MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

There’s no patch for humanity, but that’s not a bad thing

Let’s face it. We all make mistakes. Even the most diligent, well-intentioned employee can inadvertently open the floodgates to an attack. Telecoms giant Verizon illustrated this earlier this year, when it published the 2021 edition of its Data Breach Investigations Report (DBIR).

The DBIR examined approximately 5,250 successful security breaches, gathering data about the methodologies used. It found 35 percent of attacks incorporated a social element. Of these, the vast majority (85%) used phishing tactics.

**In short:** you can deploy all the technological measures you want, but unless you address the human element, an attacker can defeat your defenses with a simple phone call or email.

Social engineering has always intrigued me. There’s something weirdly compelling about someone circumventing the defenses of a company with nothing but a winning smile and a confident tone, and industry raconteurs like Jenny “The People Hacker” Radcliffe and Kevin Mitnick have some incredible stories to share.

But there’s something else. Many of the tactics successfully employed by social engineers can be found throughout history, used in the fields of warfare, espionage, and criminality. Shadowy state actors targeting government departments can be found using the same playbook as Classical-era Greek military tacticians.

There’s a reason for this. Humans are social animals. We have certain inherent traits. We’re often willing to trust strangers, and we help those we don’t necessarily know. We live by a set of rules, both written and unwritten. These attributes allowed us to develop societies, permanent settlements, and eventually nation states. But they can also be exploited by malicious actors seeking to further a particular goal.

> Technologies and tactics change. Human nature is a constant.

This article will explore some of these historical parallels. We’ll take a journey through time that starts in the Roman city of Brundisium, circa 19 BCE, with detours through the swinging sixties, the latter years of the Vietnam War, and the early days of the Internet. We’ll put the tactics used by social engineers into context, and show why they’re so effective. And finally, we’ll learn how to defend against them.

## Our Unpatchable Human Zero-Days

Before we start our trip, it’s probably a good idea to talk about the human qualities commonly targeted by social engineers.

While researching this post, I sought out as many tales of real-world social engineering as I could find. I thumbed through books by Chris Hadnagy and Kevin Mitnick. I listened to conference talks from the likes of Paul Wilson and Jenny Radcliffe. I devoured entire episodes of The Darknet Diaries.

As I went through, I noted most attacks focused on certain human attributes. These included:

*   **Curiosity**  
    **Every great scientific and technological leap started with the words: “What if?” But you don’t need to be Einstein to have curiosity. We use trial-and-error and experimentation to make sense of our environment. Social engineers frequently exploit this when harvesting credentials or [deploying malware](https://darknetdiaries.com/episode/100/).
*   **Trust**  
    **Life’s easier (and nicer) when you assume everyone acts in good faith. And so, we take people at their word. If an unfamiliar voice calls and claims to be from your bank or phone company, you might instinctively believe them. Social engineers can — and often do — exploit this.
*   **The Desire to Help**  
    **Since we’re social animals, collaboration is inevitable. If we see someone in need of assistance, chances are we’ll offer it. When exploiting this, a social engineer might pretend to be a low-ranking employee in need of credentials, access, or documents. They’ll count on the target feeling pity for them.
*   **Fear**  
    **The “fear factor” frequently features in social engineering attacks. You’re probably familiar with phishing emails claiming your bank account has been hacked, or your social media profile will be deleted unless you click a link. This tactic pressurizes the target into making hasty decisions and dropping their skepticism.
*   **The Desire to Comply**  
    **Almost all organizations — both public and private sector — are hierarchical. There’s a pecking order, with some people at the top, and others at the bottom. We tend to listen to (and obey) those higher up in the echelons. Attackers can exploit this by masquerading as high-ranking employees and issuing edicts to junior employees.

Each of the historical examples listed in this article uses these innate attributes, often to devastating effect.

## From USB Sticks to Wooden Horses

The year is 2008. A threat actor, most likely working for a foreign state, had broken into the heart of the United States defense establishment. Showing remarkable skil, the attacker had successfully deployed a data-siphoning worm onto a Central Command (CENTCOM) computer. From there, it proliferated like a fungus, spreading undetected into other computers.

William J. Lynn III, an Obama-era Deputy Secretary of Defense, later described it as "[the most significant breach of U.S. military computers ever.](https://archive.defense.gov/home/features/2010/0410_cybersec/lynn-article1.aspx)" He wasn’t wrong. The worm took almost 14 months to eradicate, and it infected both classified and unclassified machines. It’s hard to quantify the damage it inflicted on the Department of Defense.

Adding insult to injury, the damage was arguably self-inflicted. The virus, later dubbed Agent.biz, was distributed on USB sticks dropped in the parking lot at an unnamed Middle East military base. A CENTCOM employee picked one up and plugged it into their laptop.

The Department of Defense never identified the employee responsible for the first infection. We’ll never know their motivations. Were they curious about the drive’s contents? Did they want to reunite the drive with its owner? Or did they just want to save the $20 on a new memory stick? It’s not clear.

In the end, it doesn’t matter. The damage was done. The Department of Defense was forced to spend critical resources identifying and wiping infected machines, as they eliminated the worm one computer at a time. And it forced the military to radically change their approach to computer security, ultimately leading to the creation of the United States Cyber Command.

Still, I can’t help but wonder what the ancient Roman poet Virgil would think of this tale. Two millennia prior, Virgil was spending his twilight years in the city of Brundisium (now Brindisi), where he worked on his opus, the epic poem Aeneid.

Aeneid described the Siege of Troy. This is perhaps the most famous battle that never actually took place — or, at least, in the way depicted. Pretty much everything below is apocryphal. Still, it’s a great story, so indulge me.

Here’s the TL;DR: Greece was at war with Troy. It wasn’t going well. Both sides were effectively at a stalemate. Troy had retreated behind the walls of its capital city, where it could hold out indefinitely. After an exhausting decades-long siege, the Greeks were eager to end the campaign. And so, their leader, Odysseus, conjured a devious ruse.

Greece would pretend to surrender. Their forces would retreat. By means of apology, they left a large wooden horse at the gates of the city, which the Trojans interpreted as a tribute to their greatness.

We all know what happened next. The Trojans hauled the horse into the city, unbeknownst to the shock force of Greek warriors lurking within its interior. As night fell, they crept out and unlocked the gates to the city. The rest of the Greek army surged forward, flooding in and bringing the war to its conclusion in a matter of hours.

Technologically, USB drives and wooden horses couldn’t be more different. But in both of the examples cited, they were used to inflict devastating losses to the target. More importantly, they were only effective because the victim implicitly trusted they wouldn’t be used to harm them. Trust can be a dangerous thing.

## Helpful Humans

In the 1990s, Kevin Mitnick was the ultimate cybercrime bogeyman. He won his notoriety by breaking into some of the most powerful technology and telecommunications companies in the world. His misadventures were front-page news and even inspired two feature-length movies (one documentary, another dramatic).

Now, Mitnick is a legitimate cybersecurity professional and author. Through talks, articles, and books, he warns about the risks posed by social engineering attacks, giving examples from his own criminal past.

Many of his tales describe interactions with relatively low-level employees at the target company. He would build a rapport with the worker and gather information, which he would later use to achieve his larger goals.

In one example, detailed in his book [Ghost in the Wires](https://www.amazon.com/Ghost-Wires-Adventures-Worlds-Wanted/dp/0316037729), Mitnick sought to access the phone records of a friend he suspected of working for the FBI. He repeatedly called the phone provider, each time building a rapport with the employee and teasing out details relating to the account. Once he gathered enough information, he convinced the provider to fax the target’s previous invoice, claiming he needed it to rebuild his phone book.

Mitnick was successful because the employees didn’t question whether he was the real account holder. They weren’t motivated by data security, but rather customer happiness. They simply weren’t suspicious. He would successfully re-use these tactics again and again, before the FBI brought his criminal career to an abrupt end in 1995.

Twenty-five years earlier, a group of Anti-Vietnam War activists used a similar approach when breaking into a Delaware draft office. The group had already penetrated several military offices, as they sought to frustrate the recruitment of new soldiers into the highly unpopular war. They were seasoned burglars.

This Delaware office, however, proved a challenge. It was protected by an advanced, heavy duty door. Their usual tools — crowbars and lock picks — were useless here. And so, they had to think outside the box.

During the daytime, the office’s door was unlocked. A member of the group crept in and left a note behind. It read: “Please don’t lock this door tonight.”

It was simple. Obvious, even. And it worked. The group later returned under the cover of darkness. They approached the door and twisted its handle. It opened with a satisfying click. They gathered the documents they came for and left. In 2014, after the statute of limitations expired, the group would tell their tale to veteran Washington Post journalist Betty Medsger.

No doubt, the draft office was staffed by seasoned military servicemen. They understood risk, and no doubt knew of the widespread opposition to the Vietnam war. And yet, this experience was overridden by their desire to be helpful, and to comply with the request of a colleague or superior. They trusted the note’s provenance, and didn’t think to consider that it may have been left by an adversary.

## Why Social Engineering Works

The term “social engineering” sounds deceptively modern. In reality, it could be used to describe the kind of subterfuge used by criminals and military leaders throughout history.

You can draw parallels between the approaches detailed in Chris Hadnagy’s book [Human Hacking](https://www.amazon.com/Human-Hacking-Friends-Influence-People/dp/0063001780), which focuses on their application in legitimate offensive security procedures, and those used by convicted fraudster Frank Abagnale, as described in his book [Catch Me If You Can](https://www.amazon.com/s?k=catch+me+if+you+can+book&gclid=Cj0KCQjwwNWKBhDAARIsAJ8HkhcNRSvRdVegZPvCiI176SCZvOnGn3rDQGLMGOoA039SYYck0AfzRFAaAtWEEALw_wcB&hvadid=409998390125&hvdev=c&hvlocphy=9033339&hvnetw=g&hvqmt=e&hvrand=1184131583828329460&hvtargid=kwd-421448854&hydadcr=24630_11410023&tag=googhydr-20&ref=pd_sl_7yubf00gv6_e). The basic concepts are the same, with the only real point of differentiation being how they’re used.

Complicating matters, it’s now possible to perform social engineering attacks at scale. Through phishing (as well as its evil siblings, Smishing, or SMS phishing, and Vishing, or phishing via voice), a bad actor can reach millions in a matter of moments.

In 2020, the FBI received 231,000 reports of phishing attacks — or double that previous year’s figure. The real figure is almost certainly significantly higher, with most attempts unreported to the bureau. It affects non-profit organizations, businesses, and individuals, albeit to varying levels, and the costs can measure in the millions.

Earlier this year, US authorities sentenced the ringleader of a Business Email Compromise (BEC) scam to ten years in prison. The man, Obinwanne Okeke, stole $11m from companies in the construction industry by issuing fake invoices with the funds directed to foreign bank accounts.

Looking further back, in May 2000, Filipino malware developer Onel De Guzman caused an estimated $5.5bn to $8.7bn in damages, after he released a self-propagating worm masquerading as a love letter. The ILOVEYOU worm sought to steal dial-up internet credentials, and inadvertently took down the mail services of the UK parliament, Microsoft, and the US Department of defense.

> Here’s the good news: You can take steps to mitigate the risk social engineering poses to your organization.

Technical measures, as recommended by the US Computer Emergency Response Team (US-CERT), include the use of multi-factor authentication (MFA), email filtering, and firewalls. It helps to stay abreast of recent developments, and the Anti-Phishing Working Group provides helpful information about new threat actors and trends.

Training also plays an important role. It’s possible your colleagues are unaware that social engineering exists. Teach them about the tactics used and the importance of verifying the identities and details of those they interact with, along with your organization’s phishing reporting procedures. If you don’t have one, make a point to create one, even if it’s something as simple as a dedicated inbox, where employees can forward suspicious communications.

Finally, creating a culture of transparency and collaboration is important. Your colleagues should feel able to report security issues without fear or judgment.

"Our innate human traits make us vulnerable to social engineering attacks, and always will. The best and most scalable defense is to create a strong security culture, both within organizations and across society at large. When we empower people to detect and respond to these attacks, we build a more secure Internet for all," said Annybell Villarroel, Security Awareness and Culture Manager. To find out how Auth0 can meet your organization’s identity needs, click here.

How Social Engineering Has (And Hasn’t) Evolved Over Time

Chitra Dharmarajan

A motivated CyberSecurity professional with a specialization in IIOT, Cloud Application & Infrastructure Security, Web Application Security, Product Security, and Solutions Architecture. An innovative technical leader, who has efficiently managed cross-geographical teams to successfully deliver Secure Development Lifecycle, Incident Management, Penetration Testing, Product Development & Release Management initiatives. Excels in translating strategic objectives into actionable plans and solving complex problems while delivering high-quality business results. 

Senior Director, Product Security

A quick look at the refreshed OWASP Top 10 to celebrate Cybersecurity Awareness Month

A Tour Through the OWASP Top 10

Security leaders will increase visibility and diversity of thought to meet consumer (and business) expectations

From the Colonial Pipeline attack, which resulted in fuel shortages across much of the East Coast, to the devastating breach on Microsoft Exchange, it’s safe to say 2021 was a tumultuous year for cybersecurity. But what will the next year look like?

I reached out to Auth0’s leading security and privacy experts to hear their predictions for 2022, and to learn how organizations will grapple with a changing threat landscape and the ongoing pandemic.

![Predictions](https://images.ctfassets.net/23aumh6u8s0i/e8LLSbz9kUTIssTNzD33k/1c58e52ea17e0bf67b104322e8ade137/cybersecurity-prediction-sep1)

## 1. The Visibility Challenge

It’s been almost eighteen months since the Covid-19 pandemic forced us to rethink everyday life. The workplace was no exception. States ordered tens of millions to work from home, as they sought to limit the virus’ spread. To accommodate this flood of remote working, IT departments raced against the clock to build the necessary technology infrastructure.

Now, the dust has settled. The pressure has eased slightly. It’s time to take a breath. But don’t get too comfortable.

The next challenge for IT leaders — and CISOs in particular — is in securing the newly acquired devices and services underpinning remote working. Monitoring and threat detection will likely prove to be the biggest headache.

> “Visibility is fundamental to security,” explained Cassio Sampaio, Senior Vice President of Product at Auth0. “You can’t stop attacks you don’t see. It’s always better to see attacks in progress, rather than after they’ve occurred.”

Many workplaces deployed new hardware and software in record time to ensure the continuity of the business, leaving little time to integrate them into existing security workflows. Sampaio says the big priority for 2022 will be to bring this infrastructure into view.

> “With teams working remotely for the foreseeable future, now’s the time for IT teams to start focusing on security, with monitoring and threat detection both high priorities,” Sampaio added. “Hybrid working, as well as the growth of BYOD and cloud computing, has shifted the definition of a security perimeter. It now includes identity systems, as well as firewalls and IPS tools. It’s critical organizations extend their visibility to include these.”

## 2. Secure by Default Becomes the Norm

Security breaches can occur because of simple user errors. In some cases, vendors inadvertently facilitate that by issuing products with insecure default configurations, putting the onus on the customer to harden them.

> “Far too often, security is treated as the user’s responsibility. This approach has arguably contributed to several high-profile incidents,” said Shiven Ramji, Chief Product Officer at Auth0.

In August, researchers at Upguard learned some apps running on a popular infrastructure provider were leaking sensitive customer and business data totaling 39m records. This included Covid-19 contact tracing details, payroll records, and biographical customer data.

UpGuard attributed the issue to a default configuration that allowed unauthorized third parties to remotely query the underlying data source. But instead of considering it a bug, the provider described the issue as a well-documented feature.

In the face of massive data breaches and other unwelcome security lapses, we expect vendors will take a more proactive approach in creating guardrails for their customers. A Secure by Design approach will become the default. This philosophy sees products shipped with the most cautious settings by default, accompanied by other vital protective features, including Multi-Factor Authentication (MFA) and Privileged Access Management (PAM)

## 3. Malicious Actors Will Exploit Supply Chain Woes

Global supply chains are in disarray. The cost of shipping products between continents spiked during the pandemic, with ships and containers both in short supply. Meanwhile, soaring demand for semiconductors has resulted in widespread shortages of graphics cards, games consoles, and cars, with the “chip drought” expected to last until 2023.

Amid this turmoil, we can expect to see malicious actors take advantage of the situation, exploiting the widespread sense of desperation among businesses and consumers. There is evidence this has already started to occur, with the FBI reporting an increase in Business Email Compromise (BEC) attacks at the start of the year.

> “If you’re a school awaiting a shipment of Chromebooks for remote learning, or a retailer expecting stock from overseas, you might not question an unexpected invoice, especially if it comes from someone you know. The urgency may override your skepticism,” said Annybell Villaroel, Security Awareness and Culture Manager at Auth0.

## 4. Diversity of Thought and Skill Becomes Regarded as an Asset

The security landscape continuously evolves. In the past decade alone, we’ve witnessed the emergence of malware-as-a-service (MaaS), threat actors expanding by franchising their brand and technology to others, and attacks upon national infrastructure. Deepfake technology and bulk SMS messaging have been used to devastating effect.  

IT teams now face increasingly sophisticated opponents, with attacks delivered in greater volume over a variety of mediums. Combatting this will require organizations to draw from a wider range of skills when filling cybersecurity roles.

> “Bad actors have already diversified their thinking. Businesses must do the same,” said Jameeka Aaron, CISO at Auth0. <br>
> “I’ve always argued for a holistic approach to information security,” she added. “Technical skills are important, but so are the soft skills.”

To find candidates with these skills, organizations will have to broaden their hiring criteria and recruit from places they didn’t previously.

> “To respond to this new threat landscape, businesses will have to shift their focus away from GPAs and certifications. You need people who can build bridges within the organization and evangelize good security practices. And going forward, I can imagine hiring managers will recognize communication and language skills as assets, too,” said Aaron.

## 5. Consumer patience wanes over privacy breaches

Five years ago, Have I Been Pwned — a service that allows members of the public to check whether their personal credentials have been leaked — held records on 1.4 billion accounts. Today, that figure is almost 11.5 billion.

Coinciding with that almost tenfold rise is a greater awareness of security breaches among the general public, and signs their patience has begun to wane. According to Auth0’s latest CIAM survey, 92% of consumers expect businesses to keep their personal information safe.

> “A decade ago, security breaches were smaller and less likely to be headline news,” said Sampaio. “Now, they’re front-page news, and they’ve ensnared some of the largest brands in the world. People are tired and scared, and they want businesses to raise their game.”

Perhaps surprisingly, the survey showed that a larger percentage of businesses, 97%, believe they are obligated to protect their customers’ personal information.

> “This figure likely has its roots in many places. Security breaches are bad PR and are hugely costly for the company involved,” said Sampaio.
> “Recent legislation, most notably GDPR, LGPD, and APPI, introduces significant monetary penalties for organizations that experience a security breach. That raises the pressure further.”

## 6. Consumers Begin Expecting Data Portability & Interoperability

From healthcare and financial services to social networks, consumers increasingly recognize the value of data interoperability and portability. It allows you to seamlessly share medical records between practitioners, to see your banking and credit card information from a single central hub, and port your playlist between streaming services.

> “One of the most popular apps in the App Store is Mint, which lets users track spending across their accounts. In the US, FHIR (Fast Healthcare Interoperability Resources) is making it easier for doctors to see the information held on their patients by other medical professionals. From a consumer’s perspective, interoperability is something that makes their lives easier, and data portability allows them to make real choices about who they do business with,” said Lucy McGrath, VP of Privacy at Auth0.

![Interoperability](https://images.ctfassets.net/23aumh6u8s0i/11v4gylcGVWijlKWnhibFw/f7e091c1883197d00af99737574c649d/cybersecurity-prediction-sep2)

Data portability is already a consumer right in Europe thanks in part to GDPR and a number of global sectoral laws - particularly in finance and banking. McGrath expects demand for both portability and interoperability to increase in 2021 and beyond. The OECD has outlined the detailed benefits and challenges in its report _Data portability, interoperability and digital platform competition, OECD Competition Committee Discussion Paper,_ [here](https://www.oecd.org/daf/competition/data-portability-interoperability-and-digital-platform-competition-2021.pdf).

> “It’s likely that we’ll see consumers’ expectation for choice - data portability and interoperability - enshrined in more global laws. It’s an exciting space that is spurring innovation - it’s essential the technology supporting the choice continues to protect the privacy of consumers and security of their data in these complex ecosystems” McGrath said.

Top 6 Cybersecurity Predictions for 2022

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

Auth0’s first custom CTF with Hack The Box in honor of October Security Awareness Month

From companies to consumers, we believe everyone has a responsibility to make technology as secure as possible. For Auth0, this means building secure processes, technology, tools, and a culture of trust that puts people at the center. So this year we want you to join us for our first-ever custom Capture The Flag (CTF) with [Hack The Box](https://www.hackthebox.eu/) from October 18th to October 25th.

## But Wait a Minute, What Is a CTF?

A CTF or Capture The Flag is a cybersecurity competitive game where you have to solve or hack different types of challenges to gain access to a string -the flag- which looks something like this: `HTB{m1_f1rst_fl4g}`

You enter that flag into Hack The Box and get points depending on the difficulty of the challenge. The team with the most points wins the game.

## Sounds Easy, Is That It?

But winning alone is not the goal in our case. We designed our CTF with developers getting started in the security world in mind. 

The benefit of learning cybersecurity principles and hacking techniques through a CTF is that you have certainty that the vulnerability exists in the challenge. When you go hacking in the real world, you don’t know whether the environment will be vulnerable or not. CTFs can also help you develop an attacker mindset, so the more you practice, the more secure and defensive your code will be.

Rikaard Hosein, Offensive Security Engineer (i.e hacker) at Auth0, and the mastermind behind this event got started in cybersecurity thanks to CTFs. _“I solved my first cybersecurity web challenge when I was 15 and I was hooked. I kept on practicing CTFs in my spare time, and thanks to them I was able to transition from a developer role to Auth0’s offensive security engineering team. I designed the challenge concepts for this CTF to give you a little taste of what the CTF world is like, and to help you learn about cybersecurity”_. 

Our CTF is a Jeopardy-style one, meaning that the team that gets the most points wins. We have different types of challenges:

* **Web: **here you’ll find mostly web-based vulnerability and also authentication/authorization issues (of course we had to include that!). Web development knowledge will come in very handy on these.
* **Cryptography:** here you can find some improperly implemented encryption schemes, different (and perhaps a bit uncommon 😉) ciphers, and more.
* **Reverse Engineering:** some challenges may include a lower-level programming language like Assembly, decompiling code, debugging by doing step-by-step execution.
* **Pwn - Binary Exploitation: **the 0s and 1s! Finding a vulnerability in a binary or executable file.
* **Misc:** surprise

To solve these challenges you can use a wide range of freely available tools and decipher websites. Rikaard recommends a simple tool belt: a great mindset (learn, have fun, keep trying), [burp suite community edition](https://portswigger.net/burp/communitydownload), your favorite scripting language, [GDB](https://www.gnu.org/software/gdb/) and [IDA](https://hex-rays.com/ida-free/). You may need other tools but finding those is also part of the challenge 😉.

## I’m Excited. How Can I Join?

* No prior experience is required.
* You can participate either on your own or with a team of up to five people. We strongly recommend you find a team. 
* [Create an account in Hack The Box](https://ctf.hackthebox.com/) and sign up for the CTF starting now to get ready for October 18th. If you are part of a team, only the team captain needs to join the CTF (but everyone needs to have an account)
* Join Hack The Box’s [discord channel](https://discord.gg/hackthebox)
* Get ready to hack your way to the podium.

## Resources to Get Started

* [Hack The Box Introduction to CTFs](https://help.hackthebox.eu/en/articles/5200851-gs-introduction-to-ctf)
* [CTF 101](https://ctf101.org/)
* [CTF Write ups ](https://ctftime.org/writeups)(solutions to previous worldwide events)
* [CTF Field Guide by Trailofbits](https://trailofbits.github.io/ctf/)

Let the Hunt Begin: Introducing Auth0’s First Capture the Flag Event.

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Learn which cybersecurity tactics and tools will help you combat today's common cyberattacks.

With more people working remotely or online post-2020, the [FBI reports](https://thehill.com/policy/cybersecurity/493198-fbi-sees-spike-in-cyber-crime-reports-during-coronavirus-pandemic) that cybercriminals are quadrupling the number of cyberattacks they use to disrupt online activities. Research also shows the impact to organizations and their users from a single successful cyberattack is growing each year.

For example, in 2017, nearly [_197 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. In 2020, that number [grew to 37 billion](https://pages.riskbasedsecurity.com/hubfs/Reports/2020/2020%20Year%20End%20Data%20Breach%20QuickView%20Report.pdf), even though the overall number of data breaches had decreased. And IBM reports that the costs are growing for organizations that fall victim to these attacks in countries like the United States, where the average cost of a data breach grew from $7.91M to $8.64M between [2018](https://www.ibm.com/downloads/cas/861MNWN2) and [2020](https://www.ibm.com/security/data-breach).

Many of the methods cybercriminals use to breach organizations rely on human error. Even your sharpest employees can become your greatest weakness if they click on a malicious link without realizing it. However, other cyberattacks exploit gaps in your [data security](https://auth0.com/blog/what-is-data-security/) efforts to gain access to sensitive data.

Below are seven of the most common cyberattacks your organization will face in 2021 and the ways to protect yourself against the data breaches they have the potential to cause.

## 1. Malware Attacks

Malware refers to many different types of malicious software designed to infiltrate, spy on, or create a backdoor and control an organization’s systems or data. This includes ransomware, worms, trojans, adware, and spyware. [Experts report](https://monstercloud.com/blog/2020/03/23/coronavirus-alert-ransomware-attacks-up-by-800/) that malware usage is up almost 800% since early 2020.

Malware has the potential to cause major data breaches and severely disrupt business operations. Microsoft was the victim of a major ransomware attack, where WannaCry [took advantage of a weak spot in their operating system](https://en.wikipedia.org/wiki/WannaCry_ransomware_attack) and displayed the following message to banks, health care providers, manufacturers, and other businesses across the globe:

![image.png](https://images.ctfassets.net/23aumh6u8s0i/1eCk2eoRxo2dlqfakT2rLF/3d36517813cea24b63b795f7fe3a256c/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021)
<p align="center"><i><a href="https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/">Source</a></i></p>

<br /> <br /> 
<p></p>
To regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [Bitcoin](https://bitcoin.org/en/).

Malware is typically downloaded unwittingly by clicking a malicious link or by tricking a user into thinking they're downloading something legitimate when they’re not.

### How to Protect Against Malware Attacks

Teaching your employees how to spot suspicious links and pop-ups that could contain malware will help reduce the chance that it could infect your systems.

Additional ways to protect against malware include keeping your operating systems up to date to ensure known security gaps are patched and using anti-virus software. For example, the [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/) data breach could have been prevented had a known patch been installed in time.

## 2. Phishing Attacks

Phishing attacks attempt to steal information from users or trick them into downloading malware by sending malicious emails or text messages (SMS) that look like real requests but are, in fact, a Scam. Here’s a Dropbox email asking users to verify their email address that’s actually a phishing attack:

![image.png](https://images.ctfassets.net/23aumh6u8s0i/2ISbM89J8qjqwVy4kUpgOf/a1b52597302c386ee8381bfd6f6948d9/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021) 
<p align="center"><i><a href="https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250">Source</a></i></p>
<br /><br />

According to [Verizon’s 2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/dbir/2020/results-and-analysis/), phishing attacks are the most common cause of data breaches globally and have been the root cause of notable instances of cybercrime in the last decade.

The cybercriminals who breached the AP News Twitter account and falsely [tweeted](https://www.bbc.com/news/world-us-canada-21508660) that the White House was under attack used a targeted phishing attack (spear-phishing) to gain access to the account, as did the bad actors who leaked sensitive emails from Hillary Clinton’s campaign chairman [before the 2016 election](https://www.cbsnews.com/news/the-phishing-email-that-hacked-the-account-of-john-podesta/).

### How to Protect Against Phishing Attacks

The best way to protect your organization against phishing attacks is to educate your employees on how to spot a questionable email or text message. The training programs below can help you do this:

* _Digital Defense’s_ [_SecurED training program_](https://www.digitaldefense.com/professional-services/secured-training/)
* _Inspired eLearning’s_ [_Security Awareness_](https://inspiredelearning.com/security-awareness/awareness-c-suite/)

Additionally, CSO has compiled a list of resources that can help you train your teams to spot phishing attacks [here](https://www.csoonline.com/article/3225471/please-dont-send-me-to-cybersecurity-training.html).

## 3. Distributed Denial of Service Attacks

Distributed denial of service (DDoS) attacks disrupt the traffic to a website, application, server, service, or network by overwhelming it with a flood of traffic from compromised computer networks ([botnets](https://usa.kaspersky.com/resource-center/threats/botnet-attacks)) that prevents real users from accessing it. In 2018, GitHub experienced the largest DDoS attack ever when it was hit with 1.35 terabits of traffic per second and was [offline for almost 20 minutes as a result](https://www.wired.com/story/github-ddos-memcached/).

DDoS attacks are common and increased by 50% in 2020 compared to 2019, with a large surge occurring in early 2020 during the pandemic, according to security company [Kaspersky](https://securelist.com/ddos-attacks-in-q3-2020/99171/).

### How to Protect Against DDoS Attacks

DDoS attacks are tricky to identify because they’re often hard to distinguish from legitimate traffic. Some [methods of protecting against DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/) include blocking all traffic for a short period of time, rate-limiting traffic to a website, using a web application firewall to detect suspicious traffic patterns, or scattering traffic across a network of servers to reduce the attack’s impact.

## 4. Man-in-the-Middle Attacks

Man-in-the-middle (MitM) attacks are when bad actors spy on or intercept communication between you and your users or employees. MitM attacks are most commonly used to steal personal or company information or to redirect that information to another destination or in espionage situations, such as when [Russian hackers](https://www.theguardian.com/world/2018/oct/04/how-russian-spies-bungled-cyber-attack-on-weapons-watchdog) attempted to breach the Organisation for the Prohibition of Chemical Weapons (OPCW).

MitM attacks are [not the most common cyberattack](https://www.csoonline.com/article/3340117/what-is-a-man-in-the-middle-attack-how-mitm-attacks-work-and-how-to-prevent-them.html) because many of the same objectives can be achieved using malware. However, MitM attacks do present a threat for organizations because they’re often hard to spot and because [more employees are working remotely](https://www.businesswire.com/news/home/20201215005287/en/Upwork-Study-Finds-22-of-American-Workforce-Will-Be-Remote-by-2025) post-2020.

For example, fake WiFi networks are [easy to deploy](https://hackernoon.com/a-hacker-intercepted-your-wifi-traffic-stole-your-contacts-passwords-financial-data-heres-how-4fc0df9ff152) in public places like coffee shops where remote employees often work. People often connect to these networks without realizing it, allowing bad actors to spy on them while they use the network.

### How to Protect Against MitM Attacks

End-to-end encryption protocols like [Transport Layer Security](https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/) (TLS) are the best way to protect against MitM attacks. Additionally, requiring your employees to use a VPN to access company networks over public WiFi will ensure that any information shared during their session remains private, regardless of whether the network belongs to a bad actor or if their coffee shop’s WiFi is simply unsecured.

## 5. Credential Stuffing Attacks

[Credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) is a type of brute-force cyber-attack where bad actors use stolen usernames and passwords from one data breach to access user accounts at another organization.

![image.png](https://images.ctfassets.net/23aumh6u8s0i/1WPDZfXKzHLheBp0XbP2em/6769d8d365597a77b9de207e48c303d8/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021)

Credential stuffing is possible because, statistically, [65% of all people](https://services.google.com/fh/files/blogs/google_security_infographic.pdf) reuse the same password across multiple accounts. As a result, credential stuffing attacks are one of the [most common](https://enterprise.verizon.com/resources/reports/dbir/) causes of data breaches globally.

### How to Protect Against Credential Stuffing Attacks

The best way to protect against credential stuffing attacks is by either implementing [passwordless authentication](https://auth0.com/passwordless/) or [multi-factor authentication](https://auth0.com/multifactor-authentication) (MFA). Passwordless authentication prevents bad actors from using stolen credentials by eliminating them altogether, while MFA requires bad actors to verify their identity in one or more ways in addition to the stolen credentials they’re using to log in.

## 6. Password Spraying Attacks

Password spraying is also a type of brute-force attack where bad actors attempt to guess a user’s password from a list of common passwords like “123456” or “password.”

Like credential stuffing, password spraying is quite common. For example, Verizon’s 2020 Data Breach Report showed that over [80% of all hacking-related data breaches](https://enterprise.verizon.com/content/verizonenterprise/us/en/index/resources/reports/2020-data-breach-investigations-report.pdf) involved brute-force methods like password spraying.

### How to Protect Against Password Spraying Attacks

Password spraying attacks can be prevented by using passwordless authentication or MFA, just like credential stuffing attacks can be. However, you can also reduce the risk and impact of a data breach via password spraying by following the [NIST Password Guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/), which are considered the best password standards in the world.

## 7. Mobile Device Attacks

[Many organizations are working to increase the mobility](https://www.t-mobile.com/content/dam/tfb/pdf/T-Mobile-for-Business-2020-Workplace-Mobility-Report.pdf?icid=TFB_TMO_P_TFBFTRWRKS_7LCBNVDVYBXY27WF321599) of their workforce because it improves operational efficiency and productivity. However, cybercriminals are well aware of this fact and are targeting mobile devices more frequently [year](https://www.zdnet.com/article/mobile-malware-attacks-are-booming-in-2019-these-are-the-most-common-threats/) over [year](https://www.mcafee.com/content/dam/consumer/en-us/docs/2020-Mobile-Threat-Report.pdf) with a variety of attacks on this list, which puts organizations at risk for a data breach through more devices than before.

