df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Streaming companies must adapt to unprecedented network strain

Everyone is coping with the Coronavirus pandemic in their own ways, yet people around the world seem to share a few rituals: washing our hands, wearing masks, and of course, catching up on our Netflix queue. 

With much of the world’s population stuck at home under social distancing, quarantine, and mandatory lockdowns, consumer spending on streaming has increased [anywhere from 20% to 50%](https://www.nytimes.com/interactive/2020/04/11/business/economy/coronavirus-us-economy-spending.html) depending on the channel. Given this unprecedented surge in demand, it’s not hyperbolic to say the internet is going through the most intense stress test in its history.

The global desire for entertainment and escapism is [creating a windfall for streaming services](https://www.cnn.com/2020/03/02/investing/coronavirus-stay-at-home-stocks/index.html). Netflix, for example, [more than doubled](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown) its projected number of new subscribers since the pandemic began, and [Disney+ added](https://www.theguardian.com/media/2020/apr/09/disney-netflix-rival-doubles-subscriptions-in-virus-lockdown) 22 million subscribers as well. However, a combination of network slowdowns (and failures) and streaming models that don’t monetize increased traffic means that the situation for streaming media companies is more complicated than it first appears.

Media companies are facing new challenges and new opportunities and working to develop technological solutions that help them weather this historic moment.

## Quarantined Nations Increase Their Streaming Time

We can see the effects of COVID-19 on streaming services by watching how currently quarantined countries (those hits hardest by the virus) have been behaving. Even without a full-blown quarantine, the rise of voluntary social distancing and enforced isolation creates at least a comparable situation.

Though China [is showing signs of recovery](https://www.cnn.com/2020/03/19/asia/coronavirus-covid-19-update-china-intl-hnk/index.html), they implemented mass quarantine first and can give us useful data on streaming behavior. Chinese Nielsen [data shows a significant rise](https://mp.weixin.qq.com/s/vxKFJOFeXLWuasuvtu7kBw) in TV viewing, but people are also streaming less conventional content. Quarantined Chinese citizens are getting creative with streaming entertainment, [streaming concerts](https://www.nytimes.com/2020/03/04/arts/music/arts-coronavirus.html), and [setting up digital clubbing and digital gyms](https://www.bbc.com/news/world-asia-china-51628693) in their living rooms.

Italy, still in quarantine, has seen a similar rise in streaming content, with an average viewing-time increase of [11% nationally with highs of 17%](https://www.corriere.it/spettacoli/20_febbraio_29/effetto-coronavirus-volano-ascolti-telegiornali-talk-9399464c-5afe-11ea-8b1a-b76251361796.shtml?refresh_ce-cp) in the Lombardy region. During the nationwide quarantine, the Italian telecoms giant Telecom Italian SpA has reported an overall [70% increase in internet traffic](https://www.bloomberg.com/news/articles/2020-03-12/housebound-italian-kids-strain-network-with-fortnite-marathon) from work-from-home traffic and daytime online gaming.

**The spread of the novel coronavirus is also forcing studios and streaming services to rethink how they create and distribute content**, jumping release dates forward, skipping the box office, and closing down production. This will all lead to greater strain on streaming services and the larger internet.

The outbreak is closing theaters [across the United States and across the world](https://www.npr.org/2020/03/17/817136846/as-coronavirus-shuts-down-theaters-universal-shifts-some-films-to-on-demand), which has been linked to a [13% rise in streaming in the US that could rise up to 60%](https://time.com/5806060/coronavirus-movie-theaters-streaming/) based on prior crises. Production companies are fighting this by streaming [first-run movies straight to home services](https://www.vulture.com/2020/03/coronavirus-is-pushing-movies-online-faster-than-ever-before.html): Universal released _Emma_ and other new movies to streaming services, the new Pixar movie _Onward_ is going right to Disney+, and huge films like _Frozen 2_, _Birds of Prey_, and _The Invisible Man_ are coming much sooner than their prior release date.

While these first-run movies popping up on streaming services does create a large viewership base at home, it may not lead to the massive streaming profits being predicted.

<include src="TweetQuote" quoteText="Consumer spending on streaming media is up 20-50%. What streaming media companies can do to make sure they can withstand the quarantine-driven stress test."/>

## Streaming Services Are Doing Better Than Expected

It seems like a simple, logical equation: more time at home equals more streaming, which means greater profits for streaming services. But many streaming services, like Netflix, aren’t modeled to reap more profits from an increase in individual streaming time - which is why some were predicting that Netflix might not see a huge boost in profits.

 “If you have to decide between food and your Netflix subscription, it seems to me like you disconnect your Netflix. You’re probably not going to add another $13 a month if you don’t know when your next paycheck’s going to come in.” — Laura Martin, the senior entertainment analyst at Needham & Company, [told the Guardian](https://www.theguardian.com/film/2020/mar/12/coronavirus-binge-watching-netflix-streamers-viral).

**Netflix doesn’t monetize volume**. They make their money [from subscriptions](https://www.vox.com/2019/12/17/21025154/netflix-global-growth-numbers-sec-streaming-investors) ([and some product placement](https://www.cnbc.com/2017/07/27/bill-gates-ben-does-product-placement-in-netflix-and-amazon-shows.html)). The stock market reflects this uncertainty — Netflix has seen [less than a quarter of a percent of growth](https://www.cnbc.com/quotes/?symbol=NFLX) in the last month.

However, despite a [majority of consumers being aware of Netflix](https://morningconsult.com/2019/09/19/in-tvs-content-war-netflixs-shows-capture-biggest-share-of-viewer-awareness/) before lockdown and quarantine conditions, Netflix has seen a surprising surge in subscriptions. In fact, they’ve doubled their estimates: from an estimated 7 million new subscribers [to 15.77 million new subscribers](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown). 

