, regulatory organizations like the FDA and ENISA are offering guidelines, hoping to increase interoperability, but the truth is that decreasing manufacturing costs have already lead to a proliferation of IoHT devices running on different protocols. It’s not unlikely that a single hospital must manage hundreds of varying protocols from its IoHT devices.

Inventorying devices in use makes it easier to recognize what to keep and what to retire, especially since most older IoHT devices lack the ability to be patched.

According to Component’s healthcare forecast, the IoHT global market is expected to grow from [$41.22 billion to $158.07 billion by 2022](https://www.marketsandmarkets.com/PressReleases/iot-healthcare.asp), which means more devices will come online. Getting a handle on what you have in place and understanding security vulnerabilities now will save on headaches later. Auth0 offers secure IoHT authentication and authorization protocols that can further secure vulnerable PHI and protect the rest of your system.

### 6. Eliminate System Siloes with a 360 Degree Patient View

Siloed systems provide hackers with multiple points of entry and make it harder to manage cyber-hygiene updates. Consolidating databases also makes it easier to identify care gaps and limit avoidable care errors. Auth0’s consolidated patient view means you can quickly authenticate and authorize patient access, understand if your patient is interacting with IoHT devices, and take advantage of API security — all of which reduces user friction, improving your patient’s overall experience and reducing risk.

### 7. Step-Up Authentication

One of your best deterrents is making sure your patients are who they say they are. Authenticating identity often happens only at login. Auth0 gives you the opportunity to add step-up authentication at any time during the patient journey. For example, if your patient normally logs in from his or her home address, but suddenly logs in from a different country, the patient might be traveling. Or they might be a hacker. Activating Auth0’s step-up authentication allows you to push out a request for additional information to a sanctioned device, like your patient’s phone. In a well-designed flow, this is handled easily, without disrupting your patient’s journey, ensuring the security of your patient and your system.

### 8. Perform Reasonable Triage

Despite the real threats, you can’t do all of these things at once. Identifying your areas of greatest risk can help you recognize which tasks to handle in-house and which are best handled by a trusted-third party vendor.

Cybersecurity can be easy to get wrong. In 2017, Molina Healthcare, a major Medicaid and Affordable Care Act provider, was [forced to shut down its patient portal](http://www.healthcareitnews.com/news/molina-healthcare-breached-exposed-patient-data-over-month) after discovering a “security 101” flaw, impacting 4.8 million patients.

If cyber-security is not your IT team’s area of expertise, it could be time to hire expert help. Auth0 authenticates and secures more than 50 million logins each day for customers in 70+ countries. Sophisticated data encryption algorithms are best left in the hands of those who regularly beat hackers and assume responsibility for upgrades and maintenance.

## Find Out How Auth0 Can Help Healthcare Organizations

Auth0 is trusted by healthcare organizations like Healthgrades, Clinica Alemana, Green Cross Health, IntegraMed, the Seattle Cancer Care Alliance and more. If you’d like to learn more about how Auth0 can help you securely put your patients at the center of their healthcare experience, reach out to [sales@auth0.com](mailto:sales@auth0.com).


"cyberattacks"