[The Pegasus attack](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message. Clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. And once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

### How to Protect Against Mobile Device Attacks

Protecting your organization against mobile security threats requires a strong enterprise mobility management (EMM) program, as well as mobile device management (MDM) tools that help you protect any company data that may be on your employees’ personal or work devices. Identity and access management tools like multi-factor authentication can also help secure any work applications that contain sensitive information from unauthorized access.

## Create Additional Layers of Security at the Login Stage

The impact of many cyberattacks on this list (as well as [others that many companies face](https://www.google.com/url?q=https://auth0.com/resources/whitepapers/state-of-security-identity-report&sa=D&source=editors&ust=1624045583510000&usg=AOvVaw0jtWJoRiARLi1pwCySdu1J)) can be mitigated or prevented with strong authentication protocols.

First and foremost, this means good password policies and sound employee education. However, taking the next step to [secure login procedures](https://www.google.com/url?q=https://auth0.com/login-security&sa=D&source=editors&ust=1624045583512000&usg=AOvVaw2FeIurZ9Qr026LNUW7RDFZ) with security functionality like multi-factor authentication, [brute-force protection](https://auth0.com/docs/attack-protection/brute-force-protection), or passwordless authentication can add a new dimension of safety to your system.

Auth0 makes it easy to build secure authentication for the right people without compromising on user experience — [learn more about Auth0’s platform here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The 7 Most Common Types of Cybersecurity Attacks in 2021

adam-baldwin

Adam Baldwin is a staff security engineer - offensive security at Auth0, with over 26 years of experience. Adam has spent his career building companies, breaking into companies, managing teams, designing products, and talking about security non-stop. He founded ^Lift Security, successful application security and penetration testing service company, and the Node Security Project, an initiative to track vulnerabilities and make security a core value in the JavaScript ecosystem. The project evolved into a SaaS platform at the forefront of the DevSecOps movement. Both were acquired by npm, Inc. in early 2018. NPM was later acquired by GitHub.

Staff Security Engineer - Red Team Lead

Adam Baldwin

How thinking like a hacker can increase your cybersecurity (really)

I’m going to say something we don’t usually say in our blog: ‘hacker’.

If you’re not a security professional, I’ll bet right now you’re thinking of an evil dude in a hoodie doing bad things to computer systems like swiping your sensitive data to sell on the dark web.

But that’s not a hacker; that’s a criminal.

Hackers break into computer systems to do good. How can I make that claim? Because at 15, I started my career doing something that could have gotten me into a lot of trouble.

Instead, the man who could have turned me in rechanneled my energy. I’m the staff security engineer for offensive security at Auth0, a [certified ethical hacker,](https://cert.eccouncil.org/certified-ethical-hacker.html) hold two [DEF CON black badges](https://defcon.org/html/links/dc-black-badge.html) and have 26 years of experience across IT and cybersecurity.

I’m sharing my story to help you understand how hackers think so you can put that mindset to work, helping secure your business. But first, a bit of context via a brief history of hacking.

![Brief History](https://images.ctfassets.net/23aumh6u8s0i/3Cu6Hhk4uxBk10a168mv7g/b7d9b0fcd37582dd087327574361ff8b/WhatIs_Broken_Auth_sep-2)

## Brief History: Why ‘Hacker’ Is an Overloaded Word

Reading this post on your smartphone or personal computer? You can thank hackers and the phone phreaks who inspired them.

(_What follows is a quick summary of the history. For more details, check out the documentary “[The Secret History of Hacking](https://en.wikipedia.org/wiki/The_Secret_History_of_Hacking)”._)

In the 1960s and 1970s, global telecommunications relied on a series of tones to connect calls — and you could replicate the tones with a toy whistle included in a box of Captain Crunch cereal (or sing them if you had perfect pitch). Phone phreakers freely shared knowledge and did some social engineering by talking their way into trunk code access or even walking away with phone company technical manuals, says “The Secret History of Hacking”.

By 1971, they’d shared knowledge with an [Esquire reporter](https://www.ckts.info/downloads/articles/Esquire%20Magazine%20October%201971%20-%20Secrets%20Of%20The%20Little%20Blue%20Box.pdf) and businessmen, stockbrokers, autodealers, and more or less anybody who wanted to make free long distance calls could phreak. This led to jail time for several phreakers but also inspired two college kids: Stephan Wozniak and Steve Jobs, who would go on to start Apple Computing.

At this time, “hacker” still meant someone who was super-curious about computers, how they worked, and how to make them do unexpected things like produce color on TV monitors — and they shared that information with each other freely because that sharing and exploration was the root of the hacker ethos.

Wozniak’s exploration was also the root of the personal computer. He built one in his bedroom, and Jobs secured a deal for $50,000 for Apple Computing. Wozniak and Jobs went from sharing information freely to having to focus on creating a product (there’s a bit more here, but go check out the documentary for more detail).

As computing became more about business, what was originally considered teenage pranks started being taken seriously as criminal offenses. The meaning of hacker changed (about the same time as Hollywood came out with the hacker movie “[WarGames](https://en.wikipedia.org/wiki/WarGames).”)

But the thing is that the internet as we know it was based on sharing information. This means that security and, even later, privacy have been bolted on. All of the cool things that we can do with computers today harken back to the original curiosity and exploration of hackers and phone phreakers.

While this allows bad actors to pull off attacks like ransomware or account takeovers using “hackerlike” behaviors, there are people like me using their hacker skills to do good. They’re known as ethical hackers.

### What is ethical hacking?

Ethical hacking is looking for vulnerabilities within systems, applications, and companies within legally agreed upon constraints with the intent of sharing your findings with the company to make the system or app better — hacking for good —but also for street cred. 

More on that after I tell you how I almost became a criminal.

## How a Childhood Hack Jump Started My Career

My first computer was an Epson 286. It was a gift from my grandfather by way of my dad. Both of them also shared their love of tinkering with me, solving problems on our farm in Minnesota with whatever was at hand [MacGyver-style](https://en.wikipedia.org/wiki/MacGyver).

Dad inadvertently opened the door to potentially criminal behavior by connecting that computer to the outside world. He installed a screechy dial-up modem to access our two-line local bulletin board (BBS), and I poked around until I hit a restricted area. Only I didn’t stop there.

If most people see a big red button and don’t know what it’s connected to, they probably won’t push it. Most hackers I know want to see what happens if you do. So I pushed buttons until I guessed the password. Like any teenager, I bragged to all of my friends. It wasn’t long before my gloating got back to the system operator (sysop) of that network.

Instead of turning me in, [the man who would become my mentor](https://medium.com/@adam_baldwin/my-story-about-mentorship-3f793df90db7) put me to work repairing computers after school for $4.75 an hour. While I repaired, Jim Terwee, owner of Northland Computing and BBS sysops, taught me about reverse engineering, programming, and what it really meant to be a hacker. The experiences I’ve had? The work I do now helping secure more than 5 billion global logins a month for Auth0? It’s because Jim was able to redirect my curious energy.

This is something you can do by engaging ethical hackers to help protect your company or even inspiring your colleagues or yourself by exploring the hacker mindset.

## The Top 4 Hacker Mindset Characteristics

In The Secret History of Hacking, they spend a lot of time talking about how hackers “think differently” from other people. Given the big red button example, I would say I agree, but neuroscience has taught us a lot about brain plasticity since that documentary was made. Even if you don’t naturally lean towards hacking, I think there’s a case to be made that computers have taught people to push buttons to find answers. These characteristics can be found in many professions: many athletes, artists, and business leaders rely on the same four.

**Curiosity**: If I had to pick only one characteristic, curiosity could probably be expanded to include the other three. But anyone engaged in ethical hacking or “hackerlike” behavior is curious about how things work. If they push the red button, what happens? If they send just the right packet, can they break into the system? If they ask the right set of questions when they call the front desk, can they get an executive’s email address?

**Creativity:** Different people define creativity differently. For me, it’s about how you approach a problem. For example, I typically don’t want access to the code base when I’m helping test an app or platform. I want to come at it the way the user might encounter it in the wild. This constraint increases my ability to come up with interesting approaches, forcing creativity, where knowing the code base or architecture gives me far too many options but is useful. Constraints help force creativity.

**Respect for diversity of thought:** The internet is not the work of one person. I know that may seem obvious, but thousands of minds (maybe hundreds of thousands) make all the apps and sites we use to get food, learn, access healthcare, and make sure we have enough funds to shop at our favorite retail sites. As I mentioned earlier, the internet was born to share information; we can describe security and privacy as being “bolted on.” All those minds all over the world are doing things in different ways at the same time; bad actors are also all over the world figuring out ever-evolving attacks. It just doesn’t make sense to put together a security team of people who come from the same background, went to the same college to study with the same teachers, and end up listening to the same music and sharing the same meme content. Different people come at problems differently. This makes diverse teams more effective at securing sites, winning DEF CON black badges (more on that in the next section), and really doing anything —and there’s recent research that says diversity of thought even [helped teams do better during the pandemic](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/innovation-in-a-crisis-why-it-is-more-critical-than-ever).

**Tenacious:** Ethical hackers and malicious actors strongly share the characteristic of stubbornly not giving up. Neither of us is going to have a look at your app, click the mouse a few times, and decide we can’t break into it. Code is written by humans, so it’s fallible. That means sooner or later; we will come up with a vulnerability. An ethical hacker may have been hired to do this for a company or may be operating independently, in which case it’s good to help ethical hackers know how to reach your security team. Like I said, I am stubborn. When I was operating independently, I wouldn’t stop at not being able to easily reach your security team for a serious issue. I would have reached out to your sales team. Tell the sales people there’s a problem with the security of their product, and you’ll get a response. They’re tenacious, too.

## Diversity of Thought in Action: DEF CON Black Badge Case Study

DEF CON is one of the world’s largest hacker conventions. It’s where we get together to swap tools and ideas, learn things, and meet new people. It’s also where you can participate in cool hacking competitions and win prizes. One of the most coveted prizes is the [DEF CON black badge](https://www.engadget.com/2016-08-13-def-con-2016-badges.html) because it means you get entrance to DEF CON “for your natural life.” They’re also super-cool (see mine below.) My team’s won twice, but we didn’t start out as winners.

![DEF CON Black Badge](https://images.ctfassets.net/23aumh6u8s0i/5rb2MEgRmHREgeMsA5QJdp/64bc73d47483d9faae607a2dc19cf4f8/IMG_5827.jpg)

[Ryan Clarke](https://www.wired.com/2014/08/defcon-2014-badges-revealed/), also known as LostboY, created the mystery challenge. A hacking challenge run at DEF CON where the points, rules, and challenges were a mystery. Skills like lock picking, working with electronics, breaking ciphers, acting, communication, the list goes on and on were are all tested. People were encouraged to collaborate on the challenge.

The first year I played, I was lucky to join a team with some friends that played challenge the year before. We didn’t do very well, but we had fun and made new friends. For years we returned, more prepared than the year before, doing anything we could to win. (Being prepared for a mystery sure sounds like defending a network a bit, doesn’t it?)

Over the years, the team grew, bringing in members with different skills, knowledge, and interests; physical security, hardware hacking, social engineering, making (turns out some makers are really good at forgery). We continued to grow and diversify our team until five years after our first try, we won! And then our team (Team Psychoholics)  [did it again](https://defcon.org/html/links/dc-black-badge.html#tab-4). At DEF CON 28, we also won the TeleChallenge phreaking challenge.

Betting you’ve picked up on the pattern — creativity, tenacity, curiosity are all required, but you need diversity to have a winning team.

Whether or not you have the budget for an internal security team or to hire an ethical hacker, I have an ethical hacker exercise you can try right now that could improve your cybersecurity (provided you’re willing to act on what you’ve learned).

## Your Turn: Thinking like a Hacker

Let’s say you have five people at your company. Get them to sit down at the real (or virtual) lunch table and ask them two questions:

* How would you steal our company’s data?
* What do we have that’s valuable? And how would you steal it?

Everyone is going to have a different perspective. Your engineer may identify certain parts of your code as valuable. Your chief marketing officer might point to your customer relationship management (CRM) database. The thing is, they’re all going to have different insights. Then you ask the next question:

* How would you stop them? For example, if the building is on fire, you probably have an alarm. In most countries, you can dial emergency services and have them come to put it out. Do you have systems in place? Where are the holes?

That diverse range of answers will help you identify your gaps. Then you need to take action. For many companies with small or even larger resources, the easiest way to access ethical hacking talent is to pay them.

![Thinking like a Hacker](https://images.ctfassets.net/23aumh6u8s0i/15UY9ZPvcKOsqy9pM078pc/65fe774d42beeaa18fb8ebb418810739/WhatIs_Broken_Auth_sep-1)

## Why Your Company Needs a Bug Bounty Program

Hackers are continually poking at various apps and sites. When they find a vulnerability, they want to share it with the company so that changes can be made. But some companies don’t make reporting those concerns easy. This can lead to hackers getting frustrated and performing full disclosure in public without coordination with the company. While the frustration is understandable, it doesn’t always protect consumers.

A bug bounty program pays hackers to find vulnerabilities by establishing constraints around things like when and where the vulnerability will be published and how much time the company has to fix the problem. This means you get a diverse range of people checking your app or site within your guidelines, and you pay when they find something that would likely result in a fine or even legal action. Many companies combine bug bounty programs with third-party penetration testing and in-house staff. Frankly, every company should have a bug bounty program, but if you’re not quite ready, make sure you at least have a way for hackers to report concerns to you.

Here at Auth0, we have our own [bug bounty program](https://auth0.com/responsible-disclosure-policy). It runs on [Bugcrowd](https://auth0.com/blog/bugcrowd-s-bug-bounty-program/), a way to crowdsource your app security that involves accessing a lot of diversity of thought.

## Did I Change How You View ‘Hackers’?

Hopefully, by now, you’re seeing something different when you see the word “hacker.” There’s more I could tell you about the difference between white hats and black hats and how there are even gray hats, but that’s for another post or [satisfying your own curiosity](https://www.eccouncil.org/ethical-hacking/). 

If you’d like to learn more about defending against “hackerlike” attacks, please check out our inaugural report on identity security, [The State of Secure Identity](https://auth0.com/resources/whitepapers/state-of-security-identity-report) or reach out to me on Twitter @adam_baldwin

The Hacker Mindset

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Actionable Advice from Women Who Code InfoSec Panel + Auth0 QAs on How Women Can Transfer Skills to Help Close that Gap



By 2021, there will be [3.5 million open cybersecurity jobs globally](https://cybersecurityventures.com/jobs/), reports Cybersecurity Ventures. [Worldwide](https://cybersecurityventures.com/women-in-cybersecurity/), women hold 20% of the filled positions.

<include src="TweetQuote" quoteText="Actionable advice on how women can transfer skills to fill the project 3.5M gap in cybersecurity talent. @womenwhocode"/>

[Women Who Code](https://www.womenwhocode.com/), a nonprofit dedicated to supporting women’s career growth in the tech industry, sponsored a panel of seasoned InfoSec professionals from [Nike](https://www.nike.com/us/en_us/?ref=https%253A%252F%252Fwww.google.com%252F), [Intel](https://www.intel.com/content/www/us/en/homepage.html), [Google](https://www.google.com/about/), and [Auth0](https://auth0.com/) at their [Portland chapter](https://www.womenwhocode.com/portland). The panel shared how they got into cybersecurity, what they’re looking for when they hire talent, and how interested applicants can easily transfer their skills to lucrative cybersecurity roles ([full video](https://youtu.be/lAraWX64ZJw)).

<include src="TweetQuote" quoteText="Discover what it’s like to be a woman in InfoSec at @google, @intel, @nike, and @auth0. —and find out how to make the most of your opportunities. @womenwhocode  (https://youtu.be/lAraWX64ZJw) "/>

Auth0 Former CISO/VP Operations **Joan Pepin** suggested we reach out to two other women on our cybersecurity team to talk about how they ended up in InfoSec, what it’s like to work at Auth0, and advice for women looking to break into the field.

## Annybell Villarroel, Security Operations Manager 

![Annybell Villarroel, Security Operations Manager](https://images.ctfassets.net/23aumh6u8s0i/PMOss4ZNEJdF9Rum21Quy/66839db9c86453c90d646c6b6612b9af/annybell-villarroel)

Anny started working with Auth0 as a contractor back in 2015. She joined the company as a technical support engineer in 2016 and has since transferred her skills to infosec by becoming our security operations manager.

### What made you make the switch to security?

While working on a ticket, I realized something that could potentially be used in a phishing campaign. I did a quick experiment with a small sample group to gather feedback, and we noticed that our training could be improved in different ways. After hearing about the project, Jon Gelsey, our CEO at the time,  suggested to Joan (Auth0’s Former CISO) that I work in security. I got offered my current role. 

### Tell us about your current role

Besides managing projects for our Security Team, I’m preparing our Security Awareness training as well as our quarterly phishing campaigns. I recently took training at the Black Hat Conference to learn best practices and how to raise our general security awareness through [social engineering attacks](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/).

### How have your skills transferred?

As a support engineer, I learned a lot about the product itself, knowing the historical context and how it works has been useful for a few projects in the security team and my experience talking with customers has helped me with the training. I believe that asking “why” and trying to find the root cause of the problem can be useful in any project.

### What’s been the biggest challenge so far?

It’s been pretty smooth and I feel very supported in this role and the team is super-great. If I don’t know something everyone is willing to help. 

### There are a ton of jobs for women in InfoSec. Why work for Auth0? 

The job was offered to me and in general, the opportunity was given. I really like the culture here and have an emotional connection to the company. I’ve seen it grow. Auth0 is a security-first company and I find it rewarding to do work that fits with our mission statement of making the internet more secure.

### What advice would you have for women breaking into InfoSec?

Don't be afraid to ask security engineers for help. Be willing to make experiments, and take online courses on your own to learn. Practice with Capture The Flag challenges with a mentor that can guide you, and if you like to understand people or are a people person, learn about Social Engineering. **We’re hiring**.

## Eva Sarafianou, Application Security Engineer

![Eva Sarafianou, Application Security Engineer](https://images.ctfassets.net/23aumh6u8s0i/1WB3sUlt6NSIx4GFKnqb9T/6d148e76110d0246bd276b8943a15f27/eva-sarafianou)

Intrigued by cryptography’s underlying maths, research, and study while working on her masters at the University of Athens led Eva to a career in InfoSec, which she describes as “a whole new world.” Eva joined Auth0 in Aug. of 2018.

### Tell me about your current role

I work as an application security engineer. In the Product Security team we work closely with the developers, try to find vulnerabilities in our codebase and give guidelines for mitigation. We’re working on security automation, building tools that will help the engineering team write secure code by default and we're also responsible for the vulnerability disclosure program

### How have your skills transferred? 

A few months prior to obtaining my master's degree, an internship for security consultancy gave me the opportunity to start applying security in industry instead of academia, specifically web security and mobile — how many things you can control as a user even if you shouldn’t. And how, if you really dig into it you’ll usually find something interesting, even if a code does seem very secure. It may not be something huge, but security is an ongoing effort. It never ends. Even with something small, some very sophisticated attacks are possible.

### What’s been the biggest challenge so far?

Being a woman in InfoSec. During my internship, we were visiting customers for assessments and because I was young and the only woman in the office, the customers asked my manager whether or not I knew things. I had to put in extra effort to make sure the customers believed that I knew what I was doing and could explain things. It got better over time, but male interns who came to the office after me didn’t receive questions like these.

### Anything seem surprisingly easy?

I think the problem most engineers have is that they love working on their computer and digging into code. If they have to explain this to a non-technical person, they find it a bit difficult. It’s easy for me to take an issue step-by-step and make sure that somebody without the technical background understands.

### There are a ton of jobs for women in InfoSec. Why work for Auth0?

I knew Auth0 four years before I joined and really liked the product and the culture. Remote working is the most productive thing.

### What advice would you have for women breaking into InfoSec?

First of all and maybe take a direction in college and university that has to do with a computer. Be confident. I think that in InfoSec — not in Auth0 — there are many people who believe they are experts and will ask you “why” in a not very friendly way always. Always ask what you don’t know.
I’m usually the only woman on my teams — even at Auth0, in our small team, I am the only woman. Feel confident and don’t feel at all weird that you’re always a minority.
If we want more women in tech, as companies and we can do participate in organizations like WWC, but this needs to be spread to the world — it’s how parents raise their daughters. My parents were the same with me as they were with my brother — no change. I was never the little girl that had to be protected and I think that helped.

<include src="TweetQuote" quoteText="Find out what’s like to be a woman in InfoSec (https://youtu.be/lAraWX64ZJw)  — and learn how to get the most out of lucrative cybersecurity job opportunities. @womenwhocode"/>


3.5M Open Cybersecurity Jobs Worldwide by 2021

How to limit the damage during an infrastructure breach


The Capitol riot on January 6 was a dangerous moment on multiple levels, not least of which were the cybersecurity ramifications. The Capitol’s information infrastructure &mdash; laptops, documents, phones &mdash; were all in the hands of rioters for several hours. In one case, a woman allegedly stole a laptop or hard drive from Speaker of the House Nancy Pelosi’s office, though the woman eventually [turned herself in](https://www.nytimes.com/2021/01/18/us/riley-june-williams-emmanuel-jackson.html) to law enforcement.

The potential exposure of sensitive government information &mdash; especially coming on the heels of the devastating [SolarWinds hack](https://auth0.com/blog/the-nine-worst-recent-data-breaches-of-2020/) &mdash; is inspiring business leaders to examine their own cybersecurity vulnerabilities.

Many are asking: What would I do if my company’s tech was lost, stolen, or tampered with? How would we mitigate the damage from compromised hardware?

To start addressing those questions, it’s important to understand how a physical breach (of your offices or of your hardware) can have digital implications. Here are some of the cybersecurity lessons from the Capitol riot and how to protect your company in such an event.

## All Physical Access Is Risky

There’s a famous cybersecurity truism that states, “If a bad actor has physical access to your computer, it’s not your computer anymore.” In other words, just because a mugger hasn’t run off with your laptop, that doesn’t mean it hasn’t been compromised. In the high-stakes world of corporate espionage (not to mention traditional espionage), all an attacker needs is a thumb drive and a moment alone with your device to steal information or introduce malware.

What’s more, in today’s hyperconnected world, computers aren’t the only risk vector since every network-connected device can present an entryway for attackers. The proliferation of devices on which we work has made it much more difficult to assess the damage after a potential security incident. Case in point: In the confusion of the Capitol riot, it was initially unclear how much hardware had been stolen or otherwise compromised. As [Wired](https://www.wired.com/story/capitol-riot-security-congress-trump-mob-clean-up/) reported, “Rioters could have bugged congressional offices, exfiltrated data from unlocked computers, or installed malware on exposed devices.”

### What to do if your hardware may have been breached

Let’s imagine a scenario in which there’s been a break-in at your office. There’s paper scattered everywhere, you’re not sure what devices are missing, and you’re not sure if the remaining tech is compromised. Where do you start damage control?

#### Don’t overreact

Don’t try to physically destroy every piece of hardware that could potentially be infected. That’s like ripping up all your floorboards to locate a single mouse.

#### Focus on securing user identity

The single greatest security threat of 2021 and beyond is a bad actor with stolen credentials. So make sure you’ve implemented [multi-factor authentication](https://auth0.com/learn/get-started-with-mfa/) (MFA), preferably using a strong method like biometric authentication or a hardware token.

In the wake of a breach, you should also change all your passwords. MFA will protect you from a password-based attack, but it isn’t foolproof, especially if an attacker has physical access to session cookies to perform session hijacking. But combining strong MFA, password rotation, and limited session lengths will help purge any bad actors from your system.

In all likelihood, your business will never face a physical breach like the capitol riot. But in the age of [remote work](https://whatfix.com/blog/remote-work-policies/), your organization’s physical assets are constantly in motion and exposed to risk. Given that fact, your network’s true perimeter is built into your networks: user identity.

#### Conduct an asset inventory

Maintain an [asset inventory](https://www.axonius.com/blog/when-asset-inventories-become-incident-response-exercises) of all work-connected devices, and their vulnerability level is breached. Ideally, this is something you will have done prior to a security event, but if not, it should still be a priority. Establishing ownership of each device is a crucial part of asset inventory because without it, tracking down devices is much harder. Have every member of your staff report on the status of their own devices and whether or not they followed security protocols on those devices.

This will let you quickly determine if something is missing and help you figure out where to start looking for intrusions. For example, if Debra from accounting’s laptop is missing, and she had the password taped to it with a sticky note, that’s the first hole you’ll want to patch up.

<NonAmpContent>
<blockquote class="twitter-tweet"><p lang="en" dir="ltr">My heart goes out to the unsung IT heroes at the Capitol tonight. My guess is they've never had to run asset inventory IR before - a daunting, stressful task in a tabletop exercise - and they're running one (prob w/o a playbook) following a full on assault of the Capitol.</p>&mdash; socially distant, mask wearing bat (@mzbat) <a href="https://twitter.com/mzbat/status/1346983709786976257?ref_src=twsrc%5Etfw">January 7, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</NonAmpContent>
<AmpContent>
<amp-twitter
  width="375"
  height="472"
  layout="responsive"
  data-tweetid="1346983709786976257"
>
</amp-twitter>
</AmpContent>

## Enterprises Need Standardized Data Security Policies

Within large organizations, data handling policies can vary from department to department and even from team to team. Some variation is inevitable since people use different devices and different applications and have different data sharing needs. But if your company doesn’t have some shared fundamentals of data security, fixing a breach becomes a daunting task. Large organizations need to establish a shared definition of what sensitive data means to them and what their legal obligations are under [data privacy laws](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/).

One of the biggest challenges in assessing the cybersecurity damage of the Capitol riot is that Congress has no standardized cybersecurity policies. Instead, Senate staffers [told CNN](https://www.cnn.com/2021/01/07/tech/capitol-riots-cybersecurity/index.html) that “while some IT protections exist across the organization, many decisions about information security practices are left up to individual lawmakers’ offices.” They report that some staffers do not use VPNs across all their devices, and some stored data locally on their desktops.

Capitol staffers also don’t seem to have had a shared definition of “sensitive data.” While elected officials are prohibited from sharing classified information outside of specific networks, it sometimes gets out anyway. [Wired](https://www.wired.com/story/capitol-riot-security-congress-trump-mob-clean-up/) reports that “congressional staffers are not subject to Freedom of Information Act obligations and are often much more candid in their communications than other government officials.”

Even seemingly innocuous data can be dangerous in the hands of attackers, who can weaponize a high-ranking official’s (or executive’s) travel schedule. Bad actors can use personal information in spear-phishing attacks. Even device metadata can be extremely revealing if it shows who leaders are communicating with and when. 

Protecting yourself and your company requires developing both technological safeguards and a shared culture of security.

### How to implement tougher data security policies

Improving your organization’s cybersecurity requires C-suite supervision and buy-in at every level. Automate security whenever possible, instead of expecting your workforce to manage it during an emergency when they have other concerns. But while technical protections are crucial, don’t ignore the human element. Strong cybersecurity requires the active participation of an entire workforce and a shared awareness of potential risks.

#### Empower your CISO
Your head of security needs the support and resources necessary to implement top-down guidelines for the whole organization. This should take place in a larger context of the CISO’s evolving role and increasing responsibilities. To quote [Andreessen Horowitz](https://a16z.com/2020/12/18/security-in-2020/): “From its initial focus on securing on-premise servers, the Chief Security Officer (CSO/CISO) role has sprawled to include not just the cloud, but the physical workplace, individual laptops and phones, and data privacy and compliance.”

Part of the CISO’s role is to put security protocols in place so people can focus on their work. The CISO is also responsible for building an internal security culture that makes it easier for humans to choose security best practices whenever possible. Ideally, the rest of the C-Suite strongly supports them in all these efforts and models a commitment to security for the rest of the organization.

#### Have separate devices for work and personal use

This is a real challenge at companies with remote workforces and bring-your-own-device (BYOD) policies, but it’s one of the most effective ways to minimize damage in an attack. To convince your workforce to be disciplined about their device usage, emphasize the privacy benefits to them. 

[Brandon Maxwell](https://auth0.com/blog/authors/brandon-maxwell/), a Detection and Response Manager at Auth0, says, “If your device gets compromised by malware, an incident response engineer is going to have to analyze your downloads, your internet history, all those kinds of things.” In the case of a physical breach, an investigator may inspect the device for company data to ensure it wasn’t modified or accessed. While personal data would not be in scope, the analyst would likely see filenames and other metadata that an end-user may not be comfortable sharing otherwise. Emphasizing both privacy and security helps motivate employees to keep their devices separate.

#### Automate device lockouts

Institute centralized protocols to automatically lock devices after a short period of activity or if the hardware is missing. ([Apple products include this capability](https://support.apple.com/en-us/HT204756) as part of the “Find My” feature.) In an emergency, you can’t expect employees to lock their screens &mdash; it should happen automatically. Yet in the Capitol riots, numerous screens were left open, as you can see in this [deleted tweet](https://www.law.com/therecorder/2021/01/08/will-the-cybersecurity-vulnerabilities-during-capitol-rioting-spur-litigation/) from one of the rioters.

![Elijah Schaffer Tweet](https://images.ctfassets.net/23aumh6u8s0i/RJsOz4VRyoHwF2xznCuQa/6810ff2d9ddfcc741b240a2ae13b043a/elijah-schaffer-tweet)

Just as importantly, [limit session length](https://auth0.com/blog/balance-user-experience-and-security-to-retain-customers/) for employees. Just like your mobile banking app automatically logs you out after a brief period of inactivity, do the same with your sensitive data and applications. This can be useful even if you’re never the victim of an attack since locked devices also protect employees from their kids ordering $100 worth of apps while their back is turned.

You may also want to reconsider checking that “remember me for 30 days” box in your login screens since a bad actor who steals an unlocked or unencrypted device can then easily access that account.

#### Standardize physical, administrative, and technical controls across the organization

Practicing basic cybersecurity hygiene should be as deeply embedded in your company culture as your code of conduct. These expectations include things like requiring all remote workers to use full-tunnel VPNs on all devices. You should also implement strict password policies, guided by current NIST recommendations, and require all employees to use password managers to ensure strong and unique passwords.

#### Assume you’ve already been breached

Adopting this mentality will help you when going through monitoring logs for unauthorized access. Better yet, use an [identity and access management](https://auth0.com/blog/what-is-iam/) (IAM) platform that adopts this mentality on your behalf and proactively demands MFA for users who exhibit suspicious behavior or for employees who use compromised credentials.

## You Can Secure Your Data in a Chaotic World

The U.S. Capitol was put at risk not just by a failure of planning but a failure of imagination: the idea that “it can’t happen here.” Unfortunately, many organizations and businesses have the same attitude about their own cybersecurity, and it puts sensitive data at needless risk. By taking a sober look at the value of your own data and the threats to it, you can start building your defenses in case the unthinkable happens.

To learn more about how centralized identity and access management can be a part of your organization’s security posture, reach out to the team at Auth0.


Cybersecurity Lessons From Capitol Riot

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

Attack vectors are changing, so the tactics that will keep you safe need to be able to adapt.



New challenges arose in 2020 as a result of (among other things) increased numbers of remote workers using new and untested methods to access confidential information and major upswings in eCommerce use as physical stores were closed during lockdowns. With new access procedures and increases in traffic come new attack vectors and a need for new tactics to mitigate them.

Securing your product, whether it’s a web app, intellectual property stored in a distributed cloud environment, or the user data of your customers in 2021, will look a little different as a result of these changes. At the same time, many aspects of cybersecurity will remain the same, simply requiring a more concerted effort to enforce existing rules and procedures. For 2021, here are my five picks that I expect to be of critical importance.

![Cybersecurity Predictions](https://images.ctfassets.net/23aumh6u8s0i/e8LLSbz9kUTIssTNzD33k/1c58e52ea17e0bf67b104322e8ade137/cybersecurity-prediction-sep1)

## 1. The Internet of Behavior Will Continue Growing in Importance

A term coined by industry analysis leader [Gartner](https://www.gartner.com/smarterwithgartner/gartner-top-strategic-technology-trends-for-2021/)[1], the Internet of Behavior (IoB), is “about using data to change behaviors.”

When companies use data gathered from their IoT devices, facial recognition, wearables, smartphones, etc., begin using it to direct the behaviors of their customers, then use the additional data to continue honing the targeting process &mdash; this is the IoB.

The trick in 2021 will be finding a balance in the use of this data to maintain security. As Kim Berry, Principle Threat Intelligence Researcher at Auth0 puts it, “It’s going to come down to convenience vs. privacy. Will the use of this aggregate data, with the issues data aggregation brings with it, outweigh the best practice of keeping user data private and secure.”

We already know that a subset of this data is used, in more limited ways, to track our location, browsing habits, and social media use, among other things. In fact, Gartner predicts that “By 2024, [30% of digital businesses](https://www.gartner.com/smarterwithgartner/gartner-top-10-strategic-predictions-for-2021-and-beyond/) will mandate DNA storage trials, addressing the exponential growth of data poised to overwhelm existing storage technology.”[2]

So it’s not a technical stretch for the data already being collected to be aggregated with that provided by IoT devices, smart TVs, voice assistants, and connected cars. And from there to providing a customized shopping experience the next time we go online looking for home goods.

Personally, I’ll be watching for how companies walk that line Kim talks about, the one between convenience and privacy. How a company handles the data they collect tells you a lot about that company’s values and whether or not you can trust them with your own information.

## 2. 2021 Will Be the Year of the Virtual Security Team

Cybersecurity concerns can quickly outpace the ability of a smaller company to respond in a timely manner. For most SMB organizations, it’s simply not feasible to employ a CISO and a team of security specialists when the total workforce is less than 50 (for example). So what is the average SMB to do? Enter the vCISO, or virtual Chief Information Security Officer, and their virtual minions of security experts.

By bringing in such a consultant, your company can reap the benefits of having an expert on hand to review continuity plans, analyze data related to a potential breach, establish your security perimeter at the data level, and more. Using the skills of a part-time team of security pros gives you the benefits of years of collective experience going to work solving your security needs without spending on full-time salaries.