This may be a temporary situation however: considering the shutdown of television and movie production across the board, time will tell if new subscribers will stick around for old content.

**A la carte streaming services like Amazon Prime may see a boost in revenue**. An Amazon Prime subscription [nets users a variety of shows and movies](https://www.businessinsider.com/amazon-prime-benefits-what-is-included) for “free,” like Netflix, but the newest releases must be rented or purchased.

Then again, despite the [rush of online ordering](https://blog.aboutamazon.com/company-news/amazons-actions-to-help-employees-communities-and-customers-affected-by-covid-19) and their strong grip on streaming media, [Amazon stock isn’t seeing much of a surge either](https://www.cnbc.com/quotes/?symbol=AMZN). Though the entire stock market has taken a hit, [early predictions that streaming company stock would be safe refuges](https://nypost.com/2020/02/28/how-coronavirus-benefits-netflix-and-other-in-home-services/) may have been premature.

Meanwhile, Twitch — the [most popular streaming service](https://www.nytimes.com/2019/12/15/business/tech-video-game-streaming-twitch.html) for gaming videos and livestreams — [has seen a 10% growth](https://www.theverge.com/2020/3/18/21185114/twitch-youtube-livestreaming-streamelements-coronavirus-quarantine-viewership-numbers) in viewership as of March 18. Unlike Netflix or Amazon Prime, Twitch monetizes through ads and will likely see a commensurate rise in revenue.

But differing monetization methods don’t tell the whole story. These potential revenue boosts or profit stagnation trends are dependent on network architecture surviving the sudden swell of usage, which may not be a guarantee.

## Strained Network Architecture Will Need Relief

Social distancing and quarantine [are closing schools](https://www.npr.org/sections/health-shots/2020/03/16/816428320/coronavirus-u-s-enters-quarantine-life-as-many-schools-and-businesses-close) and [workplaces](https://www.washingtonpost.com/national/coronavirus-outbreak-shutdown-america/2020/03/13/d8589434-6550-11ea-acca-80c22bbee96f_story.html), which means a glut of people at home streaming media for entertainment, work, and educational purposes placing unprecedented strain on the internet. Some websites are [even taking bets](https://www.sportsbettingdime.com/news/odds-global-netflix-outage-playstation-network-xbox-live-crash/) on which streaming or web service will go down next.

[Microsoft Teams crashed](https://www.independent.co.uk/life-style/gadgets-and-tech/news/microsoft-teams-service-status-crashes-outage-issues-today-work-home-down-a9404771.html) under the increased load of remote video conferences, and YouTube and Netflix have started [throttling quality on their videos](https://edition.cnn.com/2020/03/19/tech/netflix-internet-overload-eu/index.html) in order to reduce bandwidth in the face of the surge. Hulu [users reported a widespread outage](https://www.cnet.com/news/hulu-is-down-as-users-complain-of-videos-not-loading/) on March 20, one that seemed to affect multiple devices:

![hulu-activity-03-20-2020](https://images.ctfassets.net/23aumh6u8s0i/6Gp4ntk7M1cxNGwTHZxD3k/049ae9a357782e60896684ff437b7297/hulu-activity-march-20-2020)
[DownDetector.com](http://DownDetector.com) - Hulu - March 20, 2020

Many companies [suspended their data caps](https://www.cnet.com/news/carriers-are-suspending-internet-data-caps-during-coronavirus/) and [increased streaming limits](https://www.pcgamer.com/discord-ups-streaming-viewer-limit-while-coronavirus-keeps-people-at-home/) in order to help people stay entertained and in contact during isolation and quarantine. However, these acts of generosity may increase the amount of simultaneous traffic online.

Streaming services may need to try new network solutions to stay ahead of this bloom of potentially network-crashing traffic.

## Private Cloud Boosts Streaming Infrastructure

In the face of this inflating audience and inflating screen time, streaming services using a public cloud may want to consider other options to bolster their network architecture.

There’s nothing wrong with choosing a public cloud; it’s a perfectly reasonable option for a smaller streaming service. Larger streaming services, however, can increase their bandwidth and reduce their downtime and slowdowns with a private cloud solution.

A private cloud service like Auth0 offers scalability and can provide a [greater request-per-second](https://auth0.com/blog/how-finservs-can-reduce-risk-increase-innovation-with-private-cloud/) (rps) baseline — one that can add capacity as needed. It also has enhanced uptime over a public cloud, with a guaranteed 99.99% uptime.

<include src="TweetQuote" quoteText="How private cloud can help streaming companies withstand quarantine streaming pressures."/>

A private cloud doesn’t share resources or bandwidth with other companies, which is where a public cloud can sometimes struggle. Public cloud services like AWS do create server instances as needed, but they’re doing that for every business or individual using the service. COVID-19 isolation causes internet traffic to increase through every channel — streaming media, [communication](https://www.voicesage.com/blog/communication-best-practices-for-organisations-working-to-contain-covid-19/), [education](https://nypost.com/2020/03/17/coronavirus-in-ny-teachers-prepare-for-unprecedented-challenges-of-remote-learning/), and more — public cloud services are going to be hit from multiple angles at increasing speeds.

A private cloud can help streaming companies with servers dedicated to their businesses. Moreover, a private cloud can be managed or unmanaged, depending on whether you have the time and dedicated staff to maintain it.

## Getting Through This Together, Apart

The COVID-19 pandemic is a situation without precedent, creating entire nations of at-home workers, students, and entertainment-seekers all jumping on the internet at the same time. And with isolation and [lockdown orders](https://www.wsj.com/articles/china-reports-no-new-domestic-coronavirus-infections-for-the-first-time-since-outbreak-started-11584611233) coming [faster every day](https://www.washingtonpost.com/world/2020/03/20/coronavirus-latest-news/), this isn’t a situation [likely to change in the immediate future](https://www.washingtonpost.com/health/2020/03/16/social-distancing-coronavirus/).

Keeping streaming services going is a necessity for education, entertainment, and the economy. After a discussion with Netflix CEO Reed Hastings, the Internal Market Commissioner of Brussels, Thierry Breton, had this to say in [a statement to Politico](https://www.politico.eu/article/brussels-in-talks-with-netflix-about-reducing-internet-congestion/):

 “We all have a joint responsibility to take steps to ensure the smooth functioning of the internet during the battle against the virus propagation.”

With scalable network solutions such as a private cloud, we can deploy and use more servers to keep everyone entertained, educated, in shape, and in contact with one another until the situation is resolved. And, hopefully, we can all get back to business — and life — as usual.

<include src="asides/AboutAuth0" />

The (Surprisingly Complex) Impact of COVID-19 on Streaming Media

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

Find out how step-up authentication can make media paywalls more user-friendly while discouraging churn.

## Think Paywalls Always Mean Unhappy Customers? Think Again.

CTO's in the media world are constantly juggling multiple, sometimes conflicting, priorities with how they manage access to their content. They have to combat user churn, drive revenue through a mix of ads and subscriptions, and maintain healthy traffic and SEO rankings.

In recent years, the paywall has evolved into an effective tool for balancing these needs, boosting subscriptions by restricting what content non-registered users can access.

The [_New York Times_](https://www.forbes.com/sites/greatspeculations/2017/05/04/new-york-times-digital-subscriptions-continue-to-drive-growth/#2a20a548295c), for example, increased its revenue through digital subscriptions under its paywall, even as ad revenue declined. However, using a paywall often comes at a cost to user experience (UX), and companies are wary of driving away users by forcing them to enter in their credentials.

[Step-up authentication](https://auth0.com/docs/multifactor-authentication/step-up-authentication) offers a way for media companies to balance security and UX, by only demanding that users enter their credentials under certain circumstances.

## How Step-Up Authentication Applies to Media

As we explained in our [introduction to the topic](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/#Step-Up-Authentication-vs--Multi-Factor-Authentication-vs--Adaptive-Authentication), step-up authentication allows you to make some content easily accessible to users, but request authentication when users want to access more secure content.

One of the primary use cases for step-up authentication is a membership model that only grants full access to a site to paying, registered users, i.e., a paywall.

So how do you define more secure content? If you have a [metered paywall](https://auth0.com/blog/the-role-of-ciam-in-implementing-a-sound-paywall-strategy/), a registration box appears once a customer has visited their allotted number of pages per month. For a hard paywall, users might have to register to see the vast majority of a site’s content. And in a freemium model, certain pieces of content are reserved for paying users.

Step-up authentication becomes important for users who are already logged in but engaging in riskier behaviors than just browsing through content. For example, if a customer attempts to change their payment information, that would trigger a request for [multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication). MFA requires an additional form of credential, such as a one-time code or a fingerprint scan, to confirm that the person accessing this restricted area of your site is who they claim to be.

![Media companies can use Identity Management to solve challenges](https://images.ctfassets.net/23aumh6u8s0i/20LwKMDP0CXFzTiYeMRwXI/4d2cb9bdd4161bde760e2f1ee0f23c8c/media-industry-dismantle-01)

Having an extra layer of security that “steps up” to protect payments is crucial since [phishing and credential-stuffing attacks](https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/) are on the rise. Generally, friends sharing the same set of credentials for a subscription is a low-level worry in media, but hackers using stolen credentials poses a much more serious threat. But even in the face of this threat, a good step-up authentication solution won’t represent an unpleasant disruption for users. Auth0’s [Guardian MFA](https://auth0.com/multifactor-authentication) makes the authentication process as easy and unobtrusive as possible. With Guardian, media companies can let users authenticate with a push notification on their smartphone, rather than forcing them to log in to their email or remember the answer to a years-old security question.

## How Step-Up Authentication Makes Paywalls User-friendly

[User churn](https://amplitude.com/blog/2016/01/27/understanding-user-retention) is the great enemy of media companies. A [Lenfest Institute study](https://centerforcooperativemedia.org/wp-content/uploads/sites/5/2018/04/Skibinski-Lenfest-MSU-Presentation.pdf) found that publishers’ online products have a median churn rate of 50% over a year, and while some customer turnover is inevitable, holding on to existing subscribers is still hugely important to maintaining a healthy media company.

Naturally, media companies are reluctant to make engagement more difficult by introducing friction around authentication. Forcing your readers to log in every time they want to access content is bad business, which is why step-up authentication only imposes that requirement under special circumstances.

The good news is that customers will tolerate authentication requests, provided they are employed thoughtfully. In a [2018 Experian study](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf), 66% of surveyed consumers reported that they like online security protocols because they make them feel safer.

When you employ step-up authentication with Auth0, you can still keep friction at a minimum with long-lived sessions, which can keep a user logged in to your site for up to a year. Auth0 would only require them to enter their credentials if they attempt to access more sensitive areas of your site.

Another major UX advantage for [multi-brand media companies](https://auth0.com/blog/how-enterprise-architects-can-cut-manteinance-costs-in-multi-brand-media/) is Single Sign-On (SSO). When you enable SSO across all your properties, users with bundled subscriptions can navigate freely between them. But even with SSO, you can use different paywall models across different brands. This way, one brand could have a metered paywall, while another could offer freemium content. Step-up authentication will act as a gatekeeper to ensure users only see what they’re paying for, but since they’re still logged in, you never lose sight of their [identity](https://auth0.com/blog/the-role-of-ciam-in-implementing-a-sound-paywall-strategy/) and behavior, which are crucial to refining your understanding of your users.