Mixed workplace environments where some employees are at the office while others are remote and componentized app development ecosystems can benefit from this hybrid approach as well. When your data is secure, it doesn’t matter which building blocks you use to develop your app. And with a virtual security team working on that, your developers can focus on building your core product without worrying about trying to also become cybersecurity experts. With such a dispersed perimeter, the distributed nature of using virtual teams just makes sense. 

## 3. Ransomware Will Become Yet More Effective

There are several fronts to keep an eye on with this one. First, the attack methods being employed are going to continue becoming harder to parse. The teams of hackers behind ransomware attacks are constantly changing their tactics; in fact, some are now [turning to call centers](https://www.zdnet.com/article/ransomware-gangs-are-now-cold-calling-victims-if-they-restore-from-backups-without-paying/) to follow up with their victims if they try to restore data from a backup without paying the ransom. These teams will continue adapting and adopting new techniques while governments around the world play catch up. Governments are starting to take the threat seriously, and bodies such as the US Cyber Command and the newly formed National Cyber Force (NCF) in the UK are good are bringing the fight to these groups with their stated “Defend Forward” goals. So in 2021, we expect to see them aggressively hunt down these malicious actors.

At the same time, there’s also been a shift in this attack vector. Until recently, most ransomware attacks locked down entire networks rendering the business unable to continue with their workflows until the ransom was paid and service restored. The shift is to more of a “hostageware” model, where the network is breached and data discreetly exfiltrated. This is followed by an announcement that the hackers will release the stolen data to the public if the company doesn’t pay up. While this strategy is definitely new and unique, the methods to stop it are the same &mdash; good security hygiene like ensuring all patches and updates are installed, account maintenance, and offsite backups.

## 4. Phishing/BEC Attacks Will Continue to Wreak Havoc

With all that shifting and morphing of the security perimeter, what are we going to see in terms of the ongoing scourge of [phishing attacks](https://auth0.com/blog/protecting-against-phishing-attacks/)? In all their forms, be it company-wide emails, targeted business email compromise (BEC) attacks, or the newest addition to the social engineering world, the vishing (voice phishing) attack &mdash; this vector is here to stay. So what are you going to do about it as your teams begin trickling back into the office later in the year?

Getting the basics right is the crucial factor that many in the security world let slide in favor of adopting the newest and shiniest piece of AI-based technology. No matter how awesome your machine learning-powered filters are, there is no stopping a well-orchestrated, eloquently-worded, and link-free email from making its way into some overworked employee’s inbox.

The basic that can, in fact, stop these attacks before they start? [Security education, training, and awareness (SETA)](https://searchsecurity.techtarget.com/definition/security-awareness-training). There is simply no better way to counter a human attacker using social engineering tactics than to have a workforce trained in emotional intelligence and ready to spot the red flags. Targeted education campaigns give your people intuitive senses that will tingle at the sight of that phishing email, and know who to alert to its presence. There is no better defense for these attacks than to stop them before they start.

## 5. A Distributed Security Perimeter Will Be Needed to Protect a Dispersed Infrastructure

Containerization, componentization, and cloud-first architecture are the future of app development. And when you combine this reality with the hybrid work environments being implemented across sectors, you start to see why we’re so focused on bringing the perimeter in to meet the data. 

Porous security perimeters have lent an unwitting assist to the types of attacks discussed above when companies found their entire workforce suddenly thrust into remote work by the COVID-19 pandemic. Personal devices, unsecured networks, and the ever-morphing nature of attack vectors have led to a new adage, “[identity is the perimeter.](https://auth0.com/resources/whitepapers/identity-perimeter)” According to Kim Berry:

_“The perimeter has moved in to surround the data itself. That means identity is a critical component, right? That’s what is used to access the data; a user account with a verified identity associated with it makes identity the true perimeter now &mdash; that is what’s protecting your data.”_

![Cybersecurity Predictions](https://images.ctfassets.net/23aumh6u8s0i/11v4gylcGVWijlKWnhibFw/f7e091c1883197d00af99737574c649d/cybersecurity-prediction-sep2)

## Working With the Right Partners Will Set You Up for Success in Your New Hybrid Environment

We’re entering a hybrid period in the first part of 2021. On-prem, cloud, legacy, cutting-edge &mdash; often all within the same corporate environment. Add in a workforce that may or may not be remaining remote full-time, or they may be in the office part-time, or some other mix we haven’t thought of yet. Many organizations will find that the changes they made to get through the pandemic are just not sustainable and that returning to a fully colocated workforce is the right move. Others will discover that the productivity increases they saw are just too awesome to potentially lose out on and will remain remote. And yet others will find that a hybrid model will emerge that suits their needs.

However your workplace emerges as the year progresses, one overarching reality will remain constant &mdash; the need for a strong security posture that lets you maintain your core productivity without compromising your customer experience or exposing your data to malicious actors. We invite you to [get in touch with our identity and access management (IAM) experts](https://auth0.com/contact-us) to see how partnering with Auth0 can help deliver the security you need to make the most of the systems you’ve already implemented or assist in laying the groundwork for those yet to come.

[1] Gartner Top Strategic Technology Trends for 2021, Kasey Panetta, October 19, 2020. <br />
[2] Gartner Top 10 Strategic Predictions for 2021 and Beyond, Kasey Panetta, October 21, 2020.

<include src="asides/AboutAuth0" />


5 Cybersecurity Predictions for 2021

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

There are valuable lessons to be learned from the cybersecurity stories of a challenging year.

The 9 Worst Recent Data Breaches of 2020

Securing your data against unauthorized access is more important than ever.

What Is Data Security? Top Threats and Best Practices

Join us for Avocado Lab talks, advice on setting up your own bug bounty program, and learn a bit about what we're doing to improve our cybersecurity stance



Building and maintaining a security culture where employees make secure decisions, trust and collaborate effectively with the security team, and feel empowered rather than afraid is key to being a trusted brand that makes the internet safer. Each October, National Cybersecurity Awareness month gives us an opportunity to celebrate that effort.

At Auth0, we focus tremendous efforts on both our organizational culture and our security culture, since Security is at the core of what we do, and trust is one of our key principles. Throughout the year, we provide training tailored to each of our audiences, run multiple engagement programs, as well as context-specific awareness campaigns. So we can't miss the opportunity of celebrating October National Cybersecurity Awareness Month both internally and externally.

This year Auth0 is hosting several events for the community:

* [Avocado Labs](https://avocadolabs.dev/) Online Talks: 
    * [Look! There's a threat model in my DevOps](http://avocadolabs.dev/events/avocado-labs-episode-13/). Alyssa Miller, Application Security Advocate - Snyk
    * [Trust: From Zero to Hero](http://avocadolabs.dev/events/avocado-labs-episode-12/), Annybell Villarroel, Security Culture Manager - Auth0
* Social media content highlighting those who keep us safe, those who create the tools and features we need, those who make it safer for us.
* Content on the Death of the Corporate Network from Senior Director of Engineering Duncan Godfrey, securing Node.JS Senior Manager, Product Security Marcin Hoppe, advice from CSO Joan Pepin on setting up your own bug bounty program, and a guide to treating identity as the perimeter from Cybersecurity Researcher Kim Berry. 

For our employees, we will have internal challenges and experts from our Security team as well as industry-leading guests will provide talks focused on a wide range of topics:

* **OWASP Top 10:** Jim Manico (@manicode), Founder & Secure Coding Instructor at Manicode Security, will come to give us a remote training session on OWASP Top 10
* **Hacker mindset and Burp Suite Training:** Katie Paxton-Fear (@insiderPhD), Ph.D. Student, Occasional Bug Bounty hunter & Educational CyberSecurity YouTuber, will teach us how to think like a hacker and how to use Burp Suite.
* **Internal Bug Hunt Challenge:** to encourage employees to safely find vulnerabilities in Auth0. High or Critical severity findings get added to our internal Hall of Fame, receive swag prizes, and get company wide recognition.
* **Security Demo Day:** this session walks employees through a vulnerability found in the platform and showcases discovery, exploitation, and remediation.
* **Phishing Challenge:** we run phishing campaigns on a regular basis. Now, we are reversing the roles, and employees will have the chance to phish our Security Culture Manager, who will also explain to them how to do it safely.
* **InfoSec Career Panel:** the path to infosec is varied within our team; in these sessions, we will talk about personal experiences, learning paths, skills requirements, and we will have a Q&A session.

At the end of the month, all employees that complete a series of goals will participate in a raffle for prizes.

At Auth0, we are passionate about providing secure access to everyone but not just anyone, and we believe that empowering our employees to have a strong security mindset in their personal and professional lives is key to achieve this goal.

We invite you to come to celebrate with us through our external events. Happy National Security Awareness Month! 

<include src="asides/AboutAuth0" />


National Cybersecurity Awareness Month (NCSAM) at Auth0

Hackers are preying on confusion, so businesses need a clear plan.



Between social distancing, an uncertain economic outlook, and the Coronavirus itself, business leaders have enough on their plates without having to worry about cyberattacks. Unfortunately, cybercriminals aren’t taking a vacation; they’re using the Coronavirus pandemic as an opportunity to prey upon organizations around the globe, with potentially disastrous results.

Around the world, security experts are reporting an alarming uptick in Coronavirus-related scams and attacks on our most vital infrastructure.

It’s easy to feel powerless in the face of this epidemic, but when it comes to cybersecurity, executives can actually do a great deal to limit the damage. Put measures in place now to protect your business’ data from attack, and you’ll come out the other side of the pandemic better equipped to deal with cybersecurity threats. Let’s start by identifying those threats.

## Cyberattacks Surge During Coronavirus

It was tempting to hope that hackers might give the world a break during a global health crisis. In fact, security company [Check Point](https://blog.checkpoint.com/2020/04/20/coronavirus-update-as-economic-stimulus-payments-start-to-flow-cyber-attackers-want-to-get-their-share-too/) has reported a sixfold increase in the average daily number of attacks in recent weeks. Of Coronavirus-related attacks, they report that 94% are phishing scams. This statistic is echoed by [Google](https://www.darkreading.com/threat-intelligence/stimulus-payments-are-popular-leverage-for-cyberattacks/d/d-id/1337601), which said it rejected close to 18 million virus-related phishing emails per day in one week in April.

These phishing scams can take a myriad of forms, but criminals posing as government agencies are particularly common. They may offer false guidance, claim to have a list of new Coronavirus cases, or offer people help [getting their stimulus checks](https://www.darkreading.com/threat-intelligence/stimulus-payments-are-popular-leverage-for-cyberattacks/d/d-id/1337601) or other financial assistance. Regardless of the ploy, the goals are the same: trick the reader into clicking on a link, downloading an attachment that exposes them to malware, or entering in private information, which hackers can then use to hijack their identity.

![COVID-19](https://images.ctfassets.net/23aumh6u8s0i/7smqXxxmZ8XdqSMgrGqQ22/4bd9e3fb3ab22cda8376270da6e058ec/goverment-uk)

Many phishing attacks also pose as internal business emails, taking advantage of the confusion resulting from people working from home. Even individuals who would normally be more cautious about clicking on a suspicious link may have their judgment compromised due to pandemic-related stress. People hoping for miracle cures or financial relief are far more likely to click on suspicious links than they would be otherwise.

Tragically, one of the hardest-hit sectors during the Coronavirus has been healthcare, which has been victim to a spate of ransomware attacks. As [Michael Salát of Avast](https://blog.avast.com/how-hospitals-can-protect-themselves-from-ransomware-avast?utm_campaign=socialposts_us&utm_source=twitter&utm_medium=social) has written, “hospitals are not necessarily more susceptible to ransomware attacks,” but since any system downtime could literally cost lives, “they are more likely than other organizations to pay the ransom.” Both the [Department of Homeland Security](https://www.us-cert.gov/ncas/alerts/aa20-099a) and [INTERPOL](https://www.interpol.int/en/News-and-Events/News/2020/Cybercriminals-targeting-critical-healthcare-institutions-with-ransomware) have issued warnings about cyberattacks in healthcare and urged hospitals to educate their employees on email safety, external backups for critical data, and strong, unique passwords.

{% include tweet_quote.html quote_text="As @avast’s threat intelligence director @michal_salat has noted, “hospitals are not necessarily more susceptible to ransomware attacks” — but attacks can cost lives — and they’ve tragically seen an increase during COVID.
" %}

The importance of these steps was highlighted by the experience of an Illinois hospital, which had to pay hackers $300,000 in ransom to get back access to their system after being locked out for three days. As a [hospital administrator said](https://www.pewtrusts.org/en/research-and-analysis/blogs/stateline/2020/04/13/hospital-hackers-seize-upon-coronavirus-pandemic), “The only good thing was that just a few months before, we had put our electronic medical records and our email on the cloud, so they were not affected.”

## How to Protect Against Coronavirus-Era Cyberattacks Today

The Coronavirus pandemic is an ideal situation for hackers since they thrive on confusion, ignorance, and misinformation. To thwart them, businesses need to counter with communication, education, and knowledge.

Step one is to counter misinformation and confusion by **educating your employees** on cybersecurity best practices.

These include:

* Use a unique password for every application to guard against phishing and [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) attacks. Ideally, all your employees should be using a company-approved password manager to ensure they aren’t re-using passwords.
* Be on guard against common phishing techniques, such as emails purporting to be from company representatives but with an unfamiliar or misspelled email address.
* Regularly update all software, especially anti-virus software, on any device (including mobile devices) on which you conduct company business.

It’s up to you how you educate your employees, but given how vital this information is and [how overwhelmed your team is likely to be](https://uptickapp.com/blog/what-managers-owe-our-teams-during-coronavirus), you should consider something more in-depth than a simple email. Conducting video training with specific examples of phishing attempts will make a bigger impact and let you respond to any questions your team has.

If possible, you should **mandate that all work is done on company-issued devices** since employees are less likely to be as vigilant about security updates and downloads on their personal devices. If that’s not an option, you should still **ensure that any remote tools you’re using are secure** and you’re not compromising data security in the name of convenience. (That’s particularly true for the healthcare sector, in which [telemedicine is opening up exciting possibilities](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) but also sparking concerns over patient privacy.)

As always, one of the best defenses against unauthorized intrusions into your system is to **implement a sophisticated Identity and Access Management (IAM solution)** using [multi-factor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/). MFA works by requesting an additional form of credentials beyond a username/password combination, such as a one-time code or biometric. That way, even if an employee unwittingly shares their password in a phishing scam or is the victim of a credential stuffing attack, a hacker can’t use that information to waltz into your system.

[Auth0 Signals](https://auth0.com/blog/new-ways-to-combat-automated-attacks-auth0-signals/) is a new service designed to help facilitate this by offering a real-time assessment of a login attempt’s threat level and when to request additional credentials.

<script src="https://fast.wistia.com/embed/medias/h5fqhdgsep.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:74.37% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_h5fqhdgsep videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>

## Build Digital Resiliency to Guard Against Tomorrow’s Attacks

In choosing how to protect your company’s data, it’s important to think beyond short-term survival strategies and find solutions that are designed to last for more than a few months. After all, many experts predict a [second wave](https://www.washingtonpost.com/health/2020/04/21/coronavirus-secondwave-cdcdirector/) of the pandemic that could mean a return to social distancing and remote work. And Coronavirus aside, cybersecurity threats to business are on the rise, so it’s important to be proactive rather than merely reactive.

**Conduct risk assessments** of your company’s technology, especially every tool your employees may need to work from home. [Norton advises remote teams](https://us.norton.com/internetsecurity-emerging-threats-working-from-home-due-to-coronavirus.html) to “control the urge to improvise” by switching to unsecure applications when their work-approved tools fail. Yet the best way companies can protect against so-called [Shadow IT](https://www.webopedia.com/TERM/S/shadow-it.html) is to make sure that every piece of software that your team will need to remotely collaborate works as it should.

{% include tweet_quote.html quote_text="Build digital resiliency — it’s important to think beyond short-term survival strategies for protecting your company’s data and find solutions that are designed to last for more than a few months. 
" %}

As Auth0’s CSO Joan Pepin has written, you should also draw up a [pandemic plan](https://auth0.com/blog/how-to-create-an-actionable-pandemic-plan/) to prepare for future crises. That way, in the event of an emergency, all parties know their roles, and your business won’t descend into the kind of confusion that makes it easy prey for hackers. Making this plan will also deliver immediate benefits since you’ll spot potential weak points in your company’s documentation, technology, and overall structure.

## Be Careful, Not Fearful

In times of crisis, when resources (and patience) are stretched thin, it can be challenging to think about long-term solutions. But the Coronavirus is highlighting why it’s so vital to have a culture of security in place to keep a crisis from becoming a catastrophe. That culture should include regular audits, employee training, and third-party partners you trust to keep your systems updated. It’s the difference between building a lean-to shelter to get through a storm and building a sturdy house that will keep out all the storms to come.

If you’d like to learn more about how a sophisticated IAM platform can protect against cyberattacks without slowing your business down, please [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=reach%20out%20to%20the%20team%20at%20auth0).

<include src="asides/AboutAuth0" />


Coronavirus and Cybersecurity: How Your Business Can Stay Safe

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

The UK’s new rules are pushing companies to handle kids’ data with greater care.



In January 2020, the United Kingdom’s Information Commissioner’s Office (ICO) released a [Code of Practice](https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/01/ico-publishes-code-of-practice-to-protect-children-s-privacy-online/) to protect children’s privacy online. The code isn’t the first piece of legislation that specifically seeks to limit how organizations handle the data of minors, but it is significantly broader than previous laws. Among other things, the ICO’s code demands, “The best interests of the child should be a primary consideration when you design and develop online services likely to be accessed by a child.”

The UK’s new rule — and the data privacy scandals that brought it into being — should grab the attention of the C-suite at every company that counts children among its users. This law and others like it demand a shift in both the technical measures and the philosophy with which businesses handle the data of minors.

As Elizabeth Denham, the UK’s information commissioner, has argued: “There are laws to protect children in the real world — film ratings, car seats, age restrictions on drinking and smoking. We need our laws to protect children in the digital world too.”

## Why Children’s Data Privacy Is a Hot-Button Issue in 2020
Concerns about the safety of children online are as old as the internet itself, but the increasing power of big data has brought those concerns back to the forefront. And while adults can make educated choices about their own privacy, many are uncomfortable with recent news stories of children being monitored and targeted by corporations and potentially exposed to hackers.

### Youtube Caught With Its Hand in the Cookie Jar
In September 2019, YouTube reached a $170 million [settlement with the FTC](https://www.ftc.gov/news-events/press-releases/2019/09/google-youtube-will-pay-record-170-million-alleged-violations) for allegedly breaking the [Children’s Online Privacy Protection Act (COPPA) Rule](https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-reform-proceedings/childrens-online-privacy-protection-rule) (more on that below). YouTube was accused of using cookies to collect personal information from viewers of kid-targeted channels and using the cookies to deliver targeted ads without parental consent. The FTC noted that YouTube publicly bragged about its popularity with kids and made millions of dollars marketing to them and therefore could not claim ignorance about its legal obligations under COPPA.

![DataPrivacy Youtube](https://images.ctfassets.net/23aumh6u8s0i/XBTQ3j1zo75iWEFPf82Ve/ae32e671866fe920e1ff3f54e3d2c38f/dataprivacy-yb)

### The Dress-Up App That Toyed With Data
In April 2019, the FTC issued another [COPPA fine to i-Dressup](https://www.ftc.gov/news-events/blogs/business-blog/2019/04/i-dressup-data-security-mess), an app that offered games and virtual dress-up features to children. That company let kids fill out registration forms, sent a link to their parents for approval, but then failed to delete the children’s information even if parents never gave their consent. The company also failed to implement adequate security to protect data — they transmitted [passwords in plain text](https://auth0.com/blog/yes-data-privacy-applies-to-you/) and failed to monitor for security incidents, for example — and, as a result, was infiltrated by a hacker who accessed information about millions of users, 245,000 of whom had reported that they were under 13.

### Ring Camera’s Vulnerabilities Led to a Privacy Nightmare
Arguably the biggest recent child privacy story came in December 2019, when several owners of Ring security cameras reported that their cameras had been hacked. [In one particularly troubling incident](https://www.nytimes.com/2019/12/15/us/Hacked-ring-home-security-cameras.html), a young girl in Mississippi was terrified when an unknown man calling himself Santa Claus started speaking to her through the camera’s speakers.

Ring (which is owned by Amazon) asserted that their system had not been hacked, and that these users were the victim of a [credential-stuffing attack](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/). Amazon reminded users to use [multifactor authentication](https://auth0.com/learn/get-started-with-mfa/) and unique username/password combinations when registering new devices. That’s certainly good advice, but the idea of putting cameras that are vulnerable to intrusion in their children’s bedrooms still left many customers uneasy.

## The UK’s Law Demands That Children’s Privacy Be Built Into Design
The UK’s ICO developed its code in the wake of these stories and in the midst of growing public understanding of personal data as a precious resource. The UK’s code — its full name is the [Age Appropriate Design Code](https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services/) — establishes 15 standards to protect children’s privacy online.

### The Requirements of the Age Appropriate Design Code
The code applies to organizations that design, develop, or provide online services “likely to be accessed by children,” such as apps, streaming services, social media, games, and internet-connected toys. It requires that privacy settings should automatically default to high when a child downloads an app or visits a site. Geolocation services should automatically be turned off for children, data collection and sharing should be minimal, and profiling that is used to deliver targeted ads should also be disabled by default.

In addition to stipulating a high baseline for privacy settings, the ICO’s code forbids using “nudge techniques” to convince children to weaken their privacy. Nudge techniques are tools for leading users to behave as the designer would prefer, typically by making the alternative unappealing, cumbersome, or easy to miss.

![Nudge Technique](https://images.ctfassets.net/23aumh6u8s0i/3ADJoKGdFIwDeK42Ax6hHa/8ebec8e7efbcb94dfbedd8744e90bacf/dataprivacy-nudge-technique)

The ICO’s code is unique for its emphasis on the “[best interests of the child](https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services/1-best-interests-of-the-child/).” Organizations that use the personal data of minors are encouraged to consider how they can:

* Keep children safe from exploitation (whether commercial or sexual),

* Protect health and well-being (physical, psychological, and emotional),

* Support parents in protecting the best interests of children, and

* Recognize children’s ability to form their own views as they develop and “give due weight to” those views.

### How Businesses Are Responding to the Code
The code still needs to be officially approved by Parliament, but assuming it passes, organizations will have a year to update their policies before the rules take effect, most likely in fall 2021.

While the [ICO has stated](https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services/enforcement-of-this-code/) its commitment to helping organizations comply with the new rules, they have also made it clear that they intend to rigorously enforce the law. This may include reprimands, orders, and, “for serious breaches of the data protection principles... fines of up to €20 million or 4% of your annual worldwide turnover, whichever is higher.”

Some [businesses have complained](https://ico.org.uk/media/about-the-ico/consultations/aadc/2616638/conde-nast-britain-aadc-response.pdf) that having “the best interests of a child” in mind when designing a product is a vague directive, especially for online services used by adults and children alike. But the ICO has been firm in its commitment to this principle. As Commissioner Denham said in her statement: “In an age when children learn how to use an iPad before they ride a bike, it is right that organisations designing and developing online services do so with the best interests of children in mind. Children’s privacy must not be traded in the chase for profit.”

<include src="TweetQuote" quoteText="@ico has argued: _There are laws to protect children in the real world — film ratings, car seats, age restrictions on drinking and smoking. We need our laws to protect children in the digital world too._"/>

## The Global State of Children’s Privacy Legislation
The UK’s code is notable for going further than previous laws in protecting the digital privacy of minors, but it’s far from the only such law on the books.

The United States passed COPPA in 2000 and then amended it in 2013. This law prohibits online services from collecting the personal information of children under 13 without parental consent. COPPA applies to services that are designed for children or that have “actual knowledge” that they are collecting data from children.

The California Consumer Privacy Act ([CCPA](https://dataprivacy.foxrothschild.com/2019/06/articles/california-consumer-privacy-act/selling-childrens-data-under-ccpa-no-minor-issue/)) is broadly consistent with COPPA, with a few tweaks. Under the CCPA, businesses can’t sell the personal information of minors under 16 without permission. If the child is under 13, permission must be given by a parent or guardian, but minors between 13 and 16 can opt into data sales themselves.

Other states, including [Connecticut and Massachusetts](https://www.ncsl.org/research/telecommunications-and-information-technology/consumer-data-privacy.aspx), attempted to pass similar legislation in 2019. Thus far, those bills have failed to pass, but with more data privacy legislation being cooked up all the time, the trend isn’t going anywhere.

Meanwhile, across the pond, the General Data Protection Regulation ([GDPR](https://auth0.com/docs/compliance/gdpr)) requires parental consent to process the data of children under 16, although member states can modify that to be as low as 13. In addition, the GDPR applies to data collection, not just data sales. Unlike the CCPA, it provides no exemption for organizations that claim they are unaware a user is a child.

<include src="TweetQuote" quoteText="Children’s data privacy scandals recently hit @ring @youtube. Find out why children’s privacy is driving #dataprivacy legislation in 2020."/>

## For Businesses, Authorization Is Central to Compliance
All the laws we’ve discussed demand that online services treat users differently if they are children, but this raises the question: How do you know the person on the other end of the screen is a child? For that matter, how do you know that the person giving their consent for data use is actually their parent or guardian? The answer is a matter of authorization.

Most people who share streaming accounts with their families have seen authorization separate the adults (who will be recommended the latest Scorsese drama) from the children (who will be steered toward _My Little Pony_). Media companies do this by creating multiple user profiles under a single account, enabling greater personalization and ensuring that kids’ profiles are treated differently. 

There are several [authorization models](https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services/) for accomplishing this, which can support varying degrees of complexity and customization. For example, in the Attribute-Based Access Control (ABAC) model, permissions are assigned based on their attributes, including age. In contrast, in the Relationship-Based Access Control (ReBAC) model, permissions are assigned based on relationships, which enables policies that reflect real-world user dynamics. 

Even with social mapping, it can be tricky for companies to verify the relationship between an adult and child. Most companies consider the person who can pay to be an adult, and so they allow the subscription holder to indicate which profiles belong to children. The ICO also lays out  identity verification methods for determining the age of a user, which businesses can choose from based on their resources and the risk level of the data they’re collecting:

* **Self-declaration**, in which a user states their age but gives no other evidence. This is suitable only for low-risk situations

* **Artificial intelligence** gleaned from observing how users interact with the service. This method provides a greater level of certainty but has privacy pitfalls of its own. Under the ICO, businesses that go this route must inform users up front and adhere to the principles of data minimization and purpose limitation for all data collected this way.

* **Third-party age verification services:** These services use an “attribute” system to confirm the age of a user without the website or app needing to request additional personal information. That presents an advantage for businesses, but you must be careful to ensure that these third-parties are reasonably accurate and that they themselves are not violating data protection laws.

* **Account-holder confirmation** can be employed in cases where you know an existing account holder is an adult, so they can confirm the age of additional users through an email or text of a known device.

* **Technical measures** can strengthen self-declaration. For example, if a user is denied access to a service for being too young, you may prohibit them from immediately resubmitting the form with a different age.

* **Hard identifiers** are formal identity documents, such as passports. This is an option of last resort because some children don’t have access to such documents, and requiring them may be discriminatory to those users.

### Children’s Data Privacy Takes a Village
The push for giving specific data rights to children shouldn’t discourage organizations from designing products that cater to them. Nor should organizations use data privacy to lock kids out of the digital world; rather, they should help kids become thoughtful participants in that world. Hopefully, these laws will inspire companies to be more thoughtful in crafting policies that respect children’s curiosity as well as their safety.


It’s Time for a Fresh Approach to Children’s Data Privacy

These days, data privacy can make or break Mergers & Acquisitions


Merger and acquisition (M&A) deals can take years to put together, and they involve hundreds of moving parts, but it takes only one faulty element to turn a deal from a success story to a cautionary tale — especially if that element is cybersecurity.

According to one survey by Forescout Technologies, [53%](https://www.forescout.com/company/news/press-releases/forescout-study-reveals-cybersecurity-concerns-on-merger-and-acquisition-activity/) of respondents reported that their organization had encountered a critical cybersecurity issue during an M&A deal that put the deal into jeopardy, and 65% of respondents experienced regret after closing a deal because of cybersecurity concerns.

In the current regulatory environment, with the passage of the [GDPR and the CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), and with more data privacy laws in the works, cybersecurity, and data privacy have become crucial elements of pre-M&A due diligence. If an acquiring company doesn’t like what they find, they may walk away from the deal or later wish they had.

Here, let’s go over three recent M&A transactions that never got off the ground or whose deal value was severely undermined by data security issues.

## Facebook Walks Away From Tiktok’s Forebear
[_Fortune_](https://fortune.com/2019/11/13/facebook-musically-tiktok-bytedance-acquisition/) reports that in 2016, Facebook spent months considering a possible acquisition of Musical.ly, which later became TikTok, the massively popular video app. Facebook passed on the deal because of two concerns: the app was based in China, and its predominately underage user base would likely run afoul of American laws governing child internet privacy.

After Facebook opted out, Musical.ly went on to be acquired by Beijing-based startup ByteDance for $1 billion. Today, TikTok is a runaway hit with [over a billion](https://www.cnn.com/2019/06/20/tech/tiktok-bytedance-users/index.html) active users, but it's grappling with the same cybersecurity issues that made Facebook walk away, and those may even threaten ByteDance's acquisition.

In November 2019, [Reuters](https://www.reuters.com/article/us-tiktok-cfius-exclusive/exclusive-u-s-opens-national-security-investigation-into-tiktok-sources-idUSKBN1XB4IL) reported that ByteDance was being investigated by the Committee on Foreign Investment in the United States (CFIUS) because of national security concerns. Apparently, lawmakers were alarmed by [reports from TikTok employees](https://www.washingtonpost.com/technology/2019/11/05/inside-tiktok-culture-clash-where-us-views-about-censorship-often-were-overridden-by-chinese-bosses/) that their bosses in China compelled them to censor videos, including political content. There were also concerns about the security of the app’s data on U.S. users, and in December, ByteDance was hit with a [class-action lawsuit](https://www.bbc.com/news/business-50640110) in California. The suit claims that TikTok collects and stores “vast quantities” of user information without consent and then sends that data to servers in China, in violation of multiple laws.

<include src="TweetQuote" quoteText="What made @facebook walk away from TikTok. #mergersandacquisitions #lessons"/>

ByteDance has attempted to address these concerns by fencing off its U.S. operations from China, but if they fail to convince CFIUS, the committee may force ByteDance to divest from its holdings of Musical.ly, effectively reversing the acquisition. It wouldn’t be the first time CFIUS has intervened in M&A deals over data privacy concerns. In recent years, lawmakers have been vigilant about policing cross-border M&A deals, especially between tech companies.

In 2017, CFIUS refused to allow China’s Ant Financial to buy MoneyGram due to worries about the security of personally identifiable data of Americans, and last year, CFIUS forced Chinese company Kunlun Tech Co Ltd to sell the gay dating app [Grindr](https://www.reuters.com/article/us-grindr-m-a-exclusive/exclusive-us-pushes-chinese-owner-of-grindr-to-divest-the-dating-app-sources-idUSKCN1R809L). All of these stories point to the necessity of keeping data privacy top of mind when considering an international M&A deal, especially one with China.

## Verizon’s Acquisition of Yahoo Unearths a Privacy Nightmare
In 2017, [Verizon acquired Yahoo](https://www.washingtonpost.com/news/the-switch/wp/2017/06/13/its-official-verizon-finally-buys-yahoo/) for $4.48 billion, but the deal almost fell through over two data-breach scandals that came to light in the midst of negotiations.

Yahoo revealed that they had suffered two separate data breaches, which they had not made public. In the first breach, a hacker stole the personal data of at least 500 million users, including some unencrypted passwords and answers to security questions. As [TechCrunch](https://techcrunch.com/2016/09/22/yahoo-confirms-state-sponsored-attacker-stole-personal-data-of-at-least-500-million-users/) reported at the time: “With the answers to security questions, a hacker could easily jump through a number of online forms to reset users’ passwords on sites where an additional means of account verification — like two-factor authentication — is not involved.”

In the second breach (widely reported to have been carried out by a state-sponsored actor), 1 billion accounts were compromised, and again personal information and login credentials were stolen. Yahoo’s chief information security officer reported that stolen passwords were hashed using MD5, but [tech insiders countered](https://techcrunch.com/2016/12/14/yahoo-discloses-hack-of-1-billion-accounts/) that MD5 was an outdated and insecure form of hashing that could easily be cracked to reveal the passwords.

In the end, Verizon went ahead with the acquisition of Yahoo but knocked $350 million off the purchase price. Verizon also agreed to share legal liability for the breaches with Yahoo. It was a costly inheritance, and, coupled with the PR fallout, it damaged the deal’s value in ways that will doubtlessly be felt for years.

In the wake of this scandal-plagued acquisition, the [SEC issued new guidelines](https://www.sec.gov/rules/interp/2018/33-10459.pdf') for cybersecurity disclosures, so neither shareholders, customers, nor acquiring companies are kept in the dark about a data breach. Nevertheless, the Verizon-Yahoo story has made mergers and acquisitions dealmakers take a closer look at cybersecurity during due diligence in order to determine whether the target company has appropriate security in place to be legally compliant.

<include src="TweetQuote" quoteText="Why @verizon’s acquisition of @yahoo unearthed a privacy nightmare. #mergersandacquisitions #lessons"/>

## Marriott Acquires Starwood... and a Major It Headache
In 2016, [Marriott International purchased](https://www.cnbc.com/2016/09/23/marriott-buys-starwood-becoming-worlds-largest-hotel-chain.html) Starwood Hotels & Resorts for $13.3 billion, forming the largest hotel chain in the world. Despite initial enthusiasm for this megadeal, it has been fraught with difficulties, many stemming from problems integrating software between the two chains’ operations. Two years into the merger, the two chains still struggled to transform into a truly combined company, with [some hotels reporting](https://skift.com/2018/08/07/marriott-still-working-through-starwood-integration-two-years-after-deal/) that the transition to a new salesforce system got in the way of sales.