<include src="TweetQuote" quoteText="The media companies having the most success with paywalls are the ones that don’t treat them as rigid barriers. Find out more about Auth0 step-up authentication."/>

## Experimentation and Customization are Key

The media companies having the most success with paywalls are the ones that don’t treat them as rigid barriers. Instead, they experiment with how much content to put behind a paywall, and when to request authentication.

_The Economist_ spent [six months tinkering](https://digiday.com/media/economist-tightens-paywall/) with its number of free articles per month before landing on five as the magic number, while simultaneously publishing a significant amount of content in front of the paywall. Its circulation profits have [doubled](https://www.economistgroup.com/pdfs/2018_Annual_report.pdf) in the past five years. The Washington Post traditionally removes its paywall for [hurricane-related coverage](https://twitter.com/washingtonpost/status/1168138800121438211), which attracts readers and acts as good PR.

The most effective paywall strategy is unique to every media company, but to discover what the right mix is for you, your authentication solution has to be flexible and allow for easy alterations. Auth0’s platform, with its easily customizable [Rules](https://auth0.com/docs/rules), lets you quickly change what content falls in and outside the paywall.

![Users can access content using multiple devices](https://images.ctfassets.net/23aumh6u8s0i/5thwMutvBKJsFi5CoBpJkG/4982337f9d017cafd180b8568cd36933/media-industry-dismantle-02)

You can customize further with adaptive or contextual authorization, which are interrelated concepts with step-up authentication. Adaptive authentication is triggered by user behavior, rather than the content they are trying to access. This type of behavior could be a user signing on to a new device, multiple devices at once, or from a suspicious location. For example, if a user logs on in Australia and then logs on fifteen minutes later in Delaware, this will trigger an authentication request.

Whether or not to implement adaptive authentication depends on your business model. HBO, for instance, is quite liberal in allowing shared credentials logged in at the same time, whereas other media companies are more restrictive. Whatever your needs, Auth0 has highly customizable MFA capabilities around adaptive authentication.

## Step Up to Security That Won’t Drive Users Away

As media companies seek to limit their reliance on ads, and customers become more comfortable with subscribing to their preferred media, paywalls will increase in prevalence and importance. A [2019 Imperial College/Brave Software study](https://arxiv.org/abs/1903.01406) showed that the trend is already taking hold, with 33% of sites on the top-1000 news index using some form of paywall.

<include src="TweetQuote" quoteText="Step-up authentication offers a way for media companies to balance security and UX, by only demanding that users enter their credentials under certain circumstances."/>

But all paywalls are not created equally, and the media companies who use them effectively will be those with an approach to authentication that doesn’t increase churn. According to the Imperial study, a quarter of news sites outsource paywall functionality to a third-party, but of course, those aren’t created equally either. Given how high the stakes are, it’s essential to outsource this crucial function to an authentication partner like Auth0, with the customizability to implement step-up authentication under just the right circumstances.

<include src="asides/AboutAuth0" />

Step-Up Authentication is Key to Making Paywalls Work in Media

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to protect customer data from internal and external attacks

On September 30, [American Express sent letters](https://media.dojmt.gov/wp-content/uploads/Consumer.pdf) to some of its cardholders, informing them that their personal information had been improperly accessed by a former employee, who apparently tried to use that data to open fraudulent accounts at other financial institutions. Amex has not disclosed how many accounts were compromised but told victims that their account numbers, addresses, dates of birth, and Social Security numbers had been stolen.

While the full scope of this crime is not yet clear, the implications are potentially serious, and not just for Amex. Incidents of data theft and mismanagement are on the rise—just days after the Amex story broke, [Twitter found itself](https://www.forbes.com/sites/emmawoollacott/2019/10/09/twitter-inadvertently-gives-user-security-data-to-advertisers/#29e3e2ea5f63) embroiled in its own user data scandal—and the costs are mounting.

These costs can take the form of lost revenue, lost customer trust, fines issued under new data privacy laws, and the increasing potential for credentials stolen in one attack to be used against other businesses.

Corporate titans such as American Express can weather the storm of a data breach, but SMBs can ill-afford the cost of a breach on their revenue and reputation. Yet despite the risks, many SMBs drastically underestimate the cost of a breach. [According to AppRiver's Q3 Cyberthreat Index for Business Survey](https://www.appriver.com/cyberthreatindexforbusiness/), 67% of respondents estimated a breach would cost less than $25,000. In reality, the average cost is $149,000.

Executives in every industry should take note of this breach and use it as an opportunity to examine their own data security. With that in mind, let’s take a look at what we know about the American Express data theft, how businesses can protect themselves from employee malfeasance, and the potential for stolen data to lead to further breaches

![Image of a credit card secured by a lock](https://images.ctfassets.net/23aumh6u8s0i/3dRPHqHpQRLsWibR1AWvgd/f67cb7415472656e0b9206f5bc071249/credit_lock)

## The Facts (So Far) about the Amex Breach

According to American Express, the employee accused of using cardholder data for identity theft no longer works for the company and is under investigation by law enforcement.

In its letter, Amex assured victims that they won’t be liable for fraudulent charges and offered two years of free Experian identity monitoring. (Ironically, to use that service, victims must disclose their SSNs and addresses to Experian, and some customers may feel uncomfortable trusting that information to credit monitoring services in the wake of the [Equifax breach](https://www.teampay.co/insights/b2b-fraud-schemes/).)

It bears mentioning that this [isn’t the first time](https://www.theregister.co.uk/2016/03/17/american_express_cardholder_data_breach/) American Express customers have had their personal information compromised. However, this breach is somewhat unusual in that it isn’t the result of [accidentally exposed data](https://www.pymnts.com/news/security-and-risk/2018/american-express-india-database-data-breach/) or a malicious intruder posing as a trusted third party but of an actual employee improperly accessing sensitive information.

## How Businesses Can Protect Themselves from Employee Fraud

American Express hasn’t revealed whether the employee responsible for this breach had the appropriate credentials to access unencrypted customer data or how they copied that data for their personal use. Whatever the specific circumstances, identity professionals know the most effective tactics for deterring employee fraud are carefully controlling and monitoring access to sensitive data.

![An image of a consumer using his credit card to buy online](https://images.ctfassets.net/23aumh6u8s0i/5qKdbPEP8YnwRPYcXwTE0x/a5f28025bbad3b6efd01988f2ef393da/creditcard)

[Cloud Identity and Access Management (IAM)](https://auth0.com/learn/cloud-identity-access-management/) is an effective way for cloud-based enterprises to manage access to resources. A good cloud IAM solution functions as a single, centralized resource for admins to grant access to data. With the flip of a switch, you can assign permissions based on what an employee needs for their current task and then revoke it when that task is completed, so valuable information is exposed as little as possible.

All cloud IAM solutions aren’t created equally, however, and you should look at one that lets you proactively keep an eye on employees and identify suspicious behavior. In its report on MFA for e-commerce, [NIST specifically recommends](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that businesses “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.”

[Auth0’s dashboard](https://auth0.com/docs/dashboard) gives you a comprehensive, bird’s-eye view of user behavior, including customers, third parties, and employees.

[Using Auth0’s Rules](https://auth0.com/docs/rules), you can configure your dashboard to alert admins in the event of suspicious behavior, which you can define according to your needs. For example, you might want to be alerted if an employee continually tries to access sensitive resources unrelated to their work or logs in from a new device or at an unusual time of day.

## Guarding against the Ripple Effects of Data Breaches

The American Express data breach is unlikely to be the last scandal involving credit card companies since they are such high-value targets for thieves. But executives across every industry should understand that breaches such as this don’t just harm the individual company involved; they threaten the entire e-commerce landscape.

Data breaches like this have a spillover effect since hackers often use data stolen in one breach to impersonate users on other sites, a type of attack known as [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). The best protection against this is [multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication). MFA requires users to prove their identity via means that are more difficult to fake than simple data, such as a fingerprint scan or a one-time code sent to a personal device.

Auth0’s MFA comes with the added security of [breached password detection](https://auth0.com/breached-passwords). Auth0 keeps a constantly updated collection of breached credentials and alerts users if their login information may have been compromised. 

## Don’t Be the Next Casualty of an Amex-Style Breach

For executives, there are already valuable lessons to be learned from the American Express data breach. However, those lessons are unlikely to comfort the victims of this breach or restore their faith in their credit card company. So for now, one truth about this attack is already abundantly clear: when it comes to customer data, it’s better to invest in vigilance than damage control.

<include src="asides/AboutAuth0" />

What the American Express Data Breach Should Teach the C-Suite

Tired of identity and authentication issues eating up your time and budget? There’s a simpler solution.

In any multi-brand company, enterprise architects (EAs) function like orchestra conductors overseeing the performance of each individual player, and simultaneously ensuring that every section is working together to play a unified symphony Yet these goals are particularly challenging for EAs in multi-brand media companies, where immense pressure exists to integrate and innovate across channels — and existing technology often isn’t flexible or powerful enough to meet these demands. In particular, one of the most common bottlenecks that EAs face is also one of the most critical for customer engagement: logging in.

Authentication and identity management at this stage can quickly become pain points for multi-brand companies, where maintenance dollars skyrocket, developer time is wasted, and opportunities for innovation and synergy across brands are lost.

Attempts to upgrade in-house processes, tailored to a patchwork of legacy systems, often unearth more (and more expensive) issues. However, by taking a more holistic approach, EAs have the option to create an identity management system that facilitates, rather than stymies, innovation and integration.

## Maintain a Single User Identity across Brands

Many multi-brand media companies covet a login that links users across brands and facilitates the creation of a unified user profile, since it has the potential to be both a money-saver and a money-maker. Implementing [Single Sign-On Authentication (SSO)](https://auth0.com/learn/how-to-implement-single-sign-on/) can support this.

With SSO, a user only needs to log in once to an application, and avoid having to enter their credentials again when switching to another brand, platform, or device. By implementing SSO across their network of brands, Finland's [Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) achieved major cost savings and “reduced friction across their brand portfolio.”

![How Single Sign on works](https://images.ctfassets.net/23aumh6u8s0i/2KZu1xqmgHXSNnmVTo2rrv/adb3004b36a04aff84af0c93645aca4c/how-it-work-flow)

Unfortunately, coding SSO in-house is often a cumbersome process. If you’re working with an array of outdated, fragmented systems, it can take an enormous amount of time and effort to customize SSO across your stack. Auth0’s platform helps eliminate those headaches and allows EAs to turn on SSO in any application with the flip of a single switch.