Then, in 2018, Marriott revealed that Starwood had suffered a massive data breach, in which nearly 400 million guest records were exposed through a security flaw in Starwood’s reservation system. The flaw in Starwood’s system had existed since 2014, long predating Marriott’s acquisition. But when the breach was discovered in 2018, two years after the deal, Starwood’s reservation system still hadn’t been migrated to Marriott’s.

In light of this, Marriott was hit with a [$123 million GDPR](https://www.forbes.com/sites/kateoflahertyuk/2019/07/09/marriott-faces-gdpr-fine-of-123-million/#1c7e3c654525) fine by Britain’s Information Commissioner's Office (ICO). In a [statement](https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/statement-intention-to-fine-marriott-international-inc-more-than-99-million-under-gdpr-for-data-breach/), Britain’s information commissioner, Elizabeth Denham, said, “The GDPR makes it clear that organizations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.”

## Don’t Let Data Privacy Derail Your M&A Deal
The one thing all these M&A disasters have in common is that they could have been prevented, or at least mitigated, had the companies in question known what warning signs to look for. Each of these companies (both the acquirers and the acquired companies) could have benefited from the expertise of dedicated identity-management professionals.

The right partners could have implemented cutting-edge encryption for Yahoo’s personal information, could have integrated Marriott and Starwood’s systems more quickly and could have advised TikTok on the importance of data siloing in cross-border M&As.

In the year to come, investors will surely take these lessons to heart. Even though M&A activity is predicted to be robust in 2020, it will doubtlessly be tempered by caution around cybersecurity to ensure that these issues don't prevent M&A transactions from providing a return on investment.

If your business is in the M&A market, and you’d like to make sure it doesn’t have any cybersecurity skeletons in its closet, [reach out to the team at Auth0](mailto:sales@auth0.com).


Recent M&A Deals that Imploded Over Cybersecurity

Why credential stuffing, more data privacy regulation, and record attacks will require ‘old-fashioned’ work.



[2019 set a record for data breaches](https://www.darkreading.com/attacks-breaches/2019-trending-as-worst-year-on-record-for-data-breaches/d/d-id/1336348). Add in [rising ransomware attacks](https://www.cnn.com/2019/10/08/business/ransomware-attacks-trnd/index.html) an increasing number of data privacy regulations like CCPA and India’s upcoming data privacy act are forcing a convergence of security and compliance. 

I sat down with Auth0’s Chief Security Officer Joan D. Pepin and Senior Director of Security and Compliance Duncan Godfrey to discuss what we can expect in 2020.

## 1. Credential Stuffing Continues to be the ‘Easy Attack’

[Credential stuffing attacks](https://auth0.com/blog/the-disney-credential-stuffing-attack-could-happen-to-you/), where hackers steal login credentials from one site and then use the same credentials to break into a user’s other accounts, will continue to be the ‘easiest attack on the internet’ says Joan. 

“Millions of usernames and passwords have already been breached,” says Joan. “And most people use the same password for everything. These credentials are available for free or cheap and what’s inside people’s accounts has real value. Add up bad behavior + breaches + value and you get the easiest attack on the internet. At Auth0, we detect [50,000 attacks every day](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) from unique IP addresses.” 

<include src="TweetQuote" quoteText="Find out why @CloudCISO_Joan expects credential stuffing attacks to continue in 2020 — and what you can do about it. #2020prediction #cybersecurity"/>

Joan says companies can help mitigate this global challenge by:
> * Doing what they can to make sure their customers’ credentials aren’t breached (and become part of the problem)
> * Employing solutions that will inform their users that they are using breached credentials
> * Make it easy for users to change their credentials
> * Consider bringing back the 90-day password change policy
> * As an industry, we need to collectively work on a solution that’s better than passwords

## 2. AI Loses its ‘Hollywood’ Shine

2020 will be the year that the cybersecurity industry pulls a reverse [Terminator](https://www.imdb.com/title/tt0088247/) as we see AI-focused detection products losing their shine because of their inability to meet silver bullet promises says Duncan.

“Currently, the term AI is being used as a catch-all for distinct technologies,” says Duncan. “When people think about AI, they think of movies like the [Terminator](https://www.imdb.com/title/tt0088247/) or [Minority Report](https://www.imdb.com/title/tt0181689/). But when people use AI security products, they’re often actually using machine learning algorithms rather than a prescient computer. Many cybersecurity products carry the AI label, but just can’t deliver that Hollywood performance.”

Despite all the marketing hype, AI still isn’t delivering, says Duncan. 

<include src="TweetQuote" quoteText="Sr. Director of Security and Compliance.@duncangodfrey predicts Cybersecurity AI will lose its shine in 2020. Do you agree? #2020prediction #cybersecurity"/>

“There are no shortcuts in security. It’s still based on doing the hard foundation work and being rigorous with your security hygiene. AI is solving high-level problems that are beyond the needs of most companies. I’m not saying all this technology isn’t working: we have seen great strides in content and facial recognition for example. ”

But it won’t be this way forever. “in 50 years this prediction will perhaps make me look like a Luddite but whatever tech we are using then will be built out of the ashes of the broken AI tech of the last few years — as in I might hear it tell me ‘I will be back,” says Duncan.

## 3. The Buck Stops at CCPA

GDPR was a game-changer for many, but some companies didn’t have to put their data houses in order. Joan says she expects [California Consumer Protection Act (CCPA)](https://auth0.com/ccpa/) to have a bigger impact. “Companies that were able to skate on GDPR will have to deal with CCPA — and because these companies weren’t large enough to be impacted by the EU’s regulations, they are likely to be smaller and less prepared, or we may see CCPA cause more pain than GDPR.”

## 4. What’s Under the Hood? Autonomous Vehicle Attacks Increase

[Falling asleep behind the wheel](https://arstechnica.com/cars/2019/06/people-keep-spotting-teslas-on-the-freeway-with-snoozing-drivers/) of your self-driving Tesla seems like a fairly safe activity until you look under the cybersecurity hood says Duncan. 

“We have become more and more dependent on automated driving systems and now we are seeing active testing of fully autonomous vehicles. Behind all of this technology are management and control networks operated by the manufacturer. As this technology pervades through our lives it makes you wonder how secure they are. This year [84% of automotive engineers](https://auth0.com/blog/car-hacking-and-cybersecurity-in-automotive-industry/) expressed concern that their systems weren’t keeping pace. We’ve already seen small-scale hacks on vehicles, but what happens if a control network is compromised and thousands or tens of thousands are hacked at the same time? These networks become part of our critical national infrastructure and in the same way, power grids and our telecommunications networks are vulnerable, we have a whole new class of social infrastructure that needs protecting. I expect we’ll see an increase in targeted individuals or even fleets of cars. As we become aware of the challenges, companies should take steps to secure their systems and demonstrate to society and their customers that they’re taking this seriously.”

## 5. Cybersecurity Will Require ‘Old-Fashioned Work’

Privacy regulations like GDPR and CCPA are driving the convergence of security and compliance, says Joan. But the solution doesn’t reside in the next-best cyber tool. 

“Be thoughtful,” says Joan. 

“Just like your finance team should have a really good idea of your company's assets and liabilities, the InfoSec team, your data team  — whoever is responsible — should understand your data assets and liabilities. If responsibility is unclearly spread across six teams that’s the first place to be thoughtful. Do the work of noting your assets and liabilities. Do you have a Plan? Who owns it? Which laws, regs, norms, best practices you are following (and not following). What would be easy to fix? What would be hard? This is old-fashioned work. Nothing cyber about it. Your CFO, CISO, Chief Privacy Officer, Chief Data Officer — someone should own this project, make an inventory, have a plan — and anyone who says the word “cyber” should have to put a dollar in the jar. There’s nothing cyber about it.”

## 6. Expect even more information warfare

We promised you five predictions, but couldn’t this one out. You’ll find Joan’s thoughts on the relationship between information warfare and cyber warfare in this [Forbes](https://www.forbes.com/sites/gilpress/2019/12/12/42-more-cybersecurity-predictions-for-2020/#8b57cd54a56b) post. We’ll get deeper in a future post.


Top 5 Cybersecurity Predictions for 2020

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Breached Password Detection and Multifactor Authentication Critical for Prevention



**BELLEVUE, Wash., November 18, 2019 —** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today revealed data insights showing the staggering amount of credential stuffing attacks attempted on its platform on a daily basis. Auth0 detects attacks from more than 50,000 unique IP addresses every day, reflecting the growing sophistication and frequency of cybercrime. Credential stuffing attempts are constantly multiplying, with absolutely no slowdown in sight.

The sheer number of attempts is due largely to the ease and inexpensive manner in which credential stuffing attacks can be orchestrated. Getting access to breached passwords is the first step for attackers, and unfortunately, there are billions openly available on the internet. Auth0's database contains more than one billion breached email/password combinations which are used for its [Breached Password Detection](https://auth0.com/breached-passwords) feature, the first line of defense against credential stuffing. Breached credentials, in combination with 65% of people [reusing passwords across accounts](https://services.google.com/fh/files/blogs/google_security_infographic.pdf) (Google), enables hackers to architect botnets — networks of exploited devices — to direct large-scale attacks in a coordinated manner.

Whereas targeted attacks have a specific and designated entry in mind, large-scale attacks like credential stuffing are automated and intended to attack as many entry points as possible. There is also a proliferation of 'botnets-for-hire' where services are traded among hackers, even rented for nominal fees for use in widespread attacks. And their destruction can oftentimes go unnoticed because these botnets steal insignificant amounts of money from services (like Spotify or Netflix) that actually add up to billions of dollars every year.

Between July and September 2019 alone, Auth0 determined that during a credential stuffing attack, traffic for a particular website may surge as much as 180x the usual volume, with traffic related to the attack itself accounting for 70% of overall activity.

"Unfortunately, it has become very easy and cheap for bad actors to quickly rotate the IP addresses used in an attack. Nearly all of the attacks we detect appear to originate from botnets," said Matias Woloski, CTO and co-founder of Auth0. "Many major brands have fallen victim to credential stuffing attacks this year — causing a significant impact on IT resources, account takeovers, and brand reputation. Even the largest companies are vulnerable if they don't have the right preventative measures in place." 

Auth0 is at the front door to stop credential stuffing attacks. [Breached Password Detection](https://auth0.com/breached-passwords) (part of Auth0's [Anomaly Detection](https://auth0.com/learn/anomaly-detection/)), with its internal database of more than one billion breached passwords, enables customers to block user accounts that try to login with compromised information, and only grants access when the password has been reset. This is instrumental in blocking credential stuffing attacks, since hackers rely on people reusing email and password combinations that have already been breached.  

In addition, [Multifactor Authentication](https://auth0.com/multifactor-authentication) (MFA) is one of the best ways to prevent account takeovers, whether from a credential stuffing attack or something else. In order to compromise an MFA-protected account, attackers would need to access not only a set of breached credentials used across accounts, but also the device used for the second factor. Combatting MFA drastically increases the time and effort needed for bad actors to compromise an account, which makes it infeasible to do at scale. Auth0 is working on additional features to reduce the perceived friction end users experience when MFA is implemented.

"Breached Password Detection and MFA functionality are the critical barriers for preventing credential stuffing attacks. We are continuously improving our features to detect and prevent, and will be rolling out new functionality to have even greater visibility into attacks," added Woloski.

<include src="asides/AboutAuth0" />

### Media Contacts

Alex Plew <br>
Matter for Auth0 <br>
auth0@matternow.com <br>

Deepika Zafar <br>
Racepoint Global for Auth0, EMEA <br>
auth0@racepointglobal.com


Auth0 Reveals 50,000 Unique IP Addresses Make Credential Stuffing Attempts on Daily Basis

Our security best practices checklist will help you, and the kids you know, stay safe online.



Today, it’s hard to think about a part of our lives that’s not connected to the internet in one way or another. Work, relationships, entertainment, growth, finances, health, home appliances, cars. They all can have an **online component**.

But the online world is a hard thing to perceive. We can’t quite touch it. We can only experience it through a screen, headphones, or a microphone. So the associated risks and consequences sometimes may not seem as real and bad as a hurricane, an armed theft, or as cutting a finger while cooking. But *are they*? 

Yes, they are!

But it also depends on you, and your “threat model”, which is just a fancy (and possibly intimidating) word to sum up the answers to these six questions:

* What are my assets? 
* Who are my adversaries?
* What can my adversary do?
* How likely is it that I will have to protect my assets?
* How bad are the consequences if I fail?
* What can I do to defend myself against my adversaries?

The questions also sound a bit intimidating, but it’s just about listing what you value, who can hurt you, how, what are the odds of being affected, what the consequences could be and what are your defenses. It works for online and offline risk.

Since so much of our lives are online today, we all have **valuable assets on the web**. Our online identity, our private identifiable information (name, birthdate, home address, phone number, email accounts), our social media, credit card numbers, pictures, work data. We all have information to protect, and we all have a responsibility to protect it too, [_including children_](https://auth0.com/blog/auth0-cybersafe-camp/).

![Auth0 family security](https://images.ctfassets.net/23aumh6u8s0i/4VW4wTpm0aesOHQS6GZJiu/071af53dace08a20a87351ce43a5554d/auth0-personal-security)

And since there have been so many [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) up until now, we all have adversaries. All the data that has been breached is up for sale for a cheap price on the dark web, and it could be used against us in different ways. Depending on who we are and what we do, we may be an interesting target as well. 

In general, the consequences of an attack can be tremendously hurtful. Identity theft, ransom, data or financial loss, cyberstalking, and even physical damage. 

Now, we can all get ready and protect ourselves, and that is what **October National Cybersecurity Awareness Month** is about. A yearly effort aimed at helping you stay safe online. 

At Auth0 we care very deeply about cybersecurity, and we want to help make the internet safer. Not only by [_increasing the security of your business_](https://auth0.com/blog/how-auth0-makes-your-apps-more-secure/) through our platform, by helping you enable password policies, anomaly detection, and MFA quickly, and by protecting the credentials of your users which helps prevent data breaches. But also by spreading awareness about cybersecurity, and partnering up with the [_US government_](https://www.dhs.gov/national-cyber-security-awareness-month), the [_EU_](https://cybersecuritymonth.eu/), and [_Australia_](https://www.staysmartonline.gov.au/get-involved/stay-smart-online-week) during October National Cybersecurity Awareness Month.

So we have prepared an **easy checklist** to help you, and the kids you know, stay safe online. Download the [Personal Cybersecurity Checklist](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist)!

We believe in making cybersecurity accessible for everyone, so we’ve translated it to **9 languages** with the help of Auziros from all over the world. 

Follow us on [_Twitter_](https://twitter.com/auth0), where we’ll be sharing 31 days of tips and best practices, and also come talk to us in [_our online meetup_](https://www.meetup.com/Auth0-Online-Meetup/), [_Seattle_](https://www.meetup.com/Seattle-Identity-and-Security-Meetup/), [_London_](https://www.meetup.com/London-Identity-and-Security-Meetup/), and [_Hamburg_](https://cybersecmonth-hamburg.de/). 

Cybersecurity is everyone’s responsibility. We all have to Own It. Secure It. Protect it, so we can stay safe online.


Personal Information Security Checklist for Family and Friends


**BELLEVUE, Wash. — October 7, 2019 —** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced significant momentum for its [Partner Program](https://auth0.com/partners) with the addition of new partners from key regions around the world. The surge of new Solutions and Technology Partners from the U.S., Canada, South America, Northern and Southern Europe demonstrates how integral identity management is to technology integrators. To lead the continued growth of the program globally, [Bill Lapcevic](https://www.linkedin.com/in/blapcevic/) has joined the company as VP of business development.

Worldwide spending on digital transformation efforts is predicted to reach $1.97 trillion in 2022, according to IDC. This monumental effort is driving the urgent demand for robust systems integrators and technology consultants to assist with these efforts. One of the key components of any digital transformation initiative is [identity management](https://auth0.com/learn/identity-management-drives-digital-transformation/). Given the complexity of identity, partners are rapidly signing on with Auth0 for its technology excellence, documentation, training, and support, resulting in a 440% growth of the program in the past year.

Auth0's newest partners include:

-   [Globant](https://www.globant.com/#home) — Global, digitally-native systems integrator focused on digital and cognitive transformation

-   [NetBR](https://www.netbr.com.br/) — Identity software integrator and Auth0's first partner in Brazil

-   [Versett](https://versett.com/) — Digital strategy consultancy and Auth0's first partner in Canada

-   [Nixu](https://www.nixu.com/) — Holistic European cybersecurity services company with operations in Finland, Sweden, Denmark, Benelux and Romania

-   [Soft Strategy](http://www.softstrategy.it/) — Consulting firm specializing in digital trust and Auth0's first partner in Italy

"Our mission is to help our customers prepare for and succeed in any digital and cognitive future," said Gastón Fourcade, Chief Technology Officer at Globant. "Identity management is a critical step in any transformation process. We leverage the latest technologies and platforms in our customers to deliver business-ready solutions and Auth0 proves to be a solid solution to support customers in those transformations."

Known for its comprehensive, developer-friendly documentation, Auth0 is strengthening its focus on technology training and enablement for partners, most notably through the launch of its new [Partner Portal](http://partners.auth0.com/). Auth0 partners can use the Portal to find the latest news, content and training materials, or register a new opportunity directly. Auth0 also recently launched an [AWS-focused microsite](https://auth0.com/learn/aws-auth0-iam-platform/) to promote its availability on AWS Marketplace.

"It's an exciting time to join Auth0 to build on the incredible momentum our Partner Program has achieved. Our partners are key to extending Auth0's reach worldwide," said Lapcevic. "When our partners combine their skills, best practices, and products with Auth0's extensibility and customization capabilities, customers receive a holistic world-class solution for authentication and identity that others just can't match."

Prior to joining Auth0, Lapcevic served as chief operating officer for Sentry.io responsible for the company's go-to-market business. He was also the third employee at New Relic, where he built a vibrant business development and partner program, and saw the company from inception past initial public offering. He will be responsible for owning and managing all global channels and partnerships at Auth0.

For more information on the Auth0 Partner Program, please contact a member of the [Partner Success team](https://auth0.com/partners#become-a-partner).

<include src="asides/AboutAuth0" />

### Media Contacts

Meghan Gardner<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br/>


Auth0 Partner Program Accelerates Global Growth

Follow these cybersecurity experts to keep up-to-date and to stay ahead.

40 Cybersecurity Experts, Podcasts, and Blogs to Follow

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Join us for global events promoting cybersecurity awareness and education


**BELLEVUE, Wash. -- October 1, 2019 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced a series of global events and meetups in support of [National Cybersecurity Awareness Month (NCSAM)](https://www.dhs.gov/national-cyber-security-awareness-month). During October, Auth0 joins government and industry organizations around the world in educating the public about cybersecurity best practices and how to stay safe online.

Originally created by the U.S. Department of Homeland Security and National Cyber Security Alliance, NCSAM has grown into a global initiative supported by the [EU](https://cybersecuritymonth.eu/) and [Australia](https://www.staysmartonline.gov.au/get-involved/stay-smart-online-week). This year's campaign — Own IT. Secure IT. Protect IT. — encourages personal accountability and proactive behavior to enhance cybersecurity at home and in the workplace; and focuses on issues like citizen privacy, consumer devices, and eCommerce security.

NCSAM named Auth0 a [2019 Champion Organization](https://staysafeonline.org/ncsam/champions/view-all/) dedicated to promoting a safer, more secure and more trusted internet. Auth0 activities in support of this year's campaign include:

## Online meetups. Read more and register at [Auth0 Online Meetups](https://www.meetup.com/Auth0-Online-Meetup/).

-   **October NCSAM Kickoff & Hacking JWTs** with Annybell Villarroel, security awareness manager at Auth0 and Joel Lord, developer advocate at Red Hat for the OpenShift Platform

-   **Gotta Catch'em All - Bug Bounty!**  with Chloe Messadhi, VP of strategy at Point3 Security

-   **Prioritizing Trust while Creating Applications** with Jennifer Davis, cloud advocate at Microsoft

-   **Security in 2019** with Eugenio Pace, CEO and co-founder and Joan Pepin, CISO and VP of operations at Auth0

-   **The State of Crypto in Node.js** with Ujjwal Sharma, apprentice compiler engineer at Igalia and core team member at Node.js

## In-person events. Read more and register below.

-   **Women Who Code Workshop** with Eva Sarafianou, product security engineer at Auth0. Tuesday, Oct. 15 at Auth0's Bellevue Office [Learn more and register](https://www.meetup.com/Women-Who-Code-Seattle/events/265429291/).

-   **Cybersecurity Awareness Meetup 2019** in [Hamburg](https://www.meetup.com/Hamburg-Cybersecurity-Awareness-Month-2019/events/264612206/), [London](https://www.meetup.com/London-Identity-and-Security-Meetup/), and [Seattle](https://www.meetup.com/Seattle-Identity-and-Security-Meetup/).

## Free Downloadable Content

-    **Personal Cybersecurity Checklist** Learn how you and your loved ones can [stay safe online](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist).

-   **Credential Stuffing Attacks Whitepaper** Learn about [credential stuffing attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) and how to combat them.


To get involved with National Cybersecurity Awareness Month, visit the [NICCS NCSAM website](https://niccs.us-cert.gov/national-cybersecurity-awareness-month-2019) and follow the updates on Twitter #BeCyberSmart.

<include src="asides/AboutAuth0" />

### Media Contacts:

Meghan Gardner<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)<br>

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br/>
+44 (0) 77 1124 4113


Auth0 Celebrates Cybersecurity Awareness Month 2019

Private program reinforces company’s strong security ethos


**BELLEVUE, Wash., Oct. 1, 2019** -- [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced the launch of a private bug bounty program to further reinforce its emphasis on security and ensure that its customers are protected from any vulnerabilities.

The private bug bounty is a specialized program that will allow Auth0's security team to partner with selected researchers to source potential vulnerability discoveries in exchange for monetary rewards. The bug bounty will be run on [Bugcrowd](https://www.bugcrowd.com/) and will expand the company's current [Responsible Disclosure Program](https://auth0.com/responsible-disclosure-policy/), which is already in place.

"We take the privacy and protection of our customers' data very seriously and are dedicated to investing the time and resources into ensuring we adhere to the highest standards," said Joan Pepin, CISO and VP of Operations at Auth0. "Our security program is maturing rapidly, and the launch of this bug bounty program reinforces our dedication to our customers and the highest level of security we offer them."

Bugcrowd will select and invite security researchers registered on its platform based on skills and experience. Each report verified by Bugcrowd's Application Security Engineer team will be then sent to the Auth0 Product Security team to assess the severity of the finding, assign the researcher a monetary reward, move the issue to its internal vulnerability database, and work with relevant Product and Engineering teams towards remediation.

"Bugcrowd deploys a global Crowd of diverse, creative, and highly-skilled security researchers to identify and solve security challenges," said Ashish Gupta, CEO at Bugcrowd. "The result is our ability to provide highly specialized security expertise to the high caliber of companies we work with. We are really excited to be supporting the launch of Auth0's Bug Bounty Program and serve as an extension of its security team."

The program is launching with approximately 25 global researchers who have been identified and invited by Bugcrowd, and will increase in number later this year.

Auth0 is a trusted security partner to its customers and has achieved certification for many important compliance regulations, including HIPAA, SOC 2 Type II, ISO 27001, ISO27018, and more. Please visit [Auth0 Security](https://auth0.com/security/) for more information.

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Meghan Gardner<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)


Auth0 Launches Bug Bounty Program

Add these cybersecurity books to your library and develop the skills that will support your career.

30 Cybersecurity Books To Deepen Your Knowledge

Three ways SMBs can invest in cybersecurity best practices that prioritize protecting sensitive data.



Many small business leaders believe their companies are safe from cybersecurity threats. In a [2017 study by Insureon](https://www.insureon.com/resources/research/small-business-cyber-security-poll), just 16% of 2,400 respondents were concerned about a cybersecurity attack — down from 18% the year prior. 

Small business leaders assume their teams are too small to be worthwhile targets — or that existing IT teams can handle external threats. In particular, startup founders must juggle numerous other priorities as they scale, like getting to product-market fit, hiring, and fundraising. If cybersecurity isn’t front of mind, it’s less likely the team will make a concerted effort to improve their current infrastructure.

Yet this lack of attention can be a fatal mistake. Hacking operations often use bots to [_crawl multitudes of sites_](https://www.sitelock.com/blog/2017/04/website-vulnerabilities/) looking for known vulnerabilities. In these situations, company size doesn’t matter. While security disasters at massive companies, such as [_Anthem and Target_](https://auth0.com/blog/4-security-measures-after-data-breach/), dominate headlines, startups, and the rest of the small-to-medium businesses often make easy prey because [_they devote fewer resources to defense_](https://www.bbb.org/globalassets/shared/media/state-of-cybersecurity/updates/cybersecurity_final-lowres.pdf)_._

How can small teams protect themselves when resources are low and other projects are vying for immediate attention? In this piece, we highlight three areas where startup and small business leaders can invest their time and money to secure their sensitive data and safely grow.

## 1. Secure your users from the start.

From the moment you begin hiring, safely and easily managing access to your technical systems becomes a challenge. Yet the pace of startup growth and the [_looming chance of failure_](https://www.godaddy.com/garage/startup-mistakes-4-startups-that-monumentally-failed-and-what-we-can-learn-from-them/) can make it difficult to spend time on credential management. 

A lack of a strong user management and authentication system, however, can sink you.

In Verizon's annual Data Breach Investigations report, they found that [63% of confirmed breaches](https://enterprise.verizon.com/resources/reports/2017/dbir-presentation-beltug.pdf) involved weak, default, or stolen passwords. A bad password doesn't threaten a single account. If users reuse passwords, one compromised account could lead to the loss of many other devices and systems. 

A solution like Auth0 provides [_multi-factor authentication_](https://auth0.com/multifactor-authentication) (MFA) that bypasses password vulnerabilities and enables admins to immediately approve login requests with a single click across a range of devices.

![Auth0 Guardian MFA authentication requests mobile and smart watch screenshots](https://images.ctfassets.net/23aumh6u8s0i/2WzftOPNUQiNo7UrxPClrO/f30cb0b18a1882b312362585c23f8c6d/auth0-guardian-mfa)

With MFA in place, users need a second piece of sensitive information, such as a thumbprint or facial scan, to access other systems. Hackers with only one set of credentials can't get any further. 

[Auth0 Guardian](https://auth0.com/multifactor-authentication) helps startups keep moving by ridding employees of pesky, single-use login codes. With push notifications, busy admins can approve or deny requests without ever having to open the app. Guardian also offers mobile Software Development Kits (SDKs), so that you can design your own MFA application that integrates smoothly with the rest of your company's branding.

## 2. Plan your response to attacks.

Unfortunately, [with data breaches on the rise](https://auth0.com/blog/what-is-a-data-breach/), you can’t afford to not plan ahead.

In 2017, the startup Kickico [found itself unprepared](https://medium.com/@kickico/how-they-tried-to-hack-our-ico-d348659dc4). They endured a wave of distributed denial-of-service (DDoS) attacks as hackers spoofed their site, cloned their platform on GitHub, and readied the clone to fool potential users once the original site went down. Luckily, the hackers appeared to run out of funds to keep up the DDoS attacks, and GitHub promptly responded to Kickico's request to block the attackers. 

Kickico wasn't ready, and admitted “We did not realize such a small and inconspicuous company without huge PR actions [would] attract any attention.”

Many startups are ill-prepared and subtle attacks can take much longer to detect. One study found that [over two-thirds of companies](https://enterprise.verizon.com/resources/reports/DBIR_2018_Report_execsummary.pdf) took months or longer to discover a breach—even though those breaches took mere minutes to accomplish. 

Startups can build in preparedness with tools that offer [breached password notifications](https://auth0.com/breached-passwords), so that you know about leaked credentials instantly, and can even lock out users until they reset their passwords. 

![Auth0 anomaly protection Dashboard brute force protection enabled](https://images.ctfassets.net/23aumh6u8s0i/1dU6iYAvPdzS7ZM8HcK2RA/44ebc4556fcf622399d699338f3383f9/anomaly-detection-overview)

With anomaly detection in place, startups can also set limits on brute force logins before they happen, establishing a baseline level of preparedness. 

These cybersecurity best practices can buttress a [data breach response plan](https://auth0.com/blog/data-breach-response-planning-for-startups/), which prepares startups to react as quickly as possible to a breach. Rather than taking it alone, startups should form relationships early on with law, public relations, and incident response firms that are familiar with data breaches. Once you detect a breach, you can follow the plan and leverage the experts to recover as quickly and fully as possible. 

Data privacy laws are also increasingly [taking breaches more seriously](https://auth0.com/blog/get-ready-for-gdpr/), requiring faster responses and imposing stiffer penalties. A well-thought-out data breach response plan, informed by automatic detection, is only going to become more necessary.

<include src="TweetQuote" quoteText="Many startups are ill-prepared to tackle cybersecurity attacks and subtle ones can take too long to be detected. One study found that over two-thirds of companies took months or longer to discover a breach."/>

## 3. Guard against web-based attacks.

Your website is like your company's front door, yet hackers have thousands of ways in. [Forty-nine percent of cyber attacks](https://www.cyberreadinessinstitute.org/cyber-readiness-news/small-and-mid-sized-businesses-cyber-threats-by-the-numbers) are web-based, and [44 attacks per day](https://smallbiztrends.com/2018/03/sitelock-website-security-insider-q4-2017.html) strike the average small business site. 

Web security depends on more than the connection between two entities. Data [goes through third parties](https://auth0.com/blog/using-https/) to get where it needs to go, so authentication at all stages is central to secure communication. 

If the [right communication protocols](https://auth0.com/blog/common-threats-in-web-app-security/) aren't set, transmitted information can become vulnerable to so-called man-in-the-middle attacks. HTTP, an application protocol you've likely seen in many URLs, is historically focused on sending information, not securing it. 

HTTPS, a newer protocol with security built in, makes attacks much harder to accomplish. HTTPS adds Transport Layer Security, or TLS, which ensures a client is only communicating with the expected server and that all data passed between is encrypted. 

Using an [HTTP Strict Transport Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security), or HSTS, header reinforces HTTPS across your web application by telling browsers your site can only be accessed through HTTPS. Even if users have an older version bookmarked or type http://, an HSTS header forces browsers and applications to use HTTPS instead. Hackers won't be able to access the encrypted information, steal your site's cookies, or force a redirect to a spoofed site. 

Auth0 [enforces HTTPS connections](https://auth0.com/blog/a-run-through-the-owasp-top-10/) to all of its services, which means any non-HTTPS connections will be upgraded. 

Startups have to use their limited resources judiciously, but in the same way, a new restaurant wouldn't skimp on locks, neither should startups ignore these web security best practices. 

## Security on day one

Poor cybersecurity is technical debt. These shortcuts can keep a company moving but compound over time, eventually becoming expensive burdens. You can wait on establishing good cybersecurity procedures, but hackers won't. The longer you take to make security a priority, the harder it's going to be to retroactively protect yourself. 

Cybersecurity is an investment in the sustainability of your company. Growth without cybersecurity best practices in place is [growth for the benefit of hackers](http://blog.idonethis.com/security-ringcaptcha/) seeking a big payout.  

Start by addressing one of your primary vulnerabilities: identity. With an outsourced provider like Auth0, you can scale security with user growth, form an informed threat response plan, and build a secure login environment. Investing in security early will keep you safer and better-informed when it matters most.

<include src="TweetQuote" quoteText="Cybersecurity is an investment in the sustainability of your company. Growth without cybersecurity best practices in place is growth for the benefit of hackers seeking a big payout."/>

<include src="asides/AboutAuth0" />


How SMBs can Improve Cybersecurity for their Customers

We offer three tactics to create a more open and secure company — for your colleagues and end users.



->![Two people shaking hands in office environment](https://images.ctfassets.net/23aumh6u8s0i/2brFbaENwm1v0BO1alPzES/378e13d35486ac61232cdb192e0f3d15/shaking-hands)<-

[_Image via Pexels_](https://www.pexels.com/photo/achievement-adult-agreement-arms-1243521/)

Cybersecurity can be a black box. If you aren’t a software engineer, it’s almost impossible to figure out what’s happening behind the scenes to reduce threats and protect data.

And even if you are an expert, the multitude of changes, threats, and solutions can be dizzying.

None of this is helped by the fact that most companies choose to remain tight-lipped about what cybersecurity measures they have in place. In some ways, that makes sense: publicizing too much about your efforts could decrease your competitive edge and make you vulnerable to more attacks.

On the other hand, an intense level of secrecy about cybersecurity can be crippling. Knowledge-sharing throughout the industry is limited, and your customers can feel as though they’re left in the dark about what’s being done to protect their private information.

As a result, certain companies are opting to increase their transparency and disclose their cybersecurity practices. This piece will highlight the main drivers of change — and offer concrete solutions for business leaders to clarify their cybersecurity practices in a valuable manner.

## A Growing Push for Transparency

Pioneering regulations, as well as thoughtful business leaders, are catalyzing transparency initiatives. 

In February 2018, for example, the U.S. Securities and Exchange Commission [published an update](https://www.techrepublic.com/article/sec-will-now-require-us-companies-to-disclose-cybersecurity-risks-and-breaches/) to their 2011 cybersecurity statement. The update states that all publicly traded companies must "take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion." In addition, the National Conference of State Legislatures [reports](http://www.ncsl.org/research/telecommunications-and-information-technology/data-security-laws.aspx) that at least 24 different states have introduced laws related to the data security practices of private companies. 

In the UK, the [National Cyber Security Centre](https://www.irishtimes.com/topics/topics-7.1213540?article=true&tag_organisation=National+Cyber+Security+Centre) (NCSC) is pushing for [“more openness and demystification” around cybersecurity practices](https://www.irishtimes.com/business/technology/less-fear-and-more-transparency-key-to-fighting-cybercrime-1.3692135). This encompasses the work that the NCSC does with EU multinational companies.