![Enabling Single Sign On in your custom app](https://images.ctfassets.net/23aumh6u8s0i/1ickLlLsRsT5uZCmO5mF0D/3c958bd8d5a172e42f60099fda74f088/enabling-sso-in-your-custom-app-flow)

Of course, simplicity on its own isn’t enough, and any SSO solution for a multi-brand enterprise needs to be extensible. With that in mind, Auth0 makes it easy for your in-house developers to write [Rules](https://auth0.com/docs/rules) that tailor authentication to your needs. So, for example, a media company could utilize [multiple types of paywalls](https://auth0.com/blog/the-role-of-ciam-in-implementing-a-sound-paywall-strategy/) across brands without forcing users to log in multiple times. In addition to offering customers a simple way of navigating through their favorite content, Auth0’s SSO solution cuts maintenance costs by simplifying app integration and administration.

## Keep Ahead of Ever-Evolving Identity

Just as multi-brand media companies are constantly evolving to embrace new technologies, partners, and business units, as [Auth0 Principal Architect Vittorio Bertocci](https://www.youtube.com/watch?v=Ug6D6Lwoh80&feature=youtu.be) shares in this brief video, best practices for identity management are in a constant state of change (and can be a “wild ride”. It’s a full-time job just to keep an identity management system equipped with the tools needed to stay ahead of hackers, interface smoothly with third parties, and provide customers with the identity control they expect. 

As Luis Salazar, co-founder of [Giving Compass](https://auth0.com/learn/giving-compass-case-study/) attests: “If we needed to code [identity] ourselves, we'd be at the mercy of continuous maintenance, because as the social plugins change their APIs, we need to revise our code."

Overhauling your identity management system with Auth0 frees you from the work of continuous patching. The universality of Auth0’s platform connects to any application, written in any language. Offloading authentication integrations to Auth0 means that you don’t have to worry about maintaining them in-house. This can translate to enormous financial savings by allowing your developers to work on their core product, and eliminating the need to hire more talent just for authentication and identity.

According to Mike Rogers, CTO and co-founder of [SiteMinder](https://auth0.com/blog/the-real-roi-of-auth0-part-4-maintenance/):

“Doing what Auth0 does in-house would cost hundreds of thousands of dollars each year, and that's just to manage the service and keep it running. To roll out additional features, that cost would rise directly in proportion to the number of features we would want to add and how many developers we would need to make it happen. Anytime Auth0 releases a feature, that's something we don't have to do ourselves.”

The savings offered by Auth0 aren’t merely anecdotal; a 2017 [Forrester report](https://auth0.com/forrester-total-economic-impact/) estimates that customers enjoy a minimum of “20% reduction in administration time and effort due to Auth0.”

## Outsource Your Regulatory Compliance

Identity management tends to be such a headache for EAs because the cost of getting it wrong is so high. A data breach can irrevocably tarnish a company’s image, and a slew of new international regulations threatens steep fines for companies that fail to comply. EAs in media have to be particularly mindful of compliance, as they often handle customers and content that span multiple nations, states, and sets of laws.

Increasingly, third-party security accreditations are the gold standard by which to judge whether an organization is handling data responsibly and legally. “Most Fortune 500 companies won’t sign deals if you don’t have the applicable certifications,” explains [Adam Nunn, Auth0’s Senior Manager of Governance Risk and Compliance](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/). However, earning and maintaining these certifications is expensive and labor-intensive. Annual costs to maintain certifications such as [SOC 2, HIPAA, and ISO27001](https://auth0.com/security/) can range from tens of thousands to millions of dollars.

By outsourcing accreditation to a trusted third-party such as Auth0, EAs can garner huge savings, not to mention peace of mind.

![Auth0 Certifications](https://images.ctfassets.net/23aumh6u8s0i/6Ke8qdEGmRoC4eG3PVwTac/ee2622de017bb88106852e5ee11205e5/auth0-certifications)

Auth0’s accreditations require annual re-certification to maintain, and we pass that investment on to our customers. “We're getting at least 50% ROI on the investment just for security alone," says [Sung Ho Choi, Co-Founder, fuboTV](https://auth0.com/learn/sports-centric-streaming-service-fubotv-sees-50-roi-just-auth0s-security/).

## Stop Maintaining, Start Innovating

As EAs know, “maintenance costs” aren’t as simple as a single line on a budget. Every hour of developer time spent struggling with issues like identity has hidden costs in terms of increased time-to-market, a missed chance to integrate with new technologies, and a fundamental distraction from the brand’s core product.

Conversely, partnering with a trusted third-party like Auth0 for identity management ensures that the critical issue of authentication is always updated to be as secure and compliant as possible, across all your brands. With less frustrating administration, EAs can be more effective leaders, spending less of their time and budgets on identity, and more on getting the big wins. If you’re interested in offloading this demanding work to dedicated experts, contact Auth0 to learn how you can start saving your time, energy, and budget.

<include src="asides/AboutAuth0" />

How Enterprise Architects Can Cut Maintenance Costs in Multi-brand Media

To stay competitive, media companies have to deliver seamless experiences built around customer identity. The race starts at login.

Today’s media consumers enjoy an incredible array of content and have an unprecedented number of choices for how, when, and where to consume it. In this saturated environment, media heads of product are engaged in a war for consumer attention. The winners are the companies that curate the most relevant content for each user, with simple, intuitive platforms that keep them coming back for more.

The media companies that are most successful at keeping consumer attention are those with the most intensive surgical focus on creating a personalized user experience. Netflix, for instance, doesn’t merely use its insights to recommend shows; they even tailor the [thumbnail images](https://www.vox.com/2018/11/21/18106394/why-your-netflix-thumbnail-coverart-changes) of those shows to different demographics and what they find most irresistible. Achieving this level of personalization requires media outlets to possess a deep and holistic understanding of each customer, not one that is fragmented across channels or devices.

In this piece, we’ll explore how uniting customer identity in a single view will enable UX that caters directly to your customers’ preferences. Building UX around identity is crucial for heads of production who want to make their platforms stand out rather than be one more dish in the endless media smorgasbord.

## Simplify Authentication Across Devices

The era of the internet of things (IoT) presents exciting possibilities for both media producers and consumers as more smart devices become capable of delivering content. But the promise of seamless, nearly effortless device usage is often stymied at the login screen.

As anyone who has tried to type their email address with a TV remote can attest, there are few UX experiences more painful than attempting to log in with a device that was never intended for entering credentials. This frustration and its cost to UX are avoidable if you implement [single sign-on (SSO)](https://auth0.com/blog/implementing-single-sign-on-in-b2c-applications/). With SSO, when users log in to an application with one set of credentials, they are automatically signed into other applications. The primary UX benefit of this is that it simplifies authentication across devices and accelerates the time to first login.

<include src="TweetQuote" quoteText="The era of the internet of things (IoT) presents exciting possibilities for both media producers and consumers as more smart devices become capable of delivering content."/>

With a sophisticated customer identity and access management (CIAM) solution like Auth0, you can use SSO to shift the login process to other devices, which are more user-friendly and are already associated with user profiles.

![Login Process](https://images.ctfassets.net/23aumh6u8s0i/01aER9PsXDQQNimIMoPUdF/4b03aa9398019f303bd1a13e1955ec2f/login-process)

Using [OAuth Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/), a user trying to log in to your app via their smart TV won’t have to fiddle with their remote. Instead, they’ll be directed to visit a URL on their computer or smartphone, enter a short code, and complete the authentication process with far less friction. Aside from ease of use, shifting authentication to a browser also improves security, since users don’t have to directly expose their credentials to their smart devices.

## Reduce the Number of Required Logins

The login box is your first impression with a customer. At best, a time-consuming login means that customers begin their session with an unpleasant experience. At worst, it means they browse without logging in, robbing you of the chance to present them with personalized content. The solutions to this issue hinge on using your view of the customer to minimize the number of times they have to re-enter their credentials.

For multi-brand media companies, a seamless customer experience starts with SSO. For example, we’re all familiar with SSO when we log in to Google and are automatically logged in to YouTube. That feature is critical in enabling YouTube to recognize users and recommend videos tailored to their interests.

<include src="TweetQuote" quoteText="The login box is your first impression with a customer. At best, a time-consuming login means that customers begin their session with an unpleasant experience."/>

Another effective tactic to reduce tedious logins is implementing [long-lived sessions](https://auth0.com/blog/when-ux-equals-keeping-or-losing-the-customer/) for users. Long-lived sessions let developers extend the login period before idle time-outs, in which users are automatically logged out after a certain period of inactivity. Whereas maintaining a brief window for idle time-outs makes sense for apps that handle highly sensitive information, it often hurts media companies. If you have a user who typically logs on once a month to read new content, forcing them to log in each time harms UX without providing any real benefit.

![Long-Lived Sessions Diagram](https://images.ctfassets.net/23aumh6u8s0i/7mEOMklyIKITdeeLKYnAYw/c6c49224407e2e7fb40afe1595e156c9/long-lived-sessions)

If you choose to explore long-lived sessions, it’s crucial to have a CIAM provider like Auth0 that lets you tailor the system to your business. Auth0 lets you customize session limits of up to 100 days, which you can adjust based on the level of risk your business is comfortable with. You can also apply rules that require users to authenticate when engaging in activities such as changing payment details. It’s crucial to maintain this level of customization with long-lived sessions; otherwise, your short-term UX gains can be erased by compromised security.

## Create a Consistent Experience with an Identity Directory

In a media ecosystem that is often overwhelming to users, the ideal UX is a place where one’s needs are understood and catered to the moment one logs in. To achieve this uniform, curated experience across platforms, consider storing user profiles on a centralized directory.

It’s vital to have rich, holistic profiles that function as the authoritative source of truth about your customer. That way, even if a user logs in via social media at one point, and email the next, both logins still feed into a single profile. With this approach, profiles and content recommendations stay relevant even as login behaviors evolve.

Having a single profile — as opposed to duplicates across login methods or devices — ensures that your company’s advertising and marketing efforts are appropriate rather than intrusive. Lacking this alignment can have a negative effect on UX; [a recent study](https://www.marketingcharts.com/customer-centric/privacy-and-security-107946) found that 66% of consumers disliked being targeted too many times, and 44% were annoyed if targeted for too long.

Auth0 offers customers the ability to host their directories on their own servers or on the secure Auth0 server. If your needs change, you can [move your directory to Auth0](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) without requiring that customers undergo a disruptive password reset. This model lets you scale, which results in consistent delivery of good UX even as you grow.

## Use Identity to Become a Content Concierge

In this crowded media landscape, compelling content is no longer enough to attract and retain customers. Consumers increasingly demand that companies not only select the most relevant and valuable content for them but also deliver it across all their devices with minimal effort.

Understanding your users’ identity is at the core of great UX. That’s why attaining a single vision of the customer is such an effective digital initiative for media heads of product. To do this project justice, be sure to partner with a CIAM that can provide an experience as simple, yet as customizable, as the one you offer your customers. If you’d like to learn more about how Auth0 can help you quickly create a CIAM solution that suits your needs, please reach out to an [Auth0 resource](mailto: sales@auth0.com).

<include src="asides/AboutAuth0" />

---

How To Improve CX/UX Through A Single Vision Of The Customer

steven-rees-pullman

I am an Internationally proven professional with experience including full P&L, Business Sector and Corporate planning and execution roles. My specialities — driving revenue and organisational growth in the EMEA.