For all companies that handle the data of EU citizens, regardless of their physical location, GDPR [requires](https://gdpr-info.eu/art-12-gdpr/) controllers to communicate about their data processing methods in “transparent, intelligible and easily accessible form, using clear and plain language.” 

Along with these external pressures, leaders within organizations are pushing for change. Microsoft’s Cybersecurity Field CTO Diana Kelley is [developing the company's Trust Center,](https://www.techrepublic.com/article/microsofts-security-tactics-focus-on-customers-transparency-and-working-with-its-tech-competitors/) which clearly articulates for customers how Microsoft uses and secures their information. Microsoft shares its progress on data security at an annual meetup with peers like IBM, Netflix, and Facebook.

As national and global regulations — as well as peer pressure — heat up, it's imperative for teams to have a plan in place for intelligently sharing their cybersecurity practices.

## 3 Ways You Can Increase Your Team's Transparency (and Bolster Your Security)

While a handful of teams are vocal and forthcoming about cybersecurity measures, it still isn’t second nature for many. Here are three ways to increase your own transparency and bridge those trust gaps inside and outside your organization. 

### 1. STRENGTHEN EMPLOYEE TRAINING.

->![Board meeting and presentation in office environment](https://images.ctfassets.net/23aumh6u8s0i/6LSX6AUWhE4xE1cr9L1vWw/40d3e18f90887e5f1a79339704b4e720/board-meeting)<-

[_Image via Pexels_](https://www.pexels.com/photo/group-of-people-sitting-near-table-1181396/)

Remember, not everybody within your organization is a cybersecurity expert. According to the [University of Phoenix](https://www.phoenix.edu/about_us/media-center/news/uopx-survey-perceptions-cybersecurity.html), just 10% of U.S. adults are familiar with common cybersecurity job titles (e.g., penetration tester or chief information security officer). 52% of the survey’s respondents had never even heard of the titles.

True transparency isn’t just about giving people information; it’s also about ensuring that they understand it. Internally, you need to invest in thorough training across all departments so that employees are fully aware of what to watch out for and how to protect themselves.

While your colleagues are your greatest assets, they can also be your biggest liabilities when it comes to cybersecurity. In 2018, a [Positive Technologies study](https://www.techrepublic.com/article/dont-skimp-on-it-security-training-27-of-employees-fall-prey-to-phishing-attacks/) of 3,332 employees found that 27% of participants clicked on test emails with phishing links. With the 2018 cost of a data breach on the rise — ticking in at [$3.68 million](https://www.ibm.com/security/data-breach) (up 6.4% from 2017) — it’s critical that everyone on your team recognizes threats and has resources to immediately report incidents.

### 2. DEVELOP A DETAILED PROCESS FOR HOW YOU'LL DISCLOSE BREACHES.

Nobody likes to dwell on cybersecurity incidents actually happening, but it’s essential that you have a process in place for how and when you’ll [disclose a breach](https://auth0.com/blog/what-is-a-data-breach/) if it does occur. Ironing out this process now allows you to be more proactive and move forward in a timely manner. In particular, if you handle the data of EU citizens, you have just 72 hours to report a breach, [according to GDPR's new deadline](https://gdpr-info.eu/art-33-gdpr/).

Timing can be a delicate balancing act. While you don’t want to act too quickly and disclose a breach before you have all of the necessary details, waiting too long to make the event known can expose you to criticism. Public trust in [T-Mobile](https://auth0.com/blog/3-critical-lessons-from-the-t-mobile-data-breach/), [Equifax](https://money.cnn.com/2017/09/08/technology/equifax-hack-disclosure/index.html), and [the German government](https://www.telegraph.co.uk/news/2019/01/04/hundreds-german-politicians-hacked-massive-data-leak/)(to name a few) declined following delayed disclosure of data exposures.

If you don’t already have clear protocols for disclosure, it’s time to create them. Consider including:

* A deadline for when internal and external stakeholders will be made aware of the event
* What information you will share with the different parties
* Incorporating language that empowers users to take security into their own hands

As we highlighted in our prior dissection of the [Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), you can return power to users who are in a situation where they feel like victims by laying out the steps they can take to protect their personal information.

->![Reddit Data Breach notice to users regarding 2FA and other security measures](https://images.ctfassets.net/23aumh6u8s0i/77n70IUdObd3KDLcqbQEWF/b120ee596c3faf6b6c914b6ae5fdac9d/reddit-data-breach)<-

[_Image Source: Reddit_](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)

While it might make you uneasy to be so upfront about your vulnerabilities, if you communicate the issue correctly, you can turn the risk into an asset by retaining and even bolstering user trust. 

### 3. IMPLEMENT A STRONGER USER MANAGEMENT SYSTEM.

One of the biggest barriers to transparency in corporate cybersecurity is that, even for IT staff, it can be difficult to understand who is working within their system. With a range of permissions granted to customers, employees, and third parties, such as consultants — it's easy to lose track of your users.

Implementing a system like [Auth0](https://auth0.com/) can help you keep all of your users at a given time in one central view. 

->![Auth0 Dashboard view](https://images.ctfassets.net/23aumh6u8s0i/01LwCh4Yy7Tk0LdhNxgxG8/7d2a6efdfb8b4c12093076b1e00b5140/auth0-dashboard)<-

Here, admins can monitor login activity, compare it with activity over time, and quickly note and take action on any unusual behaviors like multiple failed login attempts. Having a clear record improves your ability to demonstrate your practices both internally and externally.

## More Transparency Leads to Better Security

When talking about cybersecurity, it’s usually new technologies that get the majority of the spotlight. Yet simple fixes, like increasing your level of transparency, is are also fundamental to progress. If implemented correctly, transparency practices can lead to improved security and, as an added bonus, increased trust with your stakeholders. 

[Working with Auth0](https://auth0.com/) is one way that teams choose to boost their knowledge and ability to share information about cybersecurity. Auth0 is a trusted partner with thousands of enterprise customers across industries, giving teams and their end users added peace of mind in turbulent times.

<include src="asides/AboutAuth0" />


Cybersecurity Shouldn’t Be a Secret: Why Transparency Matters

Business can continue, but Auth0 identity can help reduce the GDPR-induced strain.



>_UPDATE Aug. 21, 2019:  [Waiting to see if Britain's new Prime Minister Boris Johnson can pull off Brexit](https://auth0.com/blog/how-iam-prepares-you-for-brexit-deal-or-no-deal/), leaves many companies facing technical uncertainties. Auth0 is closely monitoring the ongoing developments between the EU and the UK to ensure that Auth0 remains compliant with all applicable data processing laws, whatever the eventual outcome. We understand this is an anxious and uncertain time for many organisations and we are happy to answer any questions you might have on this going forward — just reach out to an [Auth0 resource](mailto: sales@auth0.com)._


Frustrated by indecision, thousands of people took to London's streets last Saturday, demanding a second Brexit referendum to "[put it to the people](https://www.npr.org/2019/03/23/706241418/march-in-london-demanding-a-second-brexit-vote-draws-huge-crowds)."

[Brexit could happen as late as May 22nd](https://www.ft.com/content/98ec4fc6-4c7d-11e9-bbc9-6917dce3dc62), in the unlikely event that British Parliament approves Prime Minister Theresea May's deal &mdash; or with a two-week extension on April 12th, if it doesn't. But even April isn't a hard deadline, with more than 120 MPs backing [an amendment in support of indicative voting](https://www.theguardian.com/politics/2019/mar/25/the-week-ahead-for-brexit-third-time-lucky-for-may) this week on options like leaving with no deal, a second referendum, or revoking Article 50 altogether.

"There are concerns that a no-deal Brexit could cripple traffic at border crossings and ports, as well as lead to shortages of food, medical supplies and other products now imported from elsewhere in the EU," reports the [Washington Post](https://www.washingtonpost.com/world/europe/the-latest-uks-may-has-personal-regret-over-brexit-bumps/2019/03/20/69deec5c-4b7e-11e9-8cfc-2c5d0999c21e_story.html?utm_term=.4e5262526ab3).

Alongside these very tangible dangers to daily life is the risk to data-driven technologies. In a recent report, Her Majesty's Treasury estimates that value at [£60 billion per year](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/731349/20180730_HMT_Discussion_Paper_-_The_Economic_Value_of_Data.pdf) to the UK economy by 2020.

What does all of this mean for companies and organizations doing business in and with the UK? We spoke with [Jonathan Keen, Associate General Counsel, Auth0](https://www.linkedin.com/in/jonathan-keen-6748a9143/) and [Chris Adriaensen, Solutions Engineering Lead, EMEA](https://www.linkedin.com/in/chrisadriaensen/) to get their insights.

<include src="TweetQuote" quoteText="What does Brexit mean for organizations doing business in the UK? We have your guide"/>

For data-driven companies (or any company with an app or website), the EU's General Data Protection Regulation (GDPR) spelled big changes in 2018, but the fact is that GDPR is actually an update and alignment of an existing network of data privacy laws. GDPR mandates that every EU member state offers at least the same (or better) level of data privacy protection to EU citizens. Countries deemed "adequate" can also freely move data across borders. Brexit raises concerns because it puts these adequacy rulings at risk for the UK.

![What does Breaxit mean for organizations doing business in the UK?](https://images.ctfassets.net/23aumh6u8s0i/3V93BWmVXIzZNUB20P80hz/57e41bf8e422b9e8b304c6750d6d6ab5/uk-may-be-leaving-the-eu)

[Source: [PixaBay](https://pixabay.com/illustrations/brexit-european-union-eu-1477615/)]

## Don’t Panic, Start Planning

"This is not the end of data protection transfers between the EU and the UK, says Jonathan, “First and foremost, companies shouldn’t panic, they should carefully analyze their data flows and identify operations that might be affected and how to address these. The UK has been operating within the GDPR framework for nearly a year now and its domestic legislative framework is unlikely to move away from the EU data protection regime, as this might hamper UK businesses ability to build and service a European customer base"

The Information Commissioner’s Office (ICO), the UK regulator for data protection, has already issued a statement confirming that even in the event of a no-deal Brexit, UK to EEA transfers of personal data will be permitted under UK law, as well as transfers from the UK to non-EEA countries who already benefit from an EU adequacy decision.

But this position has yet to be reciprocated by the EU.

“EEA to UK data transfers would be treated as if they were transfers to ‘third parties’ for GDPR purposes and require a valid GDPR transfer mechanism, such as Standard Contractual Clauses (SCCs). This would be an inconvenience and administrative burden for the businesses affected, but is by no means a show-stopper,” he says.

<include src="TweetQuote" quoteText="Don't panic, start planning. Your guide to Brexit and how IAM can help"/>

## Data Processing Center Location Matters

Since the UK faces significant challenges under a no-deal, altering a system seems unlikely. “In the medium-to-long term, it makes little sense for the UK to back away from the GDPR requirements to any significant degree, as it would handicap UK businesses’ ability to generate and support a European customer base,” he says.

What does matter, is the location of a company’s cloud provider, says Jonathan. “Cloud providers with processing centers in Europe will have a distinct advantage, regardless of how Brexit plays out.”

## Future-Proofing for Data Protection

Even though businesses move at a faster pace than most governments, they still need to plan to remain ahead of global privacy developments. "The interconnectivity and influence of modern technology have rightly elevated data protection and cybersecurity to the top of the legislative and enforcement agenda for national governments and regulators all over the globe," says Jonathan.

Expressing these regulations on a practical level isn't new says Chris Adriaensen, Solutions Engineering Lead, EMEA. "Security best practices have always existed, but GDPR enforces them. Compliance concerns are prompting companies to invest in identity management. From a technology perspective, identity and access management (IAM) helps companies address GDPR in three ways: consent management, transparency and control, and security best practices."

Data privacy, like business, is an [increasingly global](https://auth0.com/blog/data-privacy-2019-the-lowdown/) challenge &mdash; all signs suggest that regulations are going to increase rather than diminish as technology continues to develop. "Companies can consider state of the art and costs of implementation when making technology decisions, but the fact remains that building and maintaining appropriate security measures in-house is a heavy exercise. Rather than straining internal resources, they are better off using a live IAM platform that's continually updated and tested by security experts."

If you'd like to learn more about how Auth0's IAM solution can help lighten your data privacy and security load, please reach out to an [Auth0 resource](mailto: sales@auth0.com).

_EDITOR’S NOTE: [McKenzie Mayer](https://www.linkedin.com/in/mckenziemayer/) contributed to this post._


How IAM Prepares You for Brexit - Deal or No-deal

How we helped a group of Girl Scouts get their cybersecurity badges (and become cyberheroes)!



![Auth0 Support Operations Manager Abigail Sanchez showing Scout Sign Salute with badges of Scout accomplishments](https://images.ctfassets.net/23aumh6u8s0i/5RlTmkCFXiRV2hHRMSyWEr/7768c98a93aa957bb351fd29115d66b8/auth0-girl-scout)

_Gold Girl Scout, Troop Leader, and Auth0 Support Operations Manager Abigail Sanchez displaying a few of her many scout accomplishments._

Girl Scouts can earn cybersecurity badges! After learning about some scouts who got theirs with the help of the [University of Alabama](https://www.uah.edu/news/campus/girl-scouts-get-head-start-on-cybersecurity-training-at-uah-s-ccre), we put out an all-call on Slack to see if anyone knew of a troop that might want some help from Auth0. Turns out that one of our own, Support Operations Manager Abigail Sanchez is not only a troop leader but also a Gold Girl Scout (the male equivalent would be an Eagle Scout) with 25 years of scouting experience.

## Girl Scouts as Tech Career Prep

Crediting Girl Scouts with helping her succeed in tech, Abigail agreed to bring in her troop and tell us about how her scouting experience laid the groundwork for her career.

“There's a lot of stuff that I feel like I sneakily learned through Girl Scouts,” says Abigail, noting that the project proposal like the one she wrote to become a Gold Scout is something she’s continued to prepare throughout her career. Scout gatherings similarly prepared her for her first professional conferences through familiarity, making her comfortable picking which sessions to attend, as well as being prepared for awful hotel food.

Alongside seeing examples of women running events for “hundreds” of scouts at all-girl events, the exposure made a difference. Scouts also took Abigail to various career events. “They would have sessions about being a scientist or working on computers. And those were right alongside being a teacher or a nurse or the stereotypical female careers. So again, it just never occurred to me that it was any different. It just kind of broke down that barrier, and that's what I'm really hoping to do with my girls.”

Scouts helped build self-confidence that withstood a 3-to-1 male-to-female ratio in schools and early career moments “when it seemed like my male counterparts were surprised when I did things correctly.”

Auth0 and Girl Scouts share similar values, says Abigail. “Girl Scouts is famous for not excluding any female. They are very clear about that and they stand by that. Any religion, any sexual orientation, or physical anatomy, whatever. If you identify as a woman, you are welcome in Girl Scouts. I feel like Auth0 is the same way, very inclusive We are heavily male, but we come from lots of different countries and, like Girl Scouts, we share the belief that that diversity is what makes us strong.”

Every day, Abigail thinks about the Girl Scout Promise (updated since her mother was a girl scout): “On my honor, I will try.” This idea of not giving up, of trying and experimenting, is also expressed daily at Auth0 along with the Scout value of responsibility, Abigail says. “You're going to try, and you might fail, and that's good, and you move on, but you're responsible for what you say and do. And you know, I think that goes with the Auth0 value of being transparent and being respectful with people.”

Working with Abigail’s Girl Scout troop, we had several goals given that we're catching these girls probably before they've ever created their own password. “I'm just hoping that we're going to instill some actual practical things that are going to keep them safe. But on a grander scheme, I want them to have that same kind of feeling that I did, that any of these jobs are possible for them. I'm hoping with both Girl Scouts and this specific experience of going to Auth0 to see those values in action.”

<include src="TweetQuote" quoteText="\"[Girl Scouts] would have sessions about being a scientist or working on computers…It just kind of broke down that barrier, and that's what I'm really hoping to do with my girls,\" says @auth0 @abdeansan"/>

### Want to run your own company?

![Auth0 CEO Eugenio Pace speaking to girl scouts on International Women’s Day](https://images.ctfassets.net/23aumh6u8s0i/5asttyjxGLpm8vxSEPmnn0/708999d164c7929189ce1c840d2b69ca/ceo-meeting)

_How would you define CEO?_

On International Women’s Day, Auth0 CEO and co-founder Eugenio Pace explained what we do here at Auth0 and led the girls through an exploration of how a CEO spends his or her time by guessing at the meaning of each letter in the acronym (our favorites: Caring Elf Operations and Community Emergency Octopus).

During the session, co-founder and CTO Matias Woloski dropped by to ask the girls if any of them wanted to start their own company as he and Eugenio did. Girl Scout Charlie explained that she did, but unlike Eugenio and Matias, she didn’t want to start it with a friend, she wanted to start a video game company with her father.

### ‘Cybersafe Camp’ lays the groundwork

![Auth0 Security Operations Manager Annybell Villarroel dialed into call for Cybersafe Camp](https://images.ctfassets.net/23aumh6u8s0i/5eFbPv73godgpAonShvYdN/968d4bf3e661c011f7ecfe70831f186c/annybell-villarroel-zoom)

_Security Operations Manager Annybell Villarroel logs on at 1:00AM Madrid time._

[Since 80% of people 18 and older reuse passwords](https://mashable.com/2017/02/28/passwords-reuse-study-keeper-security/#z8XBGqVc38qF), we figured making the idea of password hygiene concrete might be a good place to start. But first Security Operations Manager [Annybell Villarroel](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/) signed on via Zoom from Madrid, Spain, giving the girls a feel for what it is like to work for a globally distributed company. Annybell’s “Cybersafe Camp” interactive presentation  inspired understanding with examples from [Ralph Breaks the Internet](https://www.imdb.com/title/tt5848272/) and tales of her own security heroes (like Google’s Security Princess Parisa Tabriz) as well as a detailed list of items the girls should protect like:

* Pictures
* Home Address
* Where you go to school
* Your hobbies and other activities
* Your parent’s name, phone number, credit card number

### Forming strong password habits with eggs

![Auth0 employee assists Scouts in the egg drop exercise](https://images.ctfassets.net/23aumh6u8s0i/4UA20F0vpgtXSyC5gxGoPK/a9799aca834232a7cd0b792e16e5d0f9/egg-drop)

_Adding the last layer of security._

As mentioned earlier, password habits are rough for adults, so we decided to make the risks concrete with some eggs, newspaper, bubble wrap, boxes, and gravity.

While Abigail explained the need to protect your secret password, the girls decorated eggs to represent their unique identity. They wrapped the eggs in bubble wrap and newspaper, then put them in takeout cartons, and sealed them with tape. We then very carefully moved to the kitchen to see if their unique identities would be properly protected against an attack by the hacker gravity.

“If the egg breaks, hackers get the information which is the egg yolk,” explained Girl Scout Natalie.

![Girl Scouts lined up for the egg drop exercise](https://images.ctfassets.net/23aumh6u8s0i/1TuWAcg9eW8fw3VKpY0Fzq/4942b3796e2058ef48bdb28bf6a15bfb/protected-eggs)

_Just before testing the strength of the egg passwords._

<include src="TweetQuote" quoteText="If the egg breaks, hackers get the information which is the egg yolk, explained Girl Scout Natalie (speaking about the Auth0 identity egg exercise)."/>

![Dropping the protected eggs afterwards photo](https://images.ctfassets.net/23aumh6u8s0i/7byrbUMb8OJbMeVNtM0R0g/c259d4eee638994f1ca387ddc6a9b5cd/testing-the-eggs)

_The passwords appear secure, but are they?_

Not every egg made it. Some Scouts lowered risk by not dropping at all — essentially avoiding the internet altogether. Eggs fall every day in the form of hack attacks and breaches. Choosing to avoid certain sites makes sense for safety, with precautions, the girls (and all of us) should be able to safely navigate the interwebs.

![Scouts showing off the eggs that were protected in egg drop exercise](https://images.ctfassets.net/23aumh6u8s0i/1zZ8KRpwqOn7jcz2t29rDN/07286c66005a89576a5c8249b66dd215/eggs-that-survived)

_But several egg passwords survived!_

![Scouts showing off more eggs that survived](https://images.ctfassets.net/23aumh6u8s0i/7JRea8AmdVjX2DxItfcghH/273167f9c764844b502f1085b8f0d6b7/more-protected-eggs)

_These egg passwords also held strong!_

### Hacker understanding achieved!

![Scouts playing telephone message-passing game](https://images.ctfassets.net/23aumh6u8s0i/13L1L7yF2FmYIoAGZLzIu1/35abeb6e4f2990cc478fe59bae10f2a1/telephone-game)

Maybe you remember the old game of telephone, where you try to whisper a message and keep it from changing as it gets passed around the room? Well, we played this game to show how computers are connected and demonstrate how the girls might recognize social engineering if the messages changed or started in unusual ways (Natalie usually sends a heart emoji to Charlie, but this time she sends a spider and Natalie doesn’t like spiders).

After a few rounds of playing computers passing along the message, the girls quickly realized how easy it was for the information to change by “hacking” it with a few words.

![Scout Troop leaders and the Troop doing Scout Sign, three-finger salute](https://images.ctfassets.net/23aumh6u8s0i/1IBJCnzZlqoT0TxbToOcYy/38f785e3703f229570978bc71cb84791/troop-leaders-and-group)

_Troop Leaders Candace Scairpon (left) and Abigail Sanchez (second from right) with the group!_

We wrapped the day with a photo opp. On the way home, the girls were overheard explaining the difference between malicious hackers and ethical hackers. Initial cybersecurity install successfully completed!

_Would you like Auth0 to help your Girl Scout troop get their cybersecurity badges? Please reach out to abigail.sanchez@auth0.com._

<include src="asides/AboutAuth0" />

---


Auth0 Cybersafe Camp

Email addresses, passport numbers, and credit card information included in stolen data.



_Update: Marriott now says the breach wasn’t as bad as originally reported, lowering the victim number to [383 million](https://www.bankinfosecurity.com/marriot-mega-breach-victim-count-drops-to-383-million-a-11916)._

What can you do if you’re one of the 500 million [Marriott International Inc.](https://www.bloomberg.com/quote/MAR:US) guests affected by the massive data breach announced today? According to the company’s [announcement](https://answers.kroll.com/), the breach affects guests who stayed at the Marriott’s Starwood properties from 2014 through Sept. 10, 2018. For approximately 327 million of impacted guests, Marriott says the breached information includes some combination of:

- Mailing address
- Phone number
- Email address
- Starwood Preferred Guest (“SPG”) account information
- Birthdate
- Gender
- Arrival and departure information
- Reservation date
- Communication preferences.

Credit and debit card numbers were also included in the breach. While Marriott notes this information was encrypted according to the AES-128 standard, they do not yet know if the components required to decrypt these numbers have been compromised.

![Marriot's Starwood Property](https://images.ctfassets.net/23aumh6u8s0i/7LRWHLzMk1XQxnM9cWpnKJ/9f47c148a148fa5af76cfe857598b83c/marriot-starwood-data-breach)

[Source: [Wikimedia](https://commons.wikimedia.org/wiki/File:Guam_Marriott_Resort_%26_Spa.JPG)]

## 5 Steps to Protect your Data After This Breach

If you’ve made a reservation at a Starwood property in the last four years (this includes Sheraton, Westin, Four Points, [many other brands](https://answers.kroll.com/), and Starwood-branded timeshares), take these steps to minimize your exposure:

1. **Change your password.** This should be your default response to the news of any hack that might involve your information. If you use the same password in multiple places, be sure to change your password everywhere.

2. **Implement Multi-factor Authentication (MFA).** A breached password is only useful if malicious actors can use it. A second step of authentication, like a code sent via SMS to your phone, can render that breached password useless (but you should still change your password).

3. **Monitor your accounts.** Marriott’s system was compromised for an extended period of time. Check your accounts weekly.

4. **Consider freezing your credit.** You can put a credit hold on your accounts, but in most U.S. states, the hold remains permanent until you request a thaw. This [guide from NerdWallet](https://www.nerdwallet.com/blog/finance/pros-and-cons-freezing-credit/) provides more details.

5. **Watch out for phishing attempts.** “Phishing attempts can be more credible when someone has access to actual personal details,” says Auth0 Principal Security Engineer Emory Lundberg. This hack includes data that could make social engineering attempts easier. For more advice on avoiding phishing attempts, check out this [post](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/) by Annybell Villarroel, Auth0 Security Operations Manager.

![Steps After A Data Breach](https://images.ctfassets.net/23aumh6u8s0i/6k5RKe4zh50H8BrRaPqQC2/ad318219be99cf9089a470a643ef7d5e/security-after-data-breach)

[Source: [PixaBay](https://pixabay.com/en/photos/cyber%20security/?)]

## Marriot's Data Breach Response Plan

In addition, Marriott has taken the following steps to help guests monitor and protect their information:

**Dedicated Call Center**

Marriott has established a dedicated call center to answer questions you may have about this incident. The call center is open seven days a week and is available in multiple languages. Our dedicated call center may experience high call volume initially, and we appreciate your patience.

**Email Notification**

Marriott began sending emails on a rolling basis on November 30, 2018 to affected guests whose email addresses are in the Starwood guest reservation database.

**Free WebWatcher Enrollment**

Marriott is providing guests the opportunity to enroll in WebWatcher free of charge for one year. WebWatcher monitors internet sites where personal information is shared and generates an alert to the consumer if evidence of the consumer’s personal information is found. Due to regulatory and other reasons, WebWatcher or similar products are not available in all countries. Guests from the United States who complete the WebWatcher enrollment process will also be provided fraud consultation services and reimbursement coverage for free. Click on your country, if listed, to begin the enrollment process.

<include src="asides/AboutAuth0" />

---


Marriott's Starwood Data Breach - 5 Steps to Protect your Data

davide-barbato

Security is a mindset. It's something that goes beyond IT and working hours. In Auth0 I've found a community of people who live and breath security, who are passionate about it and are self-motivated to grow and make an impact — exactly as I am.

Security Engineer

Davide Barbato

Discover how AWS communicates the creation of S3 buckets and the implications of relaxed permissions.

Fantastic! Public S3 Buckets and How to Find Them

How the economy, kubernetes vulnerabilities, and consumer complacency could equal more regulation.



Some argue that the [_number of reported data breaches in 2018_](https://www.forbes.com/sites/kateoflahertyuk/2018/12/19/breaking-down-five-2018-breaches-and-what-they-mean-for-security-in-2019/#735992841c4f) is the result of [_GDPR_](https://auth0.com/gdpr/)’s requirements. Still, the cascade of recent breach reports suggests that 2019 might be a tough year for cybersecurity. I asked our [_CISO/VP of Operations Joan Pepin_](https://www.linkedin.com/in/joanpepin/) and [_Security & Engineering Operations Director Duncan Godfrey_](https://twitter.com/duncangodfrey) about what we might expect.

<include src="TweetQuote" quoteText=".@auth0’s @CloudCISO_Joan and Security & Ops Eng. Dir. @duncangodfrey share their Top 5 Cybersecurity Predictions for 2019."/>

![Reduced Security Spend Will Lead to Economically Motivated Cybercrime](https://images.ctfassets.net/23aumh6u8s0i/45sm4mVBhnx0sbpZGkzhUg/fd99c7aaa6f3e407989cca122cc6ddd7/reduced-security-spending)

## 1. Reduced Security Spend Will Lead to Economically Motivated Cybercrime

[_Economic indicators in the US and globally do not look good_](https://www.theguardian.com/business/2018/sep/13/recession-2020-financial-crisis-nouriel-roubini), with tech companies having borne the brunt of recent market corrections, says Auth0 CISO/VP of Operations Joan Pepin. “I predict that 2019 will be a difficult year for security funding, and companies across the spectrum will freeze or reduce Information Security spending. An increase in economic hardship and a reduced defensive posture will therefore probably lead to more economically motivated cybercrime in 2019.”

![Information Warfare Around the Globe](https://images.ctfassets.net/23aumh6u8s0i/1Cug9bge9KqWfBDXABTtkq/80a2b903b524834e70397a3a4489972e/information-warfare-around-the-world)

## 2. Information Warfare to Target U.S. Companies, Specifically Defense and Communications

“[_We may be entering a new cold war with China_](https://www.washingtonpost.com/opinions/the-us-and-china-are-on-the-brink-of-cold-war-20-this-is-how-to-avoid-it/2018/11/29/24105fb6-f409-11e8-aeea-b85fd44449f5_story.html), as the trade war continues, now inflamed by actions taken against Huawei by Canada and the US,” says Joan. “I expect this to lead to increased cyber activity by the already rather active Chinese government, which may expand its operations to include more Russian-style disinformation and [_information warfare_](https://auth0.com/blog/information-warfare-offensive/). Look for major U.S. companies, especially large defense and communications providers to be the targets of this activity in 2019.”

![Kubernetes Vulnerabilities Lead to the Year of the Big Container Escape](https://images.ctfassets.net/23aumh6u8s0i/PNPKw8C7NEczARd71Ypg4/e46d0c07b0a306f2093ad3605ee4339e/kubernetes-vulnerabilities)

## 3. Kubernetes Vulnerabilities Lead to the Year of the ‘Big Container Escape’

When [_ZDNet reported a major security vulnerability with Kubernetes containers_](https://www.zdnet.com/article/kubernetes-first-major-security-hole-discovered/) early in December 2018, they noted that “[_Kubernetes_](https://kubernetes.io/) has become the most popular cloud container orchestration system by far, so it was only a matter of time until its first major security hole was discovered.”

That nothing in software is perfect is accepted news for devs and enterprises, but it’s also becoming an accepted thing for consumers (see prediction #4).

The Kubernetes privilege escalation flaw is a big deal, but it’s only the latest in the system’s [_discovered flaws_](https://www.twistlock.com/labs-blog/deep-dive-severe-kubernetes-vulnerability-date-cve-2017-1002101/), says Auth0 Security & Engineering Operations Director Duncan Godfrey. “Continued vulnerabilities to be found in Kubernetes infrastructure and the big one in 2019 is the Year of the Container Escape.”

![Cybercrime Accepted as Cost of Doing Business by Consumers](https://images.ctfassets.net/23aumh6u8s0i/foaom10ipH3jQBufHbbSc/c38ec328a63d0cc4ad50eb0a20639441/cybercrime-accepted-as-cost-of-doing-business)

## 4. Cybercrime Accepted as ‘Cost of Doing Business’ by Consumers

Despite multiple open investigations into [_Facebook’s series of breaches and sharing of personal data with other corporations without users’ permission_](https://www.nytimes.com/2018/12/18/technology/facebook-privacy.html), Joan doesn’t predict a permanent impact for the company — because consumers are reacting more like businesses (and Facebook’s attorneys will do their jobs).

Joan offered an example from her years as an outsourced security provider for an incident response company for Fortune 100 and Fortune 500 companies.

A major investment bank was having a massive issue of being dossed and having public-facing servers being breached. While on a conference call with all their vendors, including Cisco and Checkpoint and 30 bank vice presidents, the bank’s CTO said he had one question: “Is this happening to anybody else?”

Before Joan answered, she asked if he was going to divert the team to answer the question and if the answer was “yes,” what did he plan to do differently? He said if the answer was “yes,” he would “feel better” — a prime example of an enterprise settling into the cost of doing business online (although whether or not he needed to accept that particular cost could be debated).

“Having your identity stolen is horrifying for the individual, but my observation is that it’s perceived differently when lots of people are affected. After a breach, people don’t change their habits. People still shop at Target, stay at Marriott, and share information on Facebook. I’m not a psychologist or neuroscientist, but these facts lead me to believe that the trend of consumers accepting cybercrime as a cost of being online will continue into 2019.”

Because companies are not economically motivated to change and consumers may not feel empowered (let’s face it, [_the tiny payout from a class-action lawsuit_](https://www.consumerreports.org/data-theft/class-action-lawsuits-against-marriott-data-breach/) won’t pay for the damage and heartache of having your identity stolen), Joan expects regulators to step in, which leads us to Prediction #5.

![Expect More Data Privacy Regulation in 2019](https://images.ctfassets.net/23aumh6u8s0i/3rJMQ4kQiwVdRbwXuyouCj/dac8b3d32b2c2c2e3cba383fd02dba10/more-data-privacy-regulation)

## 5. Expect More Data Privacy Regulation

Shortly after the [_Marriott Mega Breach_](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/), the [_UK, the FBI, and three U.S. states opened investigations_](https://www.forbes.com/sites/thomasbrewster/2018/12/03/revealed-marriotts-500-million-hack-came-after-a-string-of-security-breaches/#13788844546f). The Marriott stock dip identified in many news stories, parallels that of the U.S. stock market, says Joan. Fines can function as a partial deterrent, but investigation and regulation move at a much slower pace than the agile tech lifecycle — the business consequence often lags far behind the technological changes needed.

GDPR is delivering an increase in reported breaches, but not clearly within the regulation’s [_72-hour breach-reporting requirements_](https://www.cnbc.com/2018/10/02/facebooks-muddy-account-breach-response-could-be-the-new-norm.html) and recent regulation in Australia demonstrates more than a sync problem — the way that [_Australia’s new backdoor requirements_](https://www.wired.com/story/australia-encryption-law-global-impact/) are written cripple tech’s ability to function securely, says Joan. [_Recent U.S. Senate hearings_](https://thehill.com/policy/technology/420838-google-ceo-responds-to-steve-king-concerns-about-granddaughters-iphone) demonstrate that many of the legislators in charge of regulating tech require greater understanding and education.

The answer, says Joan, would be for the tech industry to have greater input into educating those in charge of the regulations, followed by rational debate, and empowered law enforcement.

Regardless of whether or not the tech industry can influence these ideal conditions, [_all signs suggest we should expect greater regulation in the U.S. in 2019_](https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/12/03/the-cybersecurity-202-senators-call-for-data-breach-penalties-tougher-privacy-laws-after-marriott-hack/5c0436431b326b60d12800d2/?utm_term=.e0c757791fde).

<include src="TweetQuote" quoteText="The economy, kubernetes vulnerabilities, and consumer complacency could equal more regulation in 2019 says CloudCISO_Joan and Security & Ops Eng. Dir. @duncangodfrey."/>

<include src="asides/AboutAuth0" />


Top 5 Cybersecurity Predictions for 2019

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Our 10 most-popular security posts in 2018 ranging from data breaches to web app security.



Time flies when you are having fun. It's December already and we are getting ready to wrap up this year. 2018 was a prolific year for the Auth0 blog: we published more than 200 posts (😱) where we tackled a diverse amount of topics: frontend and backend technologies, data breaches, GDPR, Cybersecurity, Company Culture, and of course, Identity.

We believe looking back is key to look ahead. That is why this week, we are going to take a look back at the best and most impactful posts we have published in 2018.

One article wouldn't be enough to review this amazing year, that's why we have decided to split this year in review into 3 parts: [Developer Posts](https://auth0.com/blog/10-most-popular-developer-posts-in-2018/), Security Posts, and [Identity Posts](https://auth0.com/blog/10-most-popular-identity-posts-in-2018/).

Without much further ado, here's the roundup of our 10 most-popular security posts this year!

![Auth0's 10 Most-Popular Security Posts](https://images.ctfassets.net/23aumh6u8s0i/1gOT6LQG6E1TXpvELyWTGL/0af21ef35249f2847e8808be29ec5532/security-posts)

## Auth0's 10 Most-Popular Security Posts in 2018

> The following posts are not listed in any particular order.

1. <a href="#what-is-data-security" target="_self">What is Data Security?</a>
2. <a href="#security-risk-20-billion-iot-devices-by-2020" target="_self">Security Risk: 20+ Billion IoT Devices by 2020</a>
3. <a href="#4-tools-to-improve-your-teams-threat-intelligence" target="_self">4 Tools To Improve Your Team's Threat Intelligence</a>
4. <a href="#common-threats-in-web-application-security" target="_self">Common Threats in Web Application Security</a>
5. <a href="#why-customer-identity-and-access-management-is-critical-to-digital-success" target="_self">Why Customer Identity and Access Management is Critical to Digital Success</a>
6. <a href="#cloud-scale-thinking-from-day-one-for-your-saas-products" target="_self">Cloud-Scale Thinking from Day One for Your SaaS Products</a>
7. <a href="#what-is-a-data-breach" target="_self">What is a Data Breach?</a>
8. <a href="#a-tour-through-the-owasp-top-10" target="_self">A Tour Through the OWASP Top 10</a>
9. <a href="#how-two-factor-authentication-2fa-can-help-financial-institutions-reduce-data-breaches" target="_self">How Two-Factor Authentication (2FA) Can Help Financial Institutions Reduce Data Breaches</a>
10. <a href="#brace-yourself-the-gdpr-ripple-effect-in-california" target="_self">Brace Yourself: The GDPR Ripple Effect in California</a>

## <a name="what-is-data-security"></a>1. [What is Data Security?](https://auth0.com/blog/what-is-data-security/)

What is data security and why it's so important? we've made this article to get you thinking about the definition of data security in the corporate world — and what it means for your team today.

<include src="ClickImg" externalUrl="https://auth0.com/blog/what-is-data-security/" imgUrl="https://cdn.auth0.com/blog/what-is-data-security/google-authenticator.png" altText="Google Authenticator 2FA on WordPress login" imgHeight="405" imgWidth="616"/>

## <a name="security-risk-20-billion-iot-devices-by-2020"></a>2. [Security Risk: 20+ Billion IoT Devices by 2020](https://auth0.com/blog/security-risk-20-plus-billion-iot-devices-by-2020/)

Unprotected IoT devices can make it easy for bad actors to cause global damage—botnets increased 140% last year. Gartner analysts predict more than 20 billion connected things will be in use by 2020. Is the world ready for IoT? 

<include src="ClickImg" externalUrl="https://auth0.com/blog/security-risk-20-plus-billion-iot-devices-by-2020/" imgUrl="https://cdn.auth0.com/blog/security-risk-iot/myfitnesspall-breach.png" altText="MyFitnessPal Data Breach" imgHeight="511" imgWidth="1146"/>

## <a name="4-tools-to-improve-your-teams-threat-intelligence"></a>3. [4 Tools To Improve Your Team's Threat Intelligence](https://auth0.com/blog/4-tools-for-threat-intelligence/)

Four tools to help you cut through the noise, quickly figure out where to focus your energy, and actively respond to suspicious behavior.

<include src="ClickImg" externalUrl="https://auth0.com/blog/4-tools-for-threat-intelligence/" imgUrl="https://cdn.auth0.com/blog/threat-intelligence/1-fireeye.png" altText="FireEye Threat Analytics Platform" imgWidth="849" imgHeight="321"/>

## <a name="common-threats-in-web-application-security"></a>4. [Common Threats in Web Application Security](https://auth0.com/blog/common-threats-in-web-app-security/)

In this article we'll attempt to cover a comprehensive security strategy for web applications to protect against common threats in web application security and mitigate their impact.

<include src="ClickImg" externalUrl="https://auth0.com/blog/common-threats-in-web-app-security/" imgUrl="https://cdn.auth0.com/blog/common-threats-in-web-app-security/x-xss-protection-browser-compatibility-table.png" altText="X-XSS-Protection browser compatibility table" imgWidth="2400" imgHeight="1394"/>

## <a name="why-customer-identity-and-access-management-is-critical-to-digital-success"></a>5. [Why Customer Identity and Access Management is Critical to Digital Success](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/)

Going through a digital transformation? Maintaining continuous customer engagement throughout this challenging process can help keep sales on track. This article explains how Customer Identity and Access Management can help.

<include src="ClickImg" externalUrl="https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/" imgUrl="https://cdn.auth0.com/blog/ciam/logins.png" altText="Building rich customer profiles, a single view with a CIAM system" imgWidth="1016" imgHeight="1006"/>

## <a name="cloud-scale-thinking-from-day-one-for-your-saas-products"></a>6. [Cloud-Scale Thinking from Day One for Your SaaS Products](https://auth0.com/blog/cloud-scale-thinking-from-day-one-for-your-saas-products/)

Explore some of the key technical considerations you have to make while building highly-scalable SaaS products. Learn how to use reliable PaaS (Platform as a Service) vendors available in the market instead of utilizing your valuable engineering resources on infrastructure requirements and make your engineers available to focus on what matters the most, the key features of your project.

<include src="ClickImg" externalUrl="https://auth0.com/blog/cloud-scale-thinking-from-day-one-for-your-saas-products/" imgUrl="https://cdn.auth0.com/website/assets/pages/dashboard/img/p-dashboard-6fc11ba51b.png" altText="Managing Identity with Auth0" imgWidth="3333" imgHeight="1842"/>

## <a name="what-is-a-data-breach"></a>7. [What is a Data Breach?](https://auth0.com/blog/what-is-a-data-breach/)

This piece breaks down the new meaning of data leak in today's complex threat environment.

<include src="ClickImg" externalUrl="https://auth0.com/blog/what-is-a-data-breach/" imgUrl="https://cdn.auth0.com/blog/data-breaches/average-financial-loss.jpg" altText="Chart showing average financial loss of a data breach - U.S. avg. is $7.91 million per incident" imgWidth="960" imgHeight="684"/>

## <a name="a-tour-through-the-owasp-top-10"></a>8. [A Tour Through the OWASP Top 10](https://auth0.com/blog/a-run-through-the-owasp-top-10/)

Let's take a run through the OWASP Top 10 looking at the threats and what we could be doing to make sure our own applications are secure, and examine features of the Auth0 platform that help to mitigate or entirely remove such threats from your concern.

<include src="ClickImg" externalUrl="https://auth0.com/blog/a-run-through-the-owasp-top-10/" imgUrl="https://cdn.auth0.com/blog/owasp:logo.jpeg" altText="The Top 10 Application Security Risks" imgWidth="1600" imgHeight="907"/>

## <a name="how-two-factor-authentication-2fa-can-help-financial-institutions-reduce-data-breaches"></a>9. [How Two-Factor Authentication (2FA) Can Help Financial Institutions Reduce Data Breaches](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/)

Two-factor authentication or 2FA adds an additional step to the process. Like a double security door — if a thief unlocks the first one, he's blocked by another. Learn how 2FA can help Financial Institutions reduce Data Breaches.

<include src="ClickImg" externalUrl="https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/" imgUrl="https://cdn.auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/google-authenticator-balances-clarity-capability-design.jpg" altText="Google Authenticator balances clarity, capability, and design" imgWidth="620" imgHeight="460"/>

## <a name="brace-yourself-the-gdpr-ripple-effect-in-california"></a>10. [Brace Yourself: The GDPR Ripple Effect in California](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/)

2018 was the year that the General Data Protection Regulation (GDPR) finally kicked in. While the GDPR is EU-centric, several countries and states in the U.S. have followed suit with similar privacy initiatives, like the CCPA (California Consumer Privacy Act).

<include src="ClickImg" externalUrl="https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/" imgUrl="https://cdn.auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/everlane-changes-privacy-policy-making-it-easier-to-understand.png" altText="Everlane changes its privacy policy making it easier to understand" imgWidth="768" imgHeight="703"/>

## <a name="WhatsNex"></a>What's Next?

We are already preparing our content pipeline for 2019. Digital privacy and cybersecurity are areas that keep evolving as they are challenged by data breaches, vulnerabilities, and sociopolitical policies. We are committed to keep our blog in sync this constant evolution. 

We'd like to take this opportunity to thank all of our readers for their consistent support and feedback. Is there anything that you'd like us to cover in 2019? Any particular security or business trend or topic? Please let us know in the comments below or through social media ([Twitter](https://twitter.com/auth0), [LinkedIn](https://www.linkedin.com/company/auth0)). As always, you can subscribe to our newsletter to receive a weekly digest of our blog content.

Happy Holiday Season!

<include src="asides/AboutAuth0" />


10 Most-Popular Security Posts in 2018

Implement MFA, store minimal information, and take employee cybersecurity training seriously to minimize data breach risk.


The holiday season is the biggest shopping time of the year, and for that reason, it's also the most popular time of year for cybercriminals. 

If you’re a [retailer](https://auth0.com/retail), it's on you to ensure that your customers' data is safe. [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) hurt your customers and they hurt your reputation. 

With this post, we show retail teams how Auth0 can help them keep customers safe with three actionable tactics. 

While these strategies are critical during the holidays, they're also highly applicable throughout the year. Teams that take security seriously are those that will safely scale and thrive in 2019 and beyond.

## 1. Implement Multi-Factor Authentication

With data breaches of retailers on the upswing in 2018 — including ones at [Macy's](http://fortune.com/2018/07/11/macys-data-breach/)  and [Adidas](https://www.newsweek.com/adidas-breach-hack-us-website-customers-warned-their-data-has-been-hacked-1000974) — teams clearly need extra support. [Multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) delivers this. Implementing it correctly can make a huge difference in how secure your customers’ accounts are. 

MFA ensures that even if a data breach does occur and passwords are leaked, hackers still can't get into customer accounts. To do so, they need a second piece of sensitive information, like a customer's thumbprint, facial features, or mobile device.

With [Auth0 Guardian](https://auth0.com/multifactor-authentication), you can add MFA to your site simply and securely.

![Multifactor Authentication (MFA) with Auth0 Guardian](https://images.ctfassets.net/23aumh6u8s0i/4x4BhKDZLXWTlScCGVZ5B6/a53550e45f8a7d895b8ac2ae251c5a6d/multifactor-authentication-with-auth0-guardian.png))

After [installation](https://auth0.com/docs/multifactor-authentication/factors/push), retailers can easily switch on MFA push notifications. For your employees, it is a quick double-check that they are who they say they are (and that they can access sensitive customer data for work purposes). For your customers with the Guardian app, they receive a QR code on their device that they can scan before accessing their account. It's one more protective barrier to be sure they're not a hacker with the customer's credentials.  

With more than 80% of passwords having [inherent vulnerabilities](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/), MFA is a critical investment to seal your customer data from unwanted eyes during times of high activity.

## 2. Only store the data and information you need

Storing only essential customer data means that if someone does get into your system, there’s less to exploit. This is a key component of complying with the EU's [General Data Protection Regulation (GDPR)](https://auth0.com/gdpr). Some teams think that adhering to GDPR's strict standards is primarily to avoid hefty fines (the greater of €20 million or 4% of the global annual revenue); however, the standards are a must for protecting end users’ data and the integrity of your company.

If a cybercriminal does gain access to a company's confidential customer information, they can make off with:

* names
* email addresses
* mailing addresses
* phone numbers
* customer device information
* financial data
* personal details like age, race, and religion

[When hackers got into Under Armour's system](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) this year, they were able to access many customers' hashed passwords. Since studies show that people tend to [recycle their passwords](https://securityboulevard.com/2018/05/59-of-people-use-the-same-password-everywhere-poll-finds/), hackers have the ability to take these and access even more personal data in other accounts. The damage can quickly spiral out of control.

Storing less data can make you less of a target. You can also separate data, depending on how confidential it is. With [Auth0's user management solutions](https://auth0.com/user-management), you can restrict access to specific data sets for only the most privileged employees.

## 3. Train employees in the importance of cybersecurity

Training employees in the importance of data security is an often overlooked—but essential—pillar of protecting your customers’ data. Taking the time to bring them up to speed on the latest cybersecurity concerns early in their [onboarding process](https://www.intercom.com/blog/onboarding-focus-culture/) can help ensure that when the holidays roll around, they're on high alert.

When employees are aware of common hacks such as malware infiltration and phishing, they'll be able to recognize threats as they arise. And when they understand the reasons behind provisions such as automatic updates and multi-factor authentication, it’s easier to get their buy-in. 

Our blog has many pieces you can use to help communicate security issues to your employees. Here are a few to get you started:

* [Four Cybersecurity Attacks Your Employees Need to Know](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/)
* [What is a Data Breach?](https://auth0.com/blog/what-is-a-data-breach/)
* [What is Data Security?](https://auth0.com/blog/what-is-data-security/)

You also might want to bring in experts for cybersecurity training sessions. While Auth0 doesn't offer these specifically, here are a few we recommend:

* *InfoSec Institute's [Security Awareness & Anti-Phishing Training](https://www.infosecinstitute.com/securityiq/).* The program includes more than 1,000 phishing simulations, along with tailored learner assessments, to bring employees up to speed.
* *[The SANS Institute](https://www.sans.org/about/)*. This non-profit was established in 1989 and now collaborates with 165,000 security professionals worldwide. Offers many private trainings to upskill existing IT team members.
* *Inspired eLearning. *These efficient modules even include [security awareness training programs for executives](https://inspiredelearning.com/security-awareness/awareness-c-suite/). 

Sometimes education isn't enough. If you do suffer a system breach, Auth0 can quickly step in to protect your customers with tools like [anomaly detection](https://auth0.com/docs/anomaly-detection) and [breached password detection](https://auth0.com/docs/anomaly-detection/breached-passwords). In the first instance, in the Auth0 dashboard, an admin will receive a notification of a strange behavior like multiple failed login attempts and can quickly block the user while researching the issue further. 

In the second case, Auth0's security team will work to keep a retailer informed if any of its customers' passwords match with those in our database of leaked passwords (which we update daily). If we see a match, we can work with a retailer's IT team to block the potential impersonator from getting further into the system.

### Take advantage of what the season has to offer.

Holidays are the most important time of the year for retailers. It's when most retail teams make the majority of their sales, and missing out due to a security breach can set you back several quarters or years from hitting your targets. It’s more important than ever to keep your customer data safe so they continue to trust and work with you.

It’s never too late – or too early – to start thinking about the best ways to do so. Auth0 would love to help. [Reach out](https://auth0.com/) at any time, and we'll be glad to set you up.

<include src="asides/AboutAuth0" />


3 Ways Auth0 Can Help Retailers Protect Customer Data During the Holidays

Constantly test new technologies, monitor user behavior, and maintain secure networks to reap the full rewards.



While humans traditionally have staffed assembly lines, prepped and served food, and entered data into spreadsheets — more and more, machines are taking over these tasks. Although we're far from seeing robots at work that dominate entire professions, organizations are beginning to realize value from integrating intelligent machines into day-to-day operations. Small fixes like allowing machines to [prep tax forms](https://www.teampay.co/insights/finance-jobs-taken-by-robots/) or support with [revenue recognition](https://www.zuora.com/2018/05/31/the-art-and-science-of-revenue-automation-practical-lessons-for-automating-revenue-under-asc-606/) can speed things up during crunch time and allow employees to do more creative and complex work.

With advances in workplace automation come a new set of security concerns. Interconnected devices and systems mean that an attack in one location can have ripple effects across an entire company. A [data breach](https://auth0.com/blog/what-is-a-data-breach/) in one factory, for example, could halt processes across several plants. If cyberthieves illegally access patient records, they have the power to tamper with patients' medical devices and buy prescription drugs in their name.

This piece highlights three major examples of workplace automation and the ways team leaders can enhance the security of these systems to mitigate their risks.

## Warehouses: Peeking Under the Hood of Amazon

When people think of robots, they don't often think of warehouses and inventory turnover. Amazon is changing this. In 2014, Amazon began rolling out robots at work to automate and speed up processes in its warehouse facilities.

The company has more than [700 distribution facilities worldwide](http://www.mwpvl.com/html/amazon_com.html). At the height of last year's holiday season, Bisnow reports that some of Amazon's warehouses delivered [more than 1 million](https://www.bisnow.com/national/news/industrial/how-amazon-prepares-for-the-holiday-delivery-rush-81726) items per day.

![Amazon's RoboStow](https://images.ctfassets.net/23aumh6u8s0i/2IYft6NC5lAjSqy0JCkNQ8/8f702a74fe3b41e6ac4341f7789c191a/automated)

[Amazon's RoboStow](https://press.aboutamazon.com/images-videos)

RoboStow, one of Amazon's most powerful robots, weighs a whopping six tons and can move pallets of products over twenty feet high across a warehouse floor. This drastically reduces the physical labor and risk for Amazon's human employees. With its enormous capacity, RoboStow has helped Amazon store [50% more inventory](https://money.cnn.com/2016/10/06/technology/amazon-warehouse-robots/index.html) over the last five years and reduce the human labor portion of shipping to just [one minute](https://money.cnn.com/2016/10/06/technology/amazon-warehouse-robots/index.html) per package.

The results have also corresponded with a boost to Amazon's finances. According to a Slice Intelligence report, cited in The Wall Street Journal, in 2017 the company [retained 42 cents of every dollar spent online](https://www.wsj.com/articles/how-amazon-can-make-or-break-holiday-retail-1511265601), up from 38 cents in 2016. This highlights improvements in the company's ability to cut costs and overall operational efficiency.

Despite the hype around RoboStow, the machine isn’t 100% secure. While new robots may appear like they’re bulletproof, in reality they’re subject to many of the same flaws as other devices connected to the internet.

One [recent study](https://ioactive.com/robots-want-bitcoins-too/) by IOActive highlighted how their research team was able to steer several of Softbank’s robots meant for telecommunications to curse at people instead. They did this by injecting ransomware into the robot’s system through a public Wi-Fi network. Since many robots store valuable data (even if they’re simply transmitting it to a different endpoint), the team also revealed how hackers might access a robot’s software remotely, freeze it, and force the robot’s handlers to deliver something of value (e.g., money or other sensitive data) before unlocking it again.

In 2017 IOActive found nearly [50 vulnerabilities](https://ioactive.com/robots-want-bitcoins-too/) through which hackers could command popular commercial robots remotely. For Amazon and other companies that employ robots for physical labor in their warehouses, the dangers to human employees if a robot is hijacked or malfunctions could be severe.

While there is no single solution for fully securing machines like RoboStow, applying the same techniques used to [secure other mobile devices](https://auth0.com/blog/ten-mobile-security-threats-and-what-you-can-do-to-fight-back/), such as unique and complex passwords, employee education, and keeping systems updated goes a long way towards deterring dishonest users.

## Factory Robots Exposed via Routers

The epitome of monotonous (and often hazardous) labor — factory work is a popular target for workplace automation.

Today, Japan-based FANUC is leading the way with a factory that builds industrial robots for sectors as diverse as transportation and big pharma.

![Industrial Robots](https://images.ctfassets.net/23aumh6u8s0i/5u8tKWzuaPWA28wWLBfM1L/40a3a017f2895841b7f0ff1a1f632ac1/automated)

Source: [FANUC](https://www.fanuc.eu/fr/en/robots)

[Nearly 80%](https://www.bloomberg.com/news/features/2017-10-18/this-company-s-robots-are-making-everything-and-reshaping-the-world) of FANUC's assembly work is automated. [According to the company](https://www.bloomberg.com/news/features/2017-10-18/this-company-s-robots-are-making-everything-and-reshaping-the-world), human engineers complete only the wiring portion of the finished robots. That helps cut the costs of production dramatically and expands FANUC's margins.

Yet even this cutting-edge team isn't safe from cybercrime. Last year, researchers found that [over 80,000 industrial routers were exposed](https://www.darkreading.com/vulnerabilities---threats/researchers-hack-industrial-robot-/d/d-id/1328790) on the public internet, including those of FANUC. Industrial routers underlie remote networks and devices and support automation at many levels, yet despite their outsized importance, this research found that several of these devices didn't even require authentication.

[Authentication](https://auth0.com/docs/getting-started/overview) is critical to building a secure company foundation. Without it, organizations aren't able to verify the identities of its users —including employees, consultants, and customers. Without authentication, it's a cinch for a dishonest user to sneak in and steal company secrets.

At FANUC or another manufacturer with connected devices, a breach in one location could have widespread consequences across operations. As a company decision-maker, it's critical to constantly test for holes and patch and upgrade your systems to ensure that they're able to withstand increasingly numerous and complex threats.

## The Automated Workplace of McDonald's

Restaurants and food service have some of the more visible examples of automation. A robot barista Cafe X, for example, recently opened up shop in San Francisco.

![Robot Barista CafeX](https://images.ctfassets.net/23aumh6u8s0i/3VC1VT1WQ9iDbmtXwdTj4I/b20c9a7437703161633051e9b7b99ec5/automated)

[Image Source](https://www.youtube.com/watch?v=t4r6nAkav9o)

Robots have also been spotted [flipping burgers](https://www.usatoday.com/story/tech/talkingtech/2018/05/28/hamburger-making-robot-flippy-back-serving-300-burgers-day/649370002/) and [delivering meals](https://www.npr.org/sections/alltechconsidered/2017/03/23/520848983/hungry-call-your-neighborhood-delivery-robot).

On a large scale, McDonald’s has boosted workplace automation by installing thousands of ordering kiosks. The company is aiming to install kiosks in [_1,000 stores_](https://www.cnbc.com/2018/06/04/mcdonalds-to-add-self-order-kiosks-to-1000-stores-each-quarter.html) each quarter until its entire network is complete.

![McDonald's Ordering Kiosk](https://images.ctfassets.net/23aumh6u8s0i/1Ia8lLIiQuLScjPcHK4IIy/a0d5e23154170cbc02f03bf9a6f49276/automated)

[Source](https://www.businessinsider.com/mcdonalds-kiosk-vs-cashiers-photos-2018-3#the-beauty-of-the-kiosk-really-is-customization-making-your-order-the-way-you-want-it-on-here-is-much-easier-than-repeating-what-you-want-to-a-cashier-several-times-just-hit-the-customize-button-after-youve-chosen-the-item-you-want-and-go-from-there-9)

At the kiosk, customers can customize their meal — easily adding toppings and viewing nutritional information, such as calories. This reduces lag time in speaking with an employee at the cash register. McDonald's has also figured out how to present menu options on these digital screens in a more tantalizing format. They noted that customers spend an average of [_30%_](https://www.pymnts.com/restaurant-technology/2018/mcdonalds-kiosk-strategy/) more when using automated kiosks.

These kiosks certainly aren't immune to hacks. Last year, someone breached a McDonald's kiosk in Australia and removed [$4.70 from their order.](https://www.kioskmarketplace.com/articles/how-vulnerable-are-kiosks-to-hacking/) This might seem like a fun prank; however, the implications for customers and for the company's operations are more dire. If a hacker can access order histories, it’s likely they can also view customer names and credit card information.

Even in common products like ordering kiosks, being able to control users' navigation and access historical behaviors on the platforms are critical to figuring out where there might be holes.

## New machines, similar security problems.

Despite their allure, robots at work have many of the same vulnerabilities as other pieces of hardware — and workplace automation falls prey to holes in unsecured networks. In the worst case scenario with robots, cybercriminals could exploit weak points to control their movements and cause harm to human employees or a company's operations. At the other end of the spectrum, stealing a few dollars by breaching ordering kiosks still underscores larger risks of personal data theft.

An interconnected workplace —with systems that help ease time-consuming, costly, and low-value work —can be an enormous asset. Learning from leaders in the field is a great place to begin. Understanding where they've fallen short will help your organization go one step further and create an even stronger foundation on which to grow.

<include src="asides/AboutAuth0" />

---


Staying Safe in the Automated Workplace

Stay organized, access the largest and most up-to-date storage capabilities, and gain more visibility into user behavior.



The healthcare industry is the second largest in the United States, but average spend on cybersecurity is just half as much as other industries, according to a recent [TechCrunch report](https://techcrunch.com/2018/08/09/the-healthcare-industry-is-in-a-world-of-cybersecurity-hurt/). This is surprising (and unfortunate), given how valuable patient records can be to cybercriminals. If a thief obtains medical records, he or she can do a host of things, including the following:

* Purchase medical equipment or drugs in the patient's name
* Submit false health insurance claims
* Tamper with a patient’s medical devices
* Use personal information on file (such as addresses or Social Security numbers) to access other sensitive data, like financial accounts.

Hospitals, private practices, and third parties that store and process patient data are ripe for hackers.

In 2017 there were [more than twice the amount of attacks](https://techcrunch.com/2018/08/09/the-healthcare-industry-is-in-a-world-of-cybersecurity-hurt/) on healthcare organizations vs. other industries—and is just the start of what we've seen so far this year. According to a recent [Protenus report](https://marketing.protenus.com/hubfs/Breach_Barometer/2018/Q2%202018/Q2%202018%20Protenus%20Breach%20Barometer.pdf), between April and June of 2018, more than 3 million patient records were exposed. Threats are multiplying, and healthcare cybersecurity across teams is not keeping pace.

Last year, we highlighted how many healthcare organizations were facing challenges in [modernizing their legacy systems](https://auth0.com/blog/why-healthcare-is-moving-to-the-cloud-but-isnt-there-yet/). Since then, the issue of security has become more acute in the industry. Below, we detail four key reasons why cloud solutions are critical for healthcare organizations, and we offer suggestions on how to make the transition.

## 1. The cloud helps keep sensitive data in one location.

When you [move data to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/), it gives you the chance to aggregate disparate streams of information in a single place. Even if the majority of your patient data is protected, when you have information in many different sources, such as spreadsheets, hard drives, and even hard copies, it can be easy for something like a prescription or a note from an operation to get lost in the flood.

Moving data to the cloud opens new opportunities for [data management and integration (DMI) practices](https://auth0.com/blog/all-you-need-to-know-about-data-management-and-integration/). While DMI is a complex and evolving space, in a nutshell, it is a set of policies and procedures that an organization puts in motion to be sure the right people have timely access to accurate data.

For hospitals, it's essential that records are clean and up-to-date before an IT professional moves them or merges them with other information. If errors occur in patient names, medical histories, [financial information](https://www.teampay.co/insights/when-to-excel-and-when-to-automate/), or prescription information, for example, it can end in a costly lawsuit and a stained reputation— not to mention physical harm if patients are not treated correctly.

## 2. A cloud solution helps avoid downtime.

For many organizations, downtime means lost business opportunities. Teams can't [respond to customer requests](https://blog.ujet.co/how-to-elevate-customer-support-from-within), follow up on leads, and deliver products and services if computer systems are suspended. 

(Some companies are so concerned about this, given the [enormous uptick in data breaches in 2018](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), that they've begun to take out cybersecurity insurance policies that can help recoup losses.)

In healthcare, more than money is on the line. If systems are down, staff aren't able to book emergency appointments, and doctors and nurses aren't able to confirm medications or timing for procedures. Lives are at risk. 

In 2018, at New York's Jones Memorial Hospital, [computer systems were down for a week](https://www.healthcareitnews.com/news/cyberattack-knocks-new-york-hospital-offline-week) after a cyberattack. Jones Memorial is a small acute-care facility in a rural area. During the time it took to detect and clean up the issue, the hospital had to revert to manually entering patient data into medical charts and recreating prescription lists. Although the hospital had prepared for these downtime procedures, it still left more room for error and wasted time that staff could have spent delivering care.

Cloud vendors like Microsoft and IBM offer additional precautions, like up-to-date software, that can help mitigate the chances of a breach due to holes. They can also help solve common problems such as load balancing, which often leads to outages. If activity is too much for a single server to handle, these larger providers are able to spread demand over multiple servers, ensuring that you don't short-circuit in times of high activity.

## 3. A cloud solution affords better insight into user behavior.

Cloud computing is far more than a repository for your information. It opens up a world of new opportunities for IT admins, helping them better understand how employees and third parties use their systems — and who is accessing what digital files at any time.

When you're based in the cloud, you can begin to tack on additional features, such as Auth0's user-management software, which quickly pulls details on existing users at any time.

![Auth0 User Profile](https://images.ctfassets.net/23aumh6u8s0i/76L9nLzxwq7H8f4HsAnRSn/99249132de75059ed85ebb89af0d2c7e/healthcare-cybersecurity_auth0)

This level of visibility makes it easier for admins to monitor for unknown visitors or strange behaviors. If, for example, they see “John” trying to gain access to a database he isn't permitted to view, an IT executive can pull his profile, understand why he might be trying to get in, and either grant or block access. Admins even have the ability to log in as any user and attempt to troubleshoot from his or her vantage point.

Additional cloud solutions, such as identity management, can also help protect you from your own employees. Nearly [one-third](https://www.healthcareitnews.com/news/142-healthcare-data-breaches-q2-30-caused-repeat-offenders) of the attacks on patient records in 2018 came from within the organizations themselves. You want to be sure you don't have medical data still floating in file cabinets or on unprotected servers. 

## 4. The cloud gives you flexibility as you grow.

Providers like Amazon Web Services, Google Cloud, and Microsoft Azure come with on-demand teams and resources that can help customize cloud plans as organizations develop over time. Even if hospitals aren't necessarily in hypergrowth mode like many startups, they still have shifting needs. These could be for increased or reduced load capacity, depending on staffing and patient demand; more [private cloud requirements](https://auth0.com/docs/appliance/private-cloud-requirements), given a larger volume of high-touch data; or a desire to move more to the public cloud, due to cost restraints. 

Many healthcare organizations opt for a combination of public and private cloud deployment. Both offer flexibility for expansion and require less maintenance than in-house storage. The public cloud is less expensive; however, teams often go for at least a portion of data storage in the private cloud, given the following:

* A higher level of customization (since you're not sharing resources with others)
* A more stringent selection of user permissions
* No need for backup hardware or software

Due to the confidential nature of their work, government agencies and financial institutions also often opt for private cloud use. This gives an even greater sense of its capacity.

## Better healthcare cybersecurity starts with the cloud.

Security for healthcare teams is only getting more complicated. Medical devices, for example, are a growing concern. In a worst-case scenario, a cyberattack could tamper with pacemakers or other life-supporting devices. To this end, the U.S. Food and Drug Association recently released a new [cybersecurity playbook](https://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm622074.htm), which, in part, sets new guidelines for creating medical devices with software that is adaptable to new threats.

The interconnected nature of delivering care reveals how an attack on one portion of the organization has the potential to affect all others. While cloud computing won't guarantee protection against cybercrime, it will keep a team's data organized and as secure as possible.

Finally, as healthcare teams work to [comply with HIPAA](https://auth0.com/learn/why-hipaa-compliance-is-vital-your-business/), cloud computing helps providers and third parties stay prepared in the event of an audit with more visibility into day-to-day operations and tighter user permissions.

<include src="asides/AboutAuth0" />


4 Ways Cloud Computing Can Improve Healthcare Cybersecurity

Invest in cybersecurity insurance, steer clear of email money transfers, and improve your data and identity management.




In June 2018, the Memphis-based real estate company Crye-Leike found itself embroiled in an international online fraud scheme. Eight people were caught stealing nearly $15 million from the firm. Evidence later emerged linking them to phishing scams.

Crye-Leike is not alone. In 2017, the FBI warned of a large spike in cyberattacks specifically targeting real estate companies. They noted that fraudulent real estate transactions jumped 5,000%, from [$19 million](https://www.cyren.com/blog/articles/cybercriminals-see-real-estate-firms-as-profitable) in 2016 to nearly $1 billion (US $969M) in 2017. 

The FBI also saw inbound complaints of cyberattacks related to real estate jump [480%](https://www.cyren.com/blog/articles/cybercriminals-see-real-estate-firms-as-profitable) between 2016 and 2017. 

What makes real estate so alluring and easy to hack? 

In 2017 Zillow valued the U.S. real estate market at [$31.8 trillion](https://www.housingwire.com/articles/42176-value-of-us-housing-market-climbs-to-record-318-trillion) (1.5x the value of the nation's GDP). Real estate tech is also one of the fastest growing tech sectors. High-value areas often draw criminals.

![Ocean’s 8 Film Steals $4 Million at Theater's Box Offices](https://images.ctfassets.net/23aumh6u8s0i/2xuXCFmyUEund3YONGKwNe/ee9ad7f1260a160cf125eb615dd57a33/oceans-8)

([Source](https://www.thewrap.com/oceans-8-steals-4-million-at-thursday-box-office/))

With real estate in particular, no federal law mandates that businesses have to implement information-security programs (like banks and hospitals do). This has resulted in companies with exceptionally vulnerable systems. 

A recent survey showed that [50 percent](https://www.nreionline.com/technology/top-five-cybersecurity-threats-real-estate-businesses) of real estate companies do not have sufficient resources to prevent or even mitigate a cyberattack. The industry has fallen behind.

This piece will break down ways that real estate firms can come up the curve and protect their sensitive information.

## 3 Ways To Brace Your Team Against Cybercrime

### 1.) Invest in cybersecurity insurance.

The average cost of a data breach topped [$3.8 million](https://www.forbes.com/sites/niallmccarthy/2018/07/13/the-average-cost-of-a-data-breach-is-highest-in-the-u-s-infographic/#5b3d9ea72f37) in 2018—and [small businesses remain particularly vulnerable](http://blog.idonethis.com/security-ringcaptcha/). While many real estate companies are large corporations, others are still local and family-run and have been working with the same systems for generations. 

Costs to recover from a breach (e.g., additional PR for damage control, IT spending, and nonfinancial damages like decreased brand reputation or having to fire an executive) are often more than companies can handle.

Real estate teams have insurance for natural disasters — why not for cyber disasters? 

Cybersecurity insurance (or cyber liability insurance) is stand-alone coverage that helps mitigate loss from a security incident. With the number of breaches and the volume of exposed personal records escalating every year, no organization is safe.

With cybersecurity insurance, many major providers, like AIG and Chubb, can help reduce the effects of the following:

* Damaged or stolen data and software
* First-party costs, such as event management, data restoration, and network interruption
* Lost business opportunities
* Extortion (in the event a hacker holds data for ransom)
* Money stolen through false requests or other methods

Nearly all insurance plans are customizable and offer options to further insure the customers or vendors whose information was exposed or taken. 

A data breach never looks good, but being able to reimburse your customers will go a long way toward maintaining their trust and retaining them going forward.

### 2.) Never conduct and confirm wire transfers by email.

Business email compromise (what Crye-Leike sustained in 2018) is a common method for hackers targeting realtors. 

In 2017, one couple in Washington, DC, [lost $1.5 million](https://wamu.org/story/17/08/08/hackers-allegedly-steal-1-5-million-d-c-couple-home-buying-phishing-scheme/) in such a scam. They received a request to wire the title company money for their home at a different address. After re-directing the funds, the couple learned that the company didn't even know about this new request. It was a false organization.

Business email compromise in the form of a bucket brigade attack, also known as man-in-the-middle (MITM) attack, is often very difficult to detect. If they're well designed, they're nearly indistinguishable from routine forms:

![DocuSign Phishing Scam Example](https://images.ctfassets.net/23aumh6u8s0i/73bcOarUqgNmdCPFBAGynZ/6dcb94787e351fb420d9ec22049f581d/docusign)

([Source](https://activerain.com/blogsview/5056521/docusign-scam))

This DocuSign spam email is formatted to look legitimate and includes correct names and dates for context. If an employee is in a rush, it's easy to simply sign without careful scrutiny. 

Recently, hackers have been gaining illegal access to real estate professionals’ email accounts to get information about impending transactions, according to reporting from [WAMU](https://wamu.org/story/17/08/08/hackers-allegedly-steal-1-5-million-d-c-couple-home-buying-phishing-scheme/). If a deal has closed, the hackers often reach out to the buyers while impersonating the real estate company and request that they wire funds to a new address—a similar pattern to what the couple in DC suffered. Buyers end up sending down payments to fraudulent accounts. 

To stay safe from phishing scams, tell your customers that they should never wire funds through email. If they have questions, have them reach out to you directly. 

### 3.) Use a cloud security platform.

While a subset of the real estate industry (tech firms like [Homespotter](http://blog.homespotter.com/), Redfin, and Cadre) is already digital, many traditional shops still rely on printed paper, physical filing systems, and outdated hard drives. This leaves critical data ripe for theft or vulnerable to simply being lost or damaged.

[Moving your data to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/) brings numerous advantages, such as the following:

* Distribution (no single point of potential failure)
* A more stable back end, with multiple backups
* Greater capacity for insight into irregular behaviors

Teams across the board, whether in real estate or other sectors, like [retail](https://auth0.com/retail), [media](https://auth0.com/media-publishing), and [finance](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), are dealing with larger volumes of customer information. Names, email and physical addresses, phone numbers, genders, locations, devices, and even race and religion are valuable in creating more-targeted marketing materials and personalized communications. As teams collect and process more of this data, their repositories are ripe for theft if they don't have the proper security.

Some digital security teams deliver robust identity management solutions that make sure you know who's working within your system at any time. [Auth0](https://auth0.com/), for example, provides a dashboard that allows users to monitor customers logged into their accounts, consultants authorized by a company, and even its own employees. You never know when a hacker is impersonating a user you know and attempting to access sensitive data.

![Auth0 Dashboard and How to Implement MFA and Other Security Features](https://images.ctfassets.net/23aumh6u8s0i/5kLCr8wuGuyrW6HiP8xpzs/06121d1e514fa5fbe6e59df8995f73b8/auth0-dashboard)

Even teams that operate digitally can be scattered, with data in many different locations—not to mention a [mobile workforce](https://www.teampay.co/insights/tools-for-managing-a-remote-workforce/) logging in from all over the world on various devices. The dashboard allows admins a centralized view to better understand what's happening across the board. You can view current and new active users, compare their current and historical behaviors, and even use the tool to quickly block or communicate with users you think are out of line.

Shifting to a cloud security platform will open up a range of new possibilities for organization and security.  

## There's No Better Time to Improve Real Estate Security 

You can't control hackers' behavior. Even the largest corporations with the most robust security systems are vulnerable. But you can control your own security plan. Investing in cybersecurity insurance, educating your employees about email scams, and bolstering your digital and identity-management infrastructure are all important steps you can take to ensure that you and your customers will be able to recover if a breach occurs.

<include src="asides/AboutAuth0" />


Real Estate Security is More Important Than Ever: 3 Ways To Brace Your Team Against Cybercrime

Use penetration testing and 2FA and educate citizens and employees to better anticipate and avoid cyber threats.



On April 7, 2017, at a quarter to midnight, the city of Dallas was hacked.

The perpetrators accessed the City of Dallas's emergency management system and set off 156 blaring alarms—alarms intended to warn people in case of a tornado or hurricane.

It took over an hour and a half for city administrators to understand what had gone wrong and shut the sirens down.

Amid the ongoing digitization of our urban areas, the Dallas incident highlights one of the main dangers that a smart city—for all the good it can do—brings.

Without the right precautions, and without the right security, our smart cities can be just as vulnerable to hacking as our computers and mobile devices.

What happened in Dallas may have been the first high-profile incident of “city hacking,” but it certainly won't be the last.

## Why Security Is a Problem For Smart Cities

The rise of smart cities is intimately linked to the rise in production of Internet of Things (IoT) devices—as are its inherent security problems.

Your average IoT device is relatively cheaply produced. It's not built with the kind of security features you get on a Mac or Windows laptop or tablet or in a mobile phone. It is, however, connected to the internet.

These three factors have made IoT devices incredibly fertile cybercrime targets over the last decade or so.

In 2015, millions of children's names, genders, ages, photos, and parents' records (including home addresses) were compromised through a device known as the InnoTab—a kind of WiFi-enabled tablet for kids.

IoT devices are often trivially easy to access remotely because they're already connected to the internet and not built with cybersecurity in mind. Hackers don't even need to pull information from them. They can simply sit on the device and wait for it to gather information, or even requisition it for use in a distributed denial of service (DDoS) attack or botnet.

Cybersecurity researchers have found vulnerabilities in IoT devices in smart cities, too. Aside from the Dallas incident, significant issues have occurred in smart traffic signals and smart electricity meters. The number of attacks on infrastructure in the U.S. alone went from not even 200 in 2012 to 300 in 2015.

Today, advocates of smart cities are looking much more closely into the security of smart cities and how to build devices that can ensure our cities stay safe and protected—even as they get smarter. According to Gartner, 2.3 billion connected items were used in U.S cities throughout 2017. That number is only going to get bigger and bigger.

## Ensure Security For Critical Facilities

The most vulnerable locations in any smart city are the centers of utilities and power—power plants, water processing plants, and so on.

In Kiev in 2016, hackers shut down 20% of the city's power by hacking into an electrical substation.

Penetration testing is a common method that cities and municipalities use to test for vulnerabilities with their utilities. A security firm is hired to attempt to break in and gain access to the system. Afterward, they produce a report with their findings and give [recommendations for how to avoid the a real attack](https://www.redteamsecure.com/business-insider-rides-shotgun-as-redteam-security-hacks-the-power-grid/).

![Smart city -  crime of person gaining access to a facility](https://images.ctfassets.net/23aumh6u8s0i/1n7pLxG3VH1QfPNkEFt9TX/44b26808a6ffb50c7d924a0e3d40ad18/gaining-physical-access-to-facility)

Pen testing isn't just about lurking around a facility late at night and trying to gain physical access. It might also mean dropping a USB key, loaded with a virus, in the parking lot to see whether an employee happens to pick it up and stick it in their laptop; if they do, the key can be formatted to sit on the device as a keylogger, attempt to gain remote access, or send out phishing emails.

It's about social engineering—still one of the most effective ways of gaining access anywhere.

And it means, of course, more straightforward network and application penetration testing—trying to get in by remotely compromising the system itself.

## Two-Factor Authentication

Facilities that provide critical utilities, such as power and water, need to be made absolutely secure, but so does other essential infrastructure in smart cities—like subway transportation, street lights, and security cameras.

The essential technology of any smart city must employ cryptography to protect data. Otherwise, video feeds of your citizenry can wind up being streamed on the internet, or your street lights can end up flashing on and off for hours on end.

Data should be encrypted both at rest and in transit. Any systems that allow access from any parties must accept a username and a password and should go a step forward and enable two-factor authentication. Two-factor authentication is the easiest and most effective step you can take to prevent unauthorized access because it immediately cuts out the most obvious and available attack vectors.

![Two-factor authentication example using phone device auth to grant access](https://images.ctfassets.net/23aumh6u8s0i/HWYrg3Jdj6NOgoKwz1AgN/69deef407a90c08422882ec34e06392f/two-factor-authentication-using-smartphone)

[Two-factor authentication](https://auth0.com/learn/two-factor-authentication/), at root, is about ensuring that anyone accessing your systems has two methods of proving their identity. That might mean a username, password, and something like a biometric key or a one-time password delivered through an app on their phone, like [Auth0 Guardian](https://auth0.com/docs/multifactor-authentication/guardian) or Google Authenticator.

## Education For Citizens and Leaders

Ultimately, the best way to prevent most cyberattacks (on cities or anything else) from succeeding, or at least to mitigate the damages, is education.

Emails that look like they're from a C-suite executive at your company but have an odd-looking From: address, or USB drives that look like they've been forgotten in your office's parking lot: These are highly visible red flags that indicate that some person or group has gotten access to your systems or is trying to. They're also some of the most commonly successful attacks out there because many people don't recognize the signs for what they are.

When one person falls for a phishing email, it can cause huge ripple effects down the line as their contacts are emailed en masse and compromised as well.

Educating denizens about the common forms of cyberattacks and the ways to prevent falling victim to them is the number one way that cities—if they cannot prevent attacks from happening—can ensure that the effects of malicious acts do not ripple out and cause wider damage.

## The Future of Urban Cybersecurity

The cybersecurity challenges of the future are going to look bigger and much different than many of those we have today.

As smart devices proliferate and security vulnerabilities loom larger and larger, it's on all of us to make sure that the cities we are building—no matter how smart—are secure as well.

<include src="asides/AboutAuth0" />


How Do Smart Cities Tackle Cybersecurity?

Let’s cover the top 10 cybersecurity takeaways of my social engineering training at Black Hat.



I took the ["Achieving Security Awareness Through Social Engineering Attacks"](https://www.blackhat.com/us-18/training/achieving-security-awareness-through-social-engineering-attacks.html) course at [Black Hat this year](https://www.blackhat.com/us-18/)!

<br />
<div style="display: flex; justify-content: center;">
  <blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">“Achieving Security Awareness Through Social Engineering Attacks” <a href="https://twitter.com/hashtag/BHUSA?src=hash&amp;ref_src=twsrc%5Etfw">#BHUSA</a> Training taught by <a href="https://twitter.com/jaysonstreet?ref_src=twsrc%5Etfw">@jaysonstreet</a> &amp; <a href="https://twitter.com/aprilwright?ref_src=twsrc%5Etfw">@aprilwright</a> will use current Red Team strategies to develop a better understanding of how attackers use SE <a href="https://t.co/yuojeClInS">https://t.co/yuojeClInS</a></p>&mdash; Black Hat (@BlackHatEvents) <a href="https://twitter.com/BlackHatEvents/status/1002976909268045827?ref_src=twsrc%5Etfw">June 2, 2018</a></blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div>
<br />

It was eye-opening, tremendously interesting, and fun! It was facilitated by [Jayson Street](https://twitter.com/jaysonstreet) and [April Wright](https://twitter.com/aprilwright). Jayson gets paid by companies to break into their own facilities through [Social Engineering](<https://en.wikipedia.org/wiki/Social_engineering_(security)>). He shared many amazing stories, like the time he [gained full access to a bank in Beirut in two and a half minutes](https://www.youtube.com/watch?v=UpX70KxGiVo&feature=youtu.be&t=434).

![Corgi dog meme, coding on computer](https://images.ctfassets.net/23aumh6u8s0i/60r47IT9a84TsaSpyvHB4h/1f15d9303d87cc13b35de378f41ae7fc/corgi-social-engineering-meme)

[Source](https://imgflip.com/meme/38390688/corgi-hacker?sort=latest)

Here’s a summary of what we discussed in the training, along with key takeaways:

## OSINT and Social Media

> “Information doesn’t have to be secret to the valuable” ~ CIA

One of the key elements of Social Engineering is [Open-source Intelligence (OSINT)](https://en.wikipedia.org/wiki/Open-source_intelligence), which is insight produced from data collected from publicly available sources. **If you don’t have proper privacy settings in your social media accounts, the information you put there is public**.

In class, we discussed the case of a guy named Travis who put pictures of his badge, passport, plane tickets, job title, workplace and even emails on Instagram.

We analyzed how someone that overposts on social media could be targeted, and it’s not a surprise that it’s relatively simple. We also talked about tools and techniques to get and find relevant information.

There was an exercise about drafting (not sending) a spear phishing email in 1 hour targeted at someone in our organization using OSINT. Nobody used their own workplace and nobody said where they worked, but we completed the task with good results.

**Takeaway #1:** Review your privacy settings and don’t post private information on social media.

<include src="TweetQuote" quoteText="Review your privacy settings and don’t post private information on social media. Open-source Intelligence tools could be used to mine your data and create phishing opportunities."/>

## WiFi Pineapple and Bash Bunny

As part of the training, they gave us [some interesting gadgets from Hak5](https://www.hak5.org/) including a [WiFi Pineapple](https://www.wifipineapple.com/) and a [Bash Bunny](https://wiki.bashbunny.com/#!index.md). They are tools meant to be used for penetration tests, and they have many pranks that can help with Security Awareness programs by showcasing their associated dangers in safe and controlled setups.

> We also got a [Packet Squirrel](https://www.hak5.org/gear/packet-squirrel) as an extra gift!

### WiFi Pineapple

The WiFi Pineapple is a [Wireless Auditing tool](https://www.tutorialspoint.com/wireless_security/wireless_security_tools.htm) that can work as a [Man-in-the-middle platform](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). Among others, it allows the owner to intercept an open WiFi connection and inspect and modify HTTP traffic, redirect the user to a malicious site, or associate with past public WiFi connections and “pretend” to be one of them.

For example, if you’re near a Pineapple while your phone has WiFi turned on and is actively looking for connections, all of the sudden you may connect to the airport network you used 6 months ago and a site may ask you to pay for the service. They mention it on the [Silicon Valley TV Show](https://www.youtube.com/watch?v=9FckHMPBs_Q).

This is the picture of a WiFi Pineapple Tower because… Black Hat.

![WiFi Pineapple Tower at Black Hat Conference](https://images.ctfassets.net/23aumh6u8s0i/JCZHfzvkgBGa4Hp35EuBW/787cc9176b637d4189bab7e9d312a068/wifi-pineapple-tower)

**Takeaway #2:** Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it.

<include src="TweetQuote" quoteText="Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it."/>

### Bash Bunny

The Bash Bunny is a USB attack platform that can emulate trusted USB devices like Gigabit Ethernet, serial, flash storage and keyboards.

![Bash Bunny USB platform.](https://images.ctfassets.net/23aumh6u8s0i/2NNQP0gnYiYvYEEFuaHUsc/a78cb5ae090bb73827007b4051f99f01/bash-bunny)

We did a couple of experiments in the class: First, we used a “prank” payload that [rickrolls](https://en.wikipedia.org/wiki/Rickrolling) the target at a specific date and time. It took less than 20 seconds to deliver this payload.

Then we tested a “recon” payload and we could get the full terminal history, clipboard content, system users, [`ifconfig`](https://en.wikipedia.org/wiki/Ifconfig), WAN IP, and all installed applications. This took a little bit longer, but it was still fast and the computer was in sleep mode.

**Takeaway #3:** Don’t plug in random USB drives and be cautious when working on public spaces.

<include src="TweetQuote" quoteText="Don’t plug in random USB drives and be cautious when working on public spaces."/>

## Conclusion and Other Takeaways

We talked about other topics such as policies, security awareness programs, memes and the importance of repetition during training. These are the top 10 Takeaways of the experience:

1.  Review your privacy settings and don’t post private information on social media.

2.  Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it.

3.  Don’t plug in random USB drives and be cautious when working on public spaces.

4.  Clickbait is widely used in social engineering, don’t trust it.

5.  Before running phishing campaigns, there should be policies and formal training in place.

6.  Although potentially controversial, hard to spot spear phishing emails create a more impactful “teachable moment” (as Jayson says).

7.  Certain topics of Security Awareness training should be tailored by role. An organization should have a site that groups all this information and internal security-focused newsletters could be useful as well.

8.  Controlled live demos with tools like the WiFi Pineapple and the Bash Bunny help raise security awareness.

9.  Prizes and gamification support these efforts.

10. It is important to always explain the purpose of the training, demo or campaign. We don’t ever want you to fail, we want to empower you and help make you one of our strongest lines of defense:

![Security training at Black Hat Conference](https://images.ctfassets.net/23aumh6u8s0i/386zANR8fvarMMfbzH9Mfg/5e492f230e1d8b29414d4eb3798ba793/teammate-empowerment)

<include src="TweetQuote" quoteText="Security training and awareness campaigns make people the best line of cybersecurity defense"/>

<include src="asides/AboutAuth0" />


Black Hat Training: Achieving Security Awareness Through Social Engineering Attacks

Information and tools to help you mitigate risk against cyber attacks and data breaches. Learn more about Malware Infiltration, Phishing, USB Traps, and Mobile Attacks.



In 2017, nearly [_179 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. It's clear that cyber criminals are growing more creative with how they gain access to networks and valuable data.

Many of today’s most common cyberattacks have been socially engineered to rely on human error. Even your best employees can become your greatest weakness if they open a suspicious email, click on a malicious link, or pick up and use an anonymous USB device.

There are ways to protect your organization against sensitive data breaches. Here are four of the most common cyberattack examples and the ways you can avoid them.

## **1. Malware Infiltration**

**What makes you vulnerable: outdated software and lack of backup protocols**

Malware is a term that encompasses many different types of malicious software, including ransomware and spyware. Each type of malware can wreak havoc once it gains access to a system.

WannaCry, for example, a form of ransomware, recently [took advantage of a weak spot in Microsoft’s operating system](https://www.symantec.com/security-center/writeup/2017-051310-3522-99). Banks, health care providers, manufacturers, and other businesses across the globe reported WannaCry's encryption.

![WannaCry encryption](https://images.ctfassets.net/23aumh6u8s0i/1vTw3WKZIs3Fs1RZGhNNeI/18d3869c4068bf29ce62e9ce8eb6e9db/WannaCry-encryption)
  
[[Source](https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/)]

In order to regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [_bitcoin_](https://bitcoin.org/en/). [_Sixteen National Health Service’s offices_](https://developers.redhat.com/blog/2017/05/19/wannacry-ransomware-who-it-affected-and-why-it-matters/) and over 200,000 PCs worldwide reported this.

_Solution: Regularly updating your systems will go a long way toward removing dangerous holes. It's a simple fix that many teams, including [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/), have neglected._

_If you want added security, consider [moving to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/). Not only will this allow your enterprise more flexibility to scale, but you can also delegate specialized security tasks like IAM and encryption to expert providers._

## **2. Phishing **

**What makes you vulnerable: lack of education and attention to detail in suspicious e-mails**

In 2016, [91% of cyberattacks](https://phishme.com/2016-enterprise-phishing-susceptibility-report/) were the result of a spear-phishing email. Phishing e-mails steal data either by tricking recipients into giving it to the cyber criminals or by getting users to download a file that installs spyware—software designed to steal information directly from a user’s device.

Children’s Mercy Hospital [_recently reported a breach_](https://healthitsecurity.com/news/childrens-mercy-hospital-phishing-attack-impacts-phi-of-60k) that exposed the health care information of at least 60,000 people. E-mails tricked users into disclosing their work e-mail credentials, which led to the exposure of patient health data when the hackers gained access to the inboxes of the targeted hospital workers. Children’s Mercy [_is now being sued_](https://www.hipaajournal.com/childrens-mercy-hospital-sued-for-63000-record-data-breach/) for this major breach.

Here’s an example of an imitation Dropbox e-mail asking for confirmation of a user’s e-mail:

![Imitation Dropbox email phishing scam asking for confirmation of a user’s e-mail](https://images.ctfassets.net/23aumh6u8s0i/7jVF95LDb067AOrODuA8SI/2fb640b69a3567e208636c1abad55fc1/dropbox-email-asking-confirmation-of-user-email)

[_Source_](https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250)

When users click the “Verify your email” link, spyware software is automatically downloaded onto the users' computers.

_Solution: As these e-mails start to look more realistic, it’s important to educate employees on how to spot a questionable e-mail chain._

_Creative training programs include the following:_

- _Digital Defense's [SecurED training program](https://www.digitaldefense.com/professional-services/secured-training/) that works with award-winning Hollywood comedy writers_
- _Terranova's [customizable newsletters](https://terranovacorporation.com/solution/communication-material/)_
- _Inspired eLearning's [Security Awareness for the C-Suite](https://inspiredelearning.com/security-awareness/awareness-c-suite/)_
- _Wombat Security's [everyday tips](https://www.wombatsecurity.com/security-education/free-security-awareness-resources)_

_[See here for a larger list.](https://www.csoonline.com/article/3225471/security/please-dont-send-me-to-cybersecurity-training.html)_

## **3. USB Traps**

**What makes you vulnerable: lack of education and policy on outside device use **

Hackers who want a direct route to company data often use a hardware device, such as a USB drive. A [_recent Google study_](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/45597.pdf) revealed that at least 45% of people who find a USB drive will plug it into their computers. Planted USB drives may contain malware or a link that requests information, similar to a phishing e-mail.

The worst-case scenario is a drive that contains a HID spoof. This is where the USB drive tricks the computer into believing the drive is actually a keyboard and then issues a set of keystrokes that forces the computer to dump data back to the hacker. It can also allow them access to whatever network the computer is connected to.

![HID spoof process](https://images.ctfassets.net/23aumh6u8s0i/6tgD3dKhZRBiDXExHQw0H3/b36a8b23e6518b6d0c93f44e0e0f69f3/hid-spoof-process)

_Solution: Outlawing anonymous, external drives on company devices will send a clear message to your organization. Whether a drive was planted or simply purchased from an illegitimate source, removing the temptation to plug something in without properly vetting is a low-hanging fruit that can have enormous power to secure your team and your end users._

## **4. Mobile Attacks**

**What makes you vulnerable: employees accessing company data and networks via cell phones**

Hackers are well aware of the explosion of smartphone and tablet use and have created attacks specifically designed for mobile software. [_The Pegasus attack_](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message.

<p style="text-align: center;">
  <img style="width: 300px;" src="https://images.ctfassets.net/23aumh6u8s0i/1ii40f6m9VQ1rBmWpgY1pF/de53a4b3444b16e607d52ee34bb9933e/pegasus-mobile-attack-on-ios" alt="Example of Pegasus attack on Apple iOS mobile software."/>
</p>

[_Source_](https://www.hax4us.com/2017/03/hindi-english-smishing-brother-of.html)

Phishing text messages are composed to look legitimate, just as phishing e-mails are. With Pegasus, clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. The software also copied all of their calendar, contact, and e-mail data.

Pegasus was an especially frightening cyberattack because it took advantage of [_“zero day” vulnerabilities_](https://www.huffingtonpost.co.uk/entry/what-is-the-pegasus-iphone-spyware-and-why-was-it-so-dangerous_uk_57c0043fe4b0ba22a4d3f930?guccounter=1), meaning there wasn’t any prior knowledge of the vulnerabilities in Apple’s iOS until Pegasus struck. Once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

_Solution: If a mobile phone or tablet has been breached, you need a Plan B. Make sure employees quickly change their passwords by using a professional password manager, such as [LastPass](https://www.lastpass.com/) or [Valt](https://valt.io/). Many employees secure critical information with easy-to-guess iterations of a single password. Encouraging length and complexity in all passwords going forward will make it difficult for hackers to access multiple areas at once._

## Additional Security for All Systems at the Login Stage

Good password policy and sound employee education are key; however, taking the next step with [secure login procedures](https://auth0.com/b2c-customer-identity-management) will add a new dimension of safety to your system. Specialized identity solutions providers can offer support with [multifactor authentication](https://auth0.com/docs/multifactor-authentication).

Tracking your users from the start will help eliminate fraud at its origin, helping provide a secure foundation to allow your team to scale.

<include src="asides/AboutAuth0" />


Four Cybersecurity Attacks Your Employees Need to Know

Airline industry cybersecurity - map your customer journey, incorporate passwordless registration, and profile enrichment to create a more enjoyable and secure UX.



Digital transformation starts with the customer. Understanding the full scope of a customer's journey and the numerous points at which s/he interacts with your company's products and services will serve as a guide when modernizing operations. This is especially important for airlines. While many might think that the flight is the only important part of the customer journey in air travel, critical communications take place starting from the customer's initial decision to buy tickets and book a flight through post-flight feedback and promotions.

![Customer flow and journey map in air travel experiences](https://images.ctfassets.net/23aumh6u8s0i/1e3QvqlOXJrYn7vvc7xiS2/0a5f087a19ce3842a8baf14ddc2f19c1/customer-communication-flow-for-air-travel)

While many airlines will have similar maps for their customers, you can tailor this to your specific brand using resources from companies like [ProsperWorks](https://www.prosperworks.com/blog/the-importance-of-customer-journey-mapping) and [Appcues](https://www.appcues.com/blog/user-journey-map) that delve into user personas and more advanced tools for approaching your research. However you go about visualizing the path your customer(s) take with your company, this exercise will help you notice the best places to make digital improvements.

## Enhance The Customer Journey: Key Tools In A Successful Digital Transformation

Once you've mapped out your customer journey, including details like booking processes and post-flight surveys that might be unique to your organization, it's time to hone in on key pain points. The customer's initial login experience and profile creation are areas that touch on and can help solve several issues at once.

### Passwordless Registration

Modernizing the first major point at which a customer or potential customer engages with your company online ensures a top-notch experience and sets the stage for enhanced security in the future. With [Auth0 Passwordless](https://auth0.com/passwordless), on the front end, you can offer one time codes or “magic links” delivered via SMS or e-mail.

![Slack, Medium, and Google login screens](https://images.ctfassets.net/23aumh6u8s0i/1dta6aEEQtIDZsZM95GKB5/341d5a8a1c593af4c61cec4b2f703a24/pwdless)

<include src="TweetQuote" quoteText="Modernize the first major point at which a customer engages with your company online: account registration."/>

([Source](https://auth0.com/blog/auth0-passwordless-email-authentication-and-sms-login-without-passwords/))

Instead of prompting customers to re-enter a password every single time, passwordless login can ease any frustration and mitigates risk of churn early on when you need to delight your users the most.

On the back-end, your team can combine passwordless login with additional security features like [anomaly detection](https://auth0.com/docs/anomaly-detection), suspicious logins, and centralized session revocation to build out a robust authentication system that double-checks each user truly is who they say they are.

For example, Auth0 partners with ThisData to [add specific alerts](https://thisdata.com/blog/how-to-add-suspicious-login-alerts-to-auth0/) regarding suspicious logins. After creating a ThisData account in the Auth0 dashboard, just add the Login Anomaly Detection Rule in the Access Control section.

![Adding a Login Anomaly Detection Rule in the Auth0 Access Control section](https://images.ctfassets.net/23aumh6u8s0i/6Xctx1Te0DCJX2HGkLDr0w/469da26559db8ea7e20e57515255fba8/create_rule)

([Source](https://thisdata.com/blog/how-to-add-suspicious-login-alerts-to-auth0/))

Auth0 [Rules](https://auth0.com/docs/rules/current) extend security features so that you can build and customize a solution on the back-end that supports all of your customers as they browse travel deals, flight times, select an itinerary, pay, check-in, and more. Not only will customers have an easier time exploring — you can ensure them that your app is a safe environment in which to share their personal information.

<include src="TweetQuote" quoteText="Auth0 Rules extend security features so that you can build and customize a solution on the back-end that supports all transactions with your customers. "/>

### Profile Enrichment

To better understand your customers and deliver more customized offerings throughout their journey, it's important to acquire all of the publicly available information you can to underpin your strategy. [Profile enrichment](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) is a tool that captures this data using third-party data APIs, such as [Clearbit](https://help.clearbit.com/hc/en-us/articles/115004646673-Enrichment-Overview). Again, working with Auth0 Rules, you can integrate this information into a 360-view of any of your customers:

![360-view of a customer's data using Clearbit](https://images.ctfassets.net/23aumh6u8s0i/4hegzXlz6MgwIeQK9Xqkhr/ec786f6ea738ee3be28a8626c6761056/clearbit-bi)

([Source](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/))

You can capture important points such as their location, employer, Facebook interests, and email address. Of course, given the strict rules about customer data in the wake of [GDPR](https://auth0.com/gdpr), it's important to communicate to your customers what data you've acquired, how, and why. Then, be sure you give them the option to edit or even opt out if they'd like. But it's also important that they understand how allowing you to view and work with this information can benefit them. For example, you can send them special deals in their geographic area or even tailor in-flight menu options that support a healthier lifestyle (if this is a clear interest of theirs).

Profile enrichment is a powerful feature that gives a team a more comprehensive understanding of its travelers and unveils myriad ways to support them along their path.

## Staying Secure in the Airline Industry

We mentioned this earlier and will say it again: in a challenging environment, airlines need all the support they can get in terms of security. The three resources above — a customer journey map, passwordless login, and profile enrichment — will help your company comply with laws like GDPR and help you build customer trust and loyalty down the line.

While physical security has been beefed up worldwide from more cameras, TSA guards, agents, guidelines, and rules, and even canines, it's cybersecurity that deserves equal if not more attention. Making sure you really know who is traveling on your aircraft — when, from where, their travel history, payment methods, and even friends and relatives — is all valuable data that, when stored in a central location and in an accessible format, can keep your entire company and all of its stakeholders safe.


3 Tools For Digital Transformation in the Airline Industry

ef2eecee7655f814bd7a9228ba0c6992?s=200 avatar

ef2eecee7655f814bd7a9228ba0c6992?s=200

I'm passionate about startup culture, leadership and employee engagement, coming from the experience of having left big corporate, packed up with my wife and kids and moved from Australia to the US to pursue startup life.

Director of Culture

Clayton Moulynox

…and other black tie insights from EY’s Entrepreneur of the Year® awards.



Two weeks ago, I suited-up in a tuxedo and Ubered my way to the **Ernst & Young Entrepreneur of the Year® Awards** at the Westin Seattle. On a day where my biggest achievement may well have been putting my own bow tie on, I was soon to be humbled by the achievements of the entrepreneurs being recognized at the gala.
"Humble" is a word I closely associate with entrepreneurs — at least those who "break the mold" (which was the very tagline the folks at EY were attaching to this event). Case in point: [_Eugenio Pace, Auth0 Co-founder and CEO_](https://auth0.com/blog/Eugenio-pace-auth0-CEO-wins-ey-entrepreneur-award/), and the reason I found myself in a monkey suit dabbling in libations and hors-d'oeuvres along with a number of colleagues as we posed for photos and obligatory (yet completely unnecessary) selfies outside the Grand Ballroom.
Eugenio, who I've worked closely with for over three years, was accompanied by his wife Maggie, and both seemed calm and relaxed — joining in our jovial conversations, saying hello to connections, smiling … always with the smiling these two … certainly not hung up on what others might perceive as the enormity of the situation. After all, some guy named Jeffrey P. Bezos won this award once.
Our group of ten was seated at lucky Table #30 in the ballroom enjoying our starters as the lights dimmed and formalities proceeded. We were reminded of the history of the event, some of the inspirational stories and the efforts and passions of many of the people behind it. It was clear we were expected to be rowdy and make some noise as on the tables were LED-lit half moon tambourines, whistles, and little hand drum things you spin across your palms. We utilized them effectively. Some videos introducing the finalists were played, including an amusing "what would you rather" video. Would you rather be in the *Hunger Games* or *Jurassic Park*? Eugenio chose *Jurassic Park*, "because I like running, and I think there would be a lot of running in that." (For the record, I'd choose the *Hunger Games* because, well, Jennifer Lawrence.)

<include src="TweetQuote" quoteText="What do @eugenio_pace, @JeffBezos, and Jennifer Lawrence have in common? Just this blog post, probably..."/>

As mains wrapped up the awards began. The format was to announce the finalists in a specific category (there were eight or nine categories in all) after which the golden envelope was opened on stage to reveal the winner. If you've ever watched the Academy Awards then you get the visual. There were a couple of categories and deserving winners before we arrived at the category that Table #30 was most invested in: B2B Software & Services. Eugenio and Auth0 were among some great Pacific Northwest nominees, including Manny Medina of Outreach.io and Todd Schwartz and Evan Richman, the co-founders of SkyKick.
"Ladies and Gentleman, the award goes to..." a pause for dramatic effect — I took the opportunity to arm myself with a flashing tambourine and hand drum twizzle stick thing — "the winner is Eugenio Pace." Table #30 goes wild! There are kisses, back slaps and handshakes at our table before Eugenio makes his way to stage.
Now, let me circle back to my earlier comment about being humble. In my interactions with entrepreneurs over the years, I've found them to be less in awe of what they've achieved but instead in greater awe of the people they've surrounded themselves with and what is still ahead to be achieved. From my relationship with him, this certainly rings true for Eugenio. And what he says on stage will probably have you convinced too.

<p style="text-align: center;">
  <iframe src="https://player.vimeo.com/video/275898844" width="640" height="360" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
</p>

On stage, Eugenio accepts his award: "Standing here, it's very tempting to think I am here on my own merits," he starts, "but I believe that self-made men are a myth. We are the product of the contribution and love of so many people in our lives and I've been very fortunate to have so many great people across my life." He specifically called out his grandparents, parents, sister, brother-in-law, teachers, wife, colleagues, and his team. He ended with "I'd like to think this award is yours as much as it is mine." Cue applause and mad waving of the sparkly tambourines.

The theme of humbleness and humility was largely present throughout the evening. Universal Cells CEO Claudia Mitchell, winner of the Life Sciences category, told the story of how she was supported by many people over her 20-year business journey, not least by her mother who originally lent her the money to found the company, but who tragically passed away just months before Mitchell's company was acquired for $100 million. CEO of Alaffia, Olowo-n’djo Tchala, another category winner, committed to taking his award to his mother’s grave in his home country of Toga in recognition of the contribution she'd had in his life and that of his seven siblings. Other award winners expressed similar sentiments.

<include src="TweetQuote" quoteText="Eight Auziros, our CEO, and his wife went to the @EY_EOY Awards. This is what happened."/>

Later that evening, when most of our crew had left, I was standing with Eugenio, Maggie his wife, and Jenna Isherwood, an awesome Auth0 colleague. His large shiny trophy was nestled on a window ledge next to us because it was too heavy to hold. We were enjoying another drink and laughing at each others' stories...ones we've probably all told before. Eugenio was tapped on the shoulder by a man he didn't know who congratulated him, wanting to know more about his thoughts on the security space. Of course, even in his celebration, he happily gave the man his time and attention. Buoyed as ever about the future. Humble as always.



<include src="asides/AboutAuth0" />


Award-Winning Entrepreneurs are Delightfully Humble

Positioning is based on completeness of vision and ability to execute



**BELLEVUE, Wash. -- June 19, 2018 --** [_Auth0_](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that it has been named as a Visionary by Gartner in its June 2018 Magic Quadrant (MQ) for Access Management. Positioning is based on completeness of vision and ability to execute.

“We appreciate Gartner’s evolving perspective on the Access Management landscape and their willingness to acknowledge Auth0 as a Visionary,” said Eugenio Pace, CEO and Co-founder of Auth0. “We are excited about our placement as a Visionary and consider it a milestone to land here in our first year participating in the process.”

Auth0 was founded in 2013 as a Universal Identity Platform that provides developers with extensibility, flexibility, and programmatic integration with identity into applications. From the company’s inception, Auth0 was created as an identity platform designed to handle the rigors of any possible use case: B2B, B2C, or B2E. Its universality has provided global enterprises with the ease of managing all identity through one single platform.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

<include src="asides/AboutAuth0" />

### Media Contact:

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898



Auth0 Debuts as a Visionary in Gartner Magic Quadrant for Access Management

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

...or at least, they won’t as often or as thoroughly as advertised.




Open standards in identity are a good thing. An excellent thing. They’re one of the few aces in the sleeve we have in our industry for keeping complexity under control. When it comes to selecting an open source SDK, assessing whether two or more solutions can collaborate, decomposing problems and requirements into well-known patterns and units of meaning that act as a common language the industry can use to communicate and make progress — open standards are the social norm that enables all that and more.



But it’s time for industry vendors to stop bragging about their support for open standards.


For one, ***open standards are now table stakes***: Do you hear wearables suppliers brag about their support for Bluetooth, or refrigerator manufacturers boast that they can plug in your country’s power grid without adapters? *Of course* they support Bluetooth and come with standard power cord — that barely deserves a mention on the package — the battle for winning your favor is fought on completely different features. Positioning support for bleeding edge standards like token binding or [WebAuthn as a differentiating factor](https://webauthn.me/) is indeed informative, but in the year 2018 support for SAML, OAuth2, and OpenID Connect should be a given.

<include src="TweetQuote" quoteText="Use of core identity open standards should be considered table stakes, says @auth0’s @vibronet."/>


But there’s a subtler point, an epiphany I myself had only recently. Contrary to what’s commonly boasted by providers, in the general case ***open standards in identity won’t prevent vendor lock-in***.

Can open standards help to decouple you from vendor-specific considerations? You bet they can — but only for the most basic entry points in their ecosystem. When considering solving the problem of identity and access management, it’s tempting to focus on the mechanics of authentication — and once that phase is solved, consider the matter closed. If you can get a JWT from vendor A using an OpenId Connect OSS SDK, you just proved to yourself that you can likely use the same SDK to repeat the process to get a token from vendor B — hence you feel locked to neither. Think about it for a moment longer, tho. Once the demo is done and all the hands have been shaken, your developers will start working with the vendor of choice and the tokens they’ll request won’t be for proving a point —they’ll be for invoking API, which in turn represents programmatic access to data and functionality. If you look at the reality of the industry today, you’ll see that very often the vendor supplying you with support for OpenId Connect & Co is also the owner of the API you are using to access data and functionality (documents, storage, calendars, inboxes and the like, plus any hosting/serverless capabilities).


Imagine your team fully embracing those API for say a couple of years, going for the deep integration that Mr. Bezos describes [here](https://www-geekwire-com.cdn.ampproject.org/c/s/www.geekwire.com/2018/jeff-bezos-amazon-web-services-lock-never-want-customers-trapped/amp/), then deciding to switch to a new vendor. Sure, the use of OpenId Connect means that adapting your clients to requests tokens from a different source should amount to a simple string update; that’s vastly better than if you’d have to switch between proprietary systems … which incidentally, is exactly what you’ll have to do to migrate all the assets you created using the data and functionality API which are downstream from the token acquisition, use, and validation phases. Which migration task do you think will bring the highest costs and complexity, hence creating those inhibitors traditionally associated to vendor lock-in?


To be clear, I am not saying that there’s anything wrong with the above; in fact, most vendors go out of their way to make your data exportable and help with transitioning it elsewhere if you so choose. The only thing I take exception with is the statement that a vendor using identity open standards will avoid vendor lock-in, as per the aforementioned argument identity is only a fraction of the things that you’ll most likely take a dependence on from a vendor’s offering.

<include src="TweetQuote" quoteText="Find out why @auth0’s @vibronet says open standards alone in identity won’t prevent vendor lock-in."/>

Now, with all that said. There is a notable exception in which the use of open identity standards won’t lead to vendor lock-in, and it occurs in the special case in which the vendor being considered only focuses on the identity aspects of the development of your solution. In that case, there is no upsell agenda! You already know where I am going with this: Auth0 falls exactly into that category of “pure breed” providers. If a vendor only focuses on helping you to easily implement standard-based authentication flows, if that’s the only thing you are paying that vendor for, then by definition, it will be easy to use the very same standards to point your applications to a different supplier. That’s not to say that the scenario prevents the solution from *also* taking dependencies on specific features — not every aspect coming into play in identity solutions is codified in form of standard —however, it is safe to say that “pure breed” identity vendors such as Auth0 come much closer to fulfilling the promise of sparing you from hard vendor lock-in.


Open standards in identity are an excellent thing. So good, in fact, that I propose that by now use of core identity open standards should be considered table stakes, a commodity offered by everyone rather than something to brag about —along the lines of what Carr discussed in his seminal article [IT doesn’t matter](https://hbr.org/2003/05/it-doesnt-matter). Moreover, vendors should articulate the advantages of open standards without hyperbole — they carry enough advantages on their own without having to attribute them magical properties such as the ability of single-handedly avoiding vendor lock-in, without specifying the special conditions (pure identity vendor) where that boast is almost true.

Learn more and [try a WebAuthn demo crafted by Auth0, here](https://webauthn.me/).

<include src="asides/AboutAuth0" />


Open standards won’t save you from vendor lock-in

Eugenio Pace joins ranks of mold-breaking entrepreneurs in B2B Software and Services category



**BELLEVUE, Wash. -- June 19, 2018 --** [_Auth0_](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that CEO Eugenio Pace has won the Entrepreneur Of The Year® 2018 Award in the B2B Software and Services category in the Pacific Northwest.

The award recognizes entrepreneurs who are excelling in areas such as innovation, financial performance, and personal commitment to their businesses and communities. Pace was selected by an independent panel of judges, and the award was presented at a special gala event at the Westin Seattle on June 15, 2018.

“To say that I’m truly humbled by this recognition is an understatement,” said Pace. “This award is a culmination of so many things - Auth0, our incredible team, customers, and my support system both inside and outside of the company. I am incredibly honored to be selected for this award.”

Pace continues to lead Auth0 through rapid growth, including more than 100% increase in customers and revenue in 2017 alone. The company also recently announced $55M in Series D funding and is experiencing global momentum as the demand for advanced, modern, and flexible identity management accelerates.

Since 1986, EY has honored entrepreneurs whose ingenuity, spirit of innovation and discipline have driven their companies’ success, transformed their industries and made a positive impact on their communities. Now in its 32nd year, the program has honored the inspirational leadership of such entrepreneurs as:

- Howard Schultz of Starbucks Corporation
- Pierre Omidyar of eBay, Inc.
- Jodi Berg of Vitamix
- Robert Unanue of Goya Foods
- Reid Hoffman and Jeff Weiner of LinkedIn
- Andreas Bechtolsheim and Jayshree Ullal of Arista Networks
- Hamdi Ulukaya of Chobani
- James Park of Fitbit
- J.W. “Bill” Marriott, Jr. of Marriott International, Inc.
- Lonnie Moulder and Mary Lynne Hedley, PhD, of TESARO, Inc.

As a Pacific Northwest award winner, Pace is now eligible for consideration for the Entrepreneur Of The Year 2018 National Awards. Award winners in several national categories, as well as the Entrepreneur Of The Year National Overall Award winner, will be announced at the Entrepreneur Of The Year National Awards gala in Palm Springs, California, on November 10, 2018. The awards are the culminating event of the Strategic Growth Forum®, the nation’s most prestigious gathering of high-growth, market-leading companies.

### _Sponsors_

Founded and produced by EY, the Entrepreneur Of The Year Awards are nationally sponsored in the US by SAP America, the Kauffman Foundation, and Merrill Corporation.

In the Pacific Northwest Region, sponsors also include Woodruff Sawyer.

## About Entrepreneur Of The Year®

Entrepreneur Of The Year®, founded by EY, is the world’s most prestigious business awards program for entrepreneurs, chosen from an independent panel of judges including entrepreneurs and prominent leaders from business, finance, and the local community. The program makes a difference through the way it encourages entrepreneurial activity among those with potential and recognizes the contribution of people who inspire others with their vision, leadership, and achievement. As the first and only truly global awards program of its kind, Entrepreneur Of The Year celebrates those who are building and leading successful, growing and dynamic businesses, recognizing them through regional, national and global awards programs in more than 145 cities in more than 60 countries. ey.com/eoy

<include src="asides/AboutAuth0" />

### Media Contact

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898


Eugenio Pace of Auth0 Named EY Entrepreneur Of The Year® 2018 Award Winner in the Pacific Northwest

Momentum signifies global demand for extensible identity management



**BELLEVUE, Wash. -- May 15, 2018 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced $55 million in Series D funding, bringing the company’s total financing-to-date to more than $110 million. This round is led by [Sapphire Ventures](http://sapphireventures.com/), and includes investment from [World Innovation Lab](https://wilab.com/), as well as from existing investors Bessemer Venture Partners, Trinity Ventures, Meritech Capital, and K9 Ventures. The funds will be used to continue innovation of the company’s Universal Identity Platform, accelerate go-to-market programs, and drive global expansion.

The funding represents another major milestone for the company, following a [banner year in 2017](https://auth0.com/blog/auth0-announces-record-year/) that included a doubling of overall customers and more than 100 percent revenue growth; 140 new employee hires; and the opening of additional offices in London, Sydney, and Tokyo. This growth is largely attributed to Auth0’s unique Universal Identity Platform, giving companies such as VMware, AMD, Mazda, NVIDIA, News Corp, and thousands of others the extensibility to customize the platform for their specific identity needs.

_“Our goal is to identify companies that demonstrate consistent high growth in an industry that has incredible market potential. Between the outstanding leadership of the company and their disruptive technology offering, Auth0 offers that unique combination and then some. We are incredibly excited to take this journey together and help them scale to global market leadership,”_ said Anders Ranum, Partner at Sapphire Ventures.

_"Corporations in Japan are looking for a scalable, unified identity platform that can cover complex use cases, and Auth0 is best positioned to serve such increasing needs,"_ said Rob Theis, General Partner at World Innovation Lab.

In today’s global economy where cloud architecture dominates, companies are seeking ways to converge platforms to simplify their technology and save time and resources. Auth0’s platform can fulfill any identity scenario, whether it’s for consumers, business partners, employees, or IoT devices, and eliminates the need for multiple identity providers.

_“We are humbled by the support from our investors, and emboldened in our mission to provide the most extensible, powerful, and easy-to-use identity management solution available,”_ said Eugenio Pace, CEO and Co-founder of Auth0. _“We look forward to using these funds to make our product and company even better, and to continue offering value to our incredible customers around the world.”_

## About Sapphire Ventures

Sapphire Ventures is a venture capital firm focused on helping innovative technology companies become global category leaders. Leveraging nearly two decades of experience and an extensive global enterprise network, Sapphire Ventures invests capital, resources and expertise to enable its portfolio companies to scale rapidly. Whether entrepreneurs sell to businesses, consumers or both, Sapphire Ventures offers a powerful platform for business development and operational excellence to help them accelerate growth. With $2.5 billion under management via direct growth investments and early-stage fund investments, Sapphire Ventures is positioned to elevate companies to the global stage.

## About World Innovation Lab

World Innovation Lab (WiL) connects entrepreneurs with corporate resources to build global businesses. WiL is a multi-stage venture capital firm that invests in consumer and enterprise technology companies. With a deep network of global corporate partners, the firm is committed to providing startups with unparalleled investment and partnership opportunities. World Innovation Lab's foundational platform includes the Japanese government investment arm and over 20 Japan leading corporations such as Sony, Nissan, All Nippon Airways, Mizuho Bank, Daiwa Securities, NTT, and KDDI. In addition to venture investment, WiL also collaborates with the world’s leading companies to incubate new businesses and to create spin-offs and joint ventures.

<include src="asides/AboutAuth0" />

### Media Contact

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898


Auth0 Announces $55M in Series D Funding

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. <br /><br />Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. <br /><br />She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Access to information is valuable but it is also dangerous. Auth0 CISO Joan Pepin explains why information warfare is a big deal



## How Critical Thinking Skills Can Protect You From Malicious Actors

From the outside, my job as Chief Information Security Officer for Auth0 might look like it’s about devices, apps, protocols and procedures, but those are just my tools. Access to information is valuable but it is also dangerous. My job is really is about balancing the opportunities and risks that information presents.So information warfare is a big deal for me.

The thing is, information warfare didn’t start with the [Russians](https://www.washingtonpost.com/news/the-fix/wp/2018/02/16/3-things-we-just-learned-from-the-indictment-of-13-russians-in-the-mueller-investigation/).

**An Ancient Strategy for Modern Encryption**

“All warfare is based on deception.”
— Sun Tzu, The Art of War (550 BC)

Back in 550 BC, Sun Tzu recommended sharing false information as a means of attack.
Granted, back then, a single human was limited to face-to-face and hand-transported written communication. In the time it would have taken one of Sun Tzu’s spies to share a sentence, false information can now reach thousands via the internet, each of them geometrically expanding the reach of a single message.

Even thousands of years ago, during the time of Alexander the Great, an ancient general on the hill would see the battle and would get one of his chariot commanders to flank to the east and summon a trusted messenger.

He’d use his secret encoder ring to craft a message on a piece of papyrus, then he’d roll it up and seal it with wax, hand it to that trusted messenger, and send him down the hill.
The chariot commander would recognize the messenger and know that he was a trusted source information.

He’d also recognize the seal authenticating the message.

And since he’d be the first to crack the seal, he’d validate that it had not been intercepted.
Using his own secret encoder ring, the chariot commander would decode the message. For safekeeping, he would also kill the messenger and burn the papyrus.

That ancient strategy also describes modern encryption and privacy on the internet. Those fundamentals have not changed.

We still need to know that the sender is in fact who the message claims it to because this implies that the content of the message could be genuine.

We still need to ensure that the message has not been intercepted or used inappropriately. And, finally, similar to the killing of the messenger and the burning of the papyrus, we need to know that at the end of its life cycle a message was destroyed in a way that rendered it unable to be reproduced.

This is the full life cycle of safe information.

If you’re going to base a business decision on information, you want to validate these same basic things and verify them. And when you delete the message, you want it to be gone forever.
Today, after the very end of tax season, I have a friend who goes through a shredding ritual. He goes through his filing cabinet and shreds everything he doesn’t need, since information is both an asset and a liability. Deleting was just as valid in Alexander’s time as it is today, but much the way the methods for making [Greek fire](https://www.ancient.eu/Greek_Fire/) have been lost to time, we are losing the ability to validate and verify information.

**Swaying Public Opinion through Volume**

By the time the Klondike Gold Rush came around, person-to-person verification still occurred, as did accurate message sharing through the newspapers, but the volume of communication available through mass printing offered a new opportunity to control the story.

While promoting Seattle during the Klondike Gold Rush, Erastus Brainerd used newspaper advertising and feature stories to [sway public opinion](https://www.nps.gov/parkhistory/online_books/klse/hrs/hrs2.htm) in a way that had never been done before. His stories appeared in the local papers, in advertisements across the U.S., and again in letters sent directly to various chambers of commerce offering Seattle as the pathway to riches — which proved extremely convincing in the wake of one of the United States’ greatest economic depressions, the Panic of 1893.

People sold everything they had and rushed to Seattle. But travelling across the country (or globe) took time and money and snail mail delivering personal stories was equally slow. By the time the story of Seattle was proven to be more propaganda than truth, many didn’t have the funds or the heart to head home to share their stories. Of the 100,000 who rushed to the Klondike, only 30,000 made it, and only 4,000 found gold.

Historians often say the 1893 depression made people more vulnerable to stories of riches. But newspapers had evolved into a trusted source of information. These stories were reportedly “true,” which encouraged people to shift their critical thinking responsibilities to the papers.

This public opinion campaign established Seattle as a primary city in the Northwest. Companies like Nordstorm and Filson got their start as a result of the Klondike Gold Rush, eventually seeding the start of companies like Microsoft and Amazon. Clearly, opinion campaigns can have lasting effects on the real world that end up impacting global history.

Today, the machinery of our society runs on information and spreads it far faster than Brainerd’s stories. There’s far more information made daily than Brainerd produced in his entire campaign. There’s more machinery to produce it, distribute it, and consume it. Now more than ever, we need that ancient skill of being able to quantify and qualify our information.

![Information warfare infographic](https://images.ctfassets.net/23aumh6u8s0i/4dgBv709nq0eiwi0R429nE/4b9f19a1aa428d57e6643815e052b694/information-warfare-infographic)

<include src="TweetQuote" quoteText="There’s more machinery to produce, distribute, and consume information. Now more than ever, we need skills that helps us quantify and qualify our information."/>

## Why People Should Think More like Spies

*“…there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don't know we don't know.”*

Back in 2002, the U.S. Secretary of State Don Rumsfeld caught a lot of flak about his unknown knowns statement. The reporter was after a direct answer about the lack of evidence linking the government of Iran to terrorist groups with weapons of mass destruction.

“Unknown knowns” and “known unknowns” came across as gibberish to both the right and the left. But for the spooks and spies tasked with analyzing and understanding information from a globe of sources, Rumsfeld’s Unknown Knowns statement actually described a taxonomy of information.
Let me break down with an example about a suspected danger — maybe a bomb or a shooter —  in a building and whether or not that intel can be validated:

**There are known knowns**: We have intel that tells us something bad might occur in a specific building in a specific city.

**There are known unknowns**: While we know the city and the building, we don’t know when the bad thing might happen or what it is.

**Unknown knowns**: Because we’re not entirely certain we can trust the source of the information, we might know additional information without realizing it’s a salient detail. For example, April might be a critical month one source. May might be a critical month for another.

**There are unknown unknowns**: Because we lack complete information, there may be additional things — like the number of bombs or shooters — that we aren’t able to determine.

<include src="TweetQuote" quoteText="Like a station chief looking to decide which intel to trust, an era of information warfare should lead you to ask similar questions."/>

## Thinking Beyond the TV Box

When I was growing up, public opinion could be swayed by the fact that the majority of us were tuning into the same TV shows at the same time on the same channels.
Maybe because TV was a relatively young medium or because Americans had become significantly more jaded since the Klondike, my mother would warned me not to believe most anything I saw on TV.
But I liked all the voices on TV. I liked them so much that my mother put me on a TV budget. I was allowed a half an hour in the morning and another half an hour in the evening.
For my evening budget, I chose the evening news with Walter Cronkite.
Why? Because even though my mother had warned me against all the other voices, Walter Cronkite was a bit different. With his voice and later Tom Brokaw, there was an understanding that the media might have a certain bias, but it was also understood that one could easily compensate for that bias by using your own brain.
I understood that someone had crafted the story I was watching. Maybe Walter is a little more on the left than the right, but they weren’t lying.
Typically, it was easy to find another reasonable POV to use as a check. You could watch the slightly left-leaning evening news and pick up the slightly right-leaning newspaper and between those two you could easily determine the truth, as well as gain a deeper understanding of both sides. Now information has become so divergent that picking two sources and triangulating between them is not good enough.

## The Risk of Unqualified Trust

Current frustrations can make it sound like the media is in full control of all the stories. Back then, my mom drilled into my head that I had to figure out **what** someone was really saying and **why** someone might be saying it, the media actually held more power than it does today because people got the majority of their news from television, radio, and the newspapers. With the social media we’ve gained voices we might never have heard, but lost the vetting and some of our individual critical thinking skills — and allowed untrustworthy sources direct access.
Within this context, the trust that resided with journalists has been transferred to our network of friends and colleagues.
If my mom reads something on Facebook she accepts it as truth because it’s been shared by people she trusts, which is why rapid sharing without fact checking and validating sources can be so dangerous.

Everyone knows fake news is out there, but if everyone trusts the people in their feeds, who are trusting the people in their feeds and so on, it gives malicious actors an easy way to sneak in.
We need a web of trust to make this internet thing work, but that also means that each of us has the responsibility to make sure that the message we’re amplifying is an accurate one, because regardless of your political position, inaccurate info does no one any good.

## Vetting Info in the Era of Divergence

Although spooks and spies gather information, it’s the station chief who decides its value.
In the absence of a Cronkite or a Brokaw, that responsibility when reading a news story has shifted to you.
We are each our own information qualifier — and qualifying a news story today is harder than it was when I was a kid watching the evening news.
Instead of having to adjust for tone or delivery, thanks to information warfare, you could be staring at something from an untrustworthy or highly motivated source that was shared to gain a specific reaction — [like influencing presidential elections](http://www.businessinsider.com/cambridge-analytica-boasts-won-trump-election-facebook-data-2018-3).
Even if you try the old trick of triangulating with multiple voices, you might realize you’re in a social media echo chamber, where multiple people or companies you respect have reposted information from the same source. In this environment, it’s spectacularly easy for a single individual to reach out to multiple sources to control the narrative.
During the Cronkite era, information consumers regularly enjoyed vetted stories told with the help multiple validated sources. Consuming structured information made it easier to look for and recognize the most reliable patterns.
Since we’re consuming so much unstructured information, we have to work harder to ask the questions that help us know if the information before us is genuine and to validate and authenticate before sharing.
Because information is now so divergent, the burden is on you.


Information Warfare Offensive

Leading tech companies join forces to create protocols around identity data



**BELLEVUE, Wash. -- May 8, 2018 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that it has joined the [Decentralized Identity Foundation](http://identity.foundation/) (DIF) to collaborate and provide insight on creating a standards-based ecosystem for managing digital identities. Initiated by executives from Microsoft, uPort, Gem, Evernym, Blockstack, and Tierion, the Decentralized Identity Foundation addresses an ever increasing need for governance around identity and authentication.

Auth0 will work alongside companies such as IBM, Accenture, RSA, IDEO, and others within the foundation to create specifications for securing and accessing identity data. The three foundational elements of a decentralized ecosystem are to:

1) Enable registration of self-sovereign identifiers that no provider owns or controls;

2) Offer the ability to look up and discover identifiers and data across decentralized systems;

3) Provide a mechanism for users to securely store sensitive identity data, and enable them to precisely control what is shared with others.

“Digital identity is the core of every interaction, transaction, and communication online, but it’s a little like the Wild West right now in terms of standards and specifications around how identity could be handled in a decentralized manner,” said Martin Gontovnikas, Vice President of Marketing at Auth0. “There is an important need for strong voices to shape the future of this industry, and we are looking forward to our involvement with the Decentralized Identity Foundation.”

<include src="asides/AboutAuth0" />

### Media Contact

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898


Auth0 Joins Decentralized Identity Foundation

The awards program recognizes entrepreneurs who are excelling in areas such as innovation, financial performance, and personal commitment to their businesses and communities.




**BELLEVUE, Wash., May 7, 2018 –** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that CEO and Co-founder Eugenio Pace has been named a finalist by EY for its Entrepreneur Of The Year® 2018 Award in the Pacific Northwest. The awards program recognizes entrepreneurs who are excelling in areas such as innovation, financial performance, and personal commitment to their businesses and communities.

“I am honored to be considered for this very prestigious award, alongside such outstanding entrepreneurs from the Pacific Northwest,” said Pace. “Auth0 is experiencing tremendous growth and success, none of which would be possible without the incredible people I work with. This award is an amazing recognition of the collaboration between our team, our product, and our valued customers.”

Pace was selected as a finalist by a panel of independent judges. Award winners will be announced at a special gala event on June 15 at the Westin Seattle. Now in its 32nd year, the program has expanded to recognize business leaders in more than 145 cities and more than 60 countries throughout the world.

Regional award winners are eligible for consideration for the Entrepreneur Of The Year National competition. Award winners in several national categories, as well as the Entrepreneur Of The Year National Overall Award winner, will be announced at the Entrepreneur Of The Year National Awards gala in Palm Springs, California, on November 17, 2018. The awards are the culminating event of the Strategic Growth Forum®, the nation’s most prestigious gathering of high-growth, market-leading companies.

Sponsors
Founded and produced by EY, the Entrepreneur Of The Year Awards are nationally sponsored in the US by SAP America, the Kauffman Foundation and Merrill Corporation.
In the Pacific Northwest, sponsors also include Woodruff Sawyer.

About Entrepreneur Of The Year®
Entrepreneur Of The Year®, founded by EY, is the world’s most prestigious business awards program for entrepreneurs, chosen from an independent panel of judges including entrepreneurs and prominent leaders from business, finance, and the local community. The program makes a difference through the way it encourages entrepreneurial activity among those with potential and recognizes the contribution of people who inspire others with their vision, leadership and achievement. As the first and only truly global awards program of its kind, Entrepreneur Of The Year celebrates those who are building and leading successful, growing and dynamic businesses, recognizing them through regional, national and global awards programs in more than 145 cities and more than 60 countries. ey.com/eoy

<include src="asides/AboutAuth0" />

### Media Contact

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898


Auth0 CEO Eugenio Pace Named EY Entrepreneur Of The Year® 2018 Award Finalist in Pacific Northwest

Identity expert Vittorio Bertocci joined Auth0 as Principal Architect. Find out what he thinks companies miss when they think ‘identity.’



## Auth0 Welcomes Vittorio Bertocci to the Team

If you’ve heard [Vittorio Bertocci](https://www.linkedin.com/in/vittoriobertocci/)’s sessions at events like BUILD, Microsoft PDC, and many other industry events around the world, you know why we are so excited he is joining Auth0.

During his lengthy career with Microsoft, Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware) and turned Auth0 co-founders Eugenio Pace and Matías Woloski onto the concept of identity.

So, if you’ve been missing out, don’t worry. We’ve got you.

<include src="TweetQuote" quoteText="Please join us in welcoming @vibronet to @auth0! Find out what he thinks companies miss most when they think ‘identity’ (and what he’ll be doing for @auth0)."/>

As Auth0 Principal Architect, Vittorio will be applying his skill for rendering complex ideas clear in webinars and customer meetings.

We’ll frequently share his expertise, but if that’s not enough, you can still find Vittorio’s many articles online, get his [books on identity](https://www.amazon.com/Vittorio-Bertocci/e/B001JSFAPC/ref=sr_ntt_srch_lnk_2?qid=1524600242&sr=8-2-fkmr0), check out his blog at [cloudidentity.com](http://www.cloudidentity.com/blog/), follow him [@vibronet](https://twitter.com/vibronet), or catch him at his next speaking engagement.

![Vittorio Bertocci](https://images.ctfassets.net/23aumh6u8s0i/3OmJg0exZxZthSn2MZDSrN/dc8654b3a014e0ef7b7c515ec13ffb0a/Vittorio_193)

Since today is his first day at Auth0, we thought we’d seed future conversations with a few introductory questions.

**What do most companies miss when they start thinking about “identity?”**

Ha! I hate to answer the very first question with “it depends,” but it truly does. Every company, large or small, already has experience with identity — after all, business is made of people, and identity just happens to be how employees, partners, and customers access resources to perform the functions their company needs them to fulfill.

On one extreme of the spectrum, you have very large companies, with a significant investment in traditional identity solutions. Those solutions are normally very good at hiding complexity from users and developers… as long as the action takes place within the boundaries of their network. As those companies start their journey through digital transformation, they are forced to operate with resources and actors outside of their boundaries… and rediscover many of the challenges that their infrastructure hid from them. The good news is that those challenges can be tamed, and doing so leads to even higher levels of productivity.

On the other extreme, there are companies like ISVs providing services to individual users, who start venturing toward the world of enterprise integration as their services evolve to work with business users. The thing that typically surprises developers at that stage is just how much higher the bar is when it comes to data control, consent, policies, SSO, and compliance. Once again, the good news is that there are solid patterns in place that can help integrate with businesses and satisfy those new requirements, without giving up any of the agility of existing solutions.

**Which three identity trends most intrigue you?**

The first one is easy to pick, as it goes well beyond identity: it’s the increasingly common expectation that everything can be accessed programmatically, through an API. This is one of the most impactful revolutions in recent years. It is empowering more people to tap into existing data and capabilities, and build on it, rather than forcing them to reinvent the wheel or even give up on great ideas because laying the fundamentals is too expensive. As identity practitioners, we have the opportunity and responsibility to make those scenarios possible —connecting users to data and application with the least friction, while ensuring that access occurs respecting policies, consent, and all the appropriate security and access control hygiene.

The second trend I am observing with interest is the increased attention to protect artifacts used in OAuth2, OpenID Connect, and modern protocols in general: token binding, proof of possession, and [Webauthn are all signs that our industry is maturing](https://webauthn.me/), and the pendulum is once again swinging toward providing viable solutions for high assurance scenarios. Those were all considerations that were top of mind back in the time of the WS-star protocols (which, incidentally, is still my car’s license plate to this day!), but in those days, those properties were a complexity price to pay upfront — an entry ticket for using those protocols, regardless of whether your scenario called for it or not. The modern efforts to bring back those assurances to contemporary protocols takes an incremental approach, so that new capabilities can be gracefully introduced as needed. I like that, and I think it will do a lot of good for many high-value scenarios.

For the third trend: Regardless of whether one thinks it is a revolution or mostly hype, I don’t think I can exempt myself from naming Blockchain here.

<include src="TweetQuote" quoteText="Learn about @vibronet’s 3 most intriguing identity trends — and help us welcome him to @auth0!"/>

**Why Auth0 and why now?**

In a nutshell: excellence and customer obsession.

Leaving my position at Microsoft has been one of the hardest things I have ever done in my life — the Azure AD team is amazing, Microsoft as a whole is doing everything right, and I was lucky to be successful and do meaningful work there.

Microsoft is a universe in itself. As cloud scenarios rose in importance, I found myself spending more and more time dealing with internal customers, with less time to work with external customers and the industry. Although that’s very interesting and impactful work, my true passion lies with the developer community. Auth0 has done amazing work with developers since its inception, adapting to the industry trends and customer requirements with dazzling speed, flexibility and overall excellence. Add to that the tremendous respect and admiration I have for Eugenio and Matías, and you’ll easily see why I am so excited to join Auth0 and do my best to contribute to its growth.

**What will you be doing for Auth0?**

The field is wide open! Initially I’ll focus on standards and internal/external education. Most importantly, I’ll cultivate a beginner mindset — absorbing everything I can learn about the company, technology, customers, culture, you name it. Hopefully that will equip me to contribute to product innovation, feeding the virtuous cycle that ties customer [Jobs-to-be-Done](https://auth0.com/resources/webinars/the-jobs-to-be-done-framework) into features and solutions.

**Welcome to Auth0, Vittorio! We are so excited to have you.**


"cybersecurity"