General Manager EMEA

Steven Rees-Pullman

An interview with our partner, Houston Inc. about why identity is critical for building an audience

Thanks to digitization (and a lot of human effort and planning), the media and entertainment industry has transformed from a network of products to a network of services. Media and entertainment customers now enjoy media and entertainment wherever they are &mdash; via mobile apps, streaming subscriptions, and connected devices.

But all that convenience also created the login box.

Now, media companies must provide a frictionless login experience in addition to creating content and increasingly personalized experiences. Growing audience means meeting (and exceeding) customer expectations &mdash; often growing that audience one person at a time by marketing on a one-to-one basis. And all of this has to take place while minimizing data breach risks that might compromise sensitive user information.

With so much to achieve, where should media companies begin? We asked one of our Nordic partners, [Tomi Ruotimo, CEO of Houston Inc.](https://houston-inc.com/) Consulting for his perspective.

![Headshot of Tomi Ruotimo, CEO of Houston Inc.](https://images.ctfassets.net/23aumh6u8s0i/3NYv1ZHycLe4eaQxi6LuBx/91e28da1c0953dee5385b49c9c97bca1/tomi-ruotimo-ceo-houston-inc)

Tomi founded Houston in 2003 with the vision to help companies design and build digital services to solve specific business problems. Fifteen years later, Houston has 100  employees and have helped companies like Finnish media giant Alma Media, Finnair and Konecranes digitise their offerings. Working with Houston and Auth0, [Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) achieved 30% total savings by providing seamless access across their brands.

**Why is identity important in the Nordics?**

The European Commission ranks Denmark, Sweden, and Finland as the EU's most advanced digital economies, with the highest levels of [digitization](https://ec.europa.eu/digital-single-market/en/desi). According to Reuters, the region also leads the world in paying for [online news](http://media.digitalnewsreport.org/wp-content/uploads/2018/06/digital-news-report-2018.pdf?x89475).

Working with large, multi-brand media companies, we know identity can seem incredibly complex. It's about choosing the right solution for the use case, and giving Nordic media companies a clear roadmap toward turning their free users into paying subscribers.

**What is your answer to "_where do I begin with identity management_?"**

The answer is always: with a good user experience. Your login box is the gateway, and making it as easy as possible for people to sign in is the first step toward conversion. In the case of multi-brand media companies, users should also be able to securely switch between brands or services without having to sign in a second time.

From a technical point of view, the most difficult challenge is merging customer information from different brands and login types into one customer profile. For this, you need verified emails. [The right identity provider can walk you through this process and make identifying single customers much quicker](https://auth0.com/blog/solving-5-media-industry-challenges-with-auth0-identity-solutions/).

Then on the front-end, it's all about reducing friction for the user. Consider [Single Sign On (SSO)](https://auth0.com/single-sign-on/) across brands and features like social login to simplify registrations and logins for end users.

**What about media companies looking for identity management beyond the basics?**

Identity is a great tool for learning about your users, while also complying with data privacy and security laws like GDPR. The key is first-party data, collected directly from the user, with their consent. This doesn't mean companies should ask for a user's life story right away. Customers are turned off by a long sign up form: 86% of users will [quit at registration](https://auth0.com/blog/progressive-profiling/) if the form is too long, while reducing form fields from 11 to 4 increases conversion rates by 120%.

We often recommend "Progressive Profiling," an identity feature that allows media companies to collect information over time, as users interact with their platform. The first time a user signs in, you might just ask for their name and email. The second time, you could ask for their location to improve the experience. The third time could be topics of interest, etc. Ultimately, your goal is to get high-quality information from your users without pushing them away so you can personalize their experience.

**How can media companies use the customer data they've collected?**

Along with our partners like Auth0, we typically recommend that media companies integrate their identity solution with marketing or analytics platforms, so they can deliver personalized messages, content, discounts, etc.

[Media companies](https://auth0.com/media-publishing/) can also use identity data to identify frequent users, and offer them a premium experience or simply message them in a different way. In a similar way, media companies that appeal to a wide demographic can tailor their experiences for different audiences, and make sure they're collecting the appropriate data for each age group. People will want to use your service more if you provide the right content. Netflix and Amazon do this well.

**What advice do you have for media companies investing in identity?**

Look at your business needs, and ask: should I build my own identity platform, or invest in a ready-made product? Auth0 has a good resource with [20 questions for Build or Buy](https://auth0.com/learn/build-or-buy-20-identity-management-questions/). There is always opportunity cost to committing your own resources to identity management. If you choose to buy, find a partner who understands your business and processes, and can validate the right approach to the service, both at the technical level and in the user experience.

The bottom line: if turning free users into subscribers, and monetizing interactions with those subscribers is the goal, then identity is step one.

## About Steven Rees-Pullman

Steven Rees-Pullman is General Manager of Auth0, a leading Identity-as-a-Service platform that secures more than 2.5 billion logins per month. More information can be found at <https://auth0.com/>.

## About Tomi Ruotimo

Tomi Ruotimo CEO and Founder of [Houston Inc.](https://houston-inc.com/) Tomi is an innovative idealist, disruptive thinker, but also known as "enfant terrible of business". He has over 30 years experience in IT. He has founded Houston Inc. which, alongside with a sibling organization called Houston Analytics are one of the leading IoT software consultancy organizations in Scandinavia.

<include src="asides/AboutAuth0" />

If You Want More Paying Subscribers, Invest in Identity

chris-adriaensen

Chris is a Lead Solutions Engineer at Auth0 and has been in the digital identity industry for about 10 years. He works with clients to build successful and trusted solutions using Auth0's platform. Prior to joining Auth0, Chris was a Solution Architect at ForgeRock, as well as Verizon, where he worked on various strategic identity projects.

Lead Solutions Engineer

Chris Adriaensen

A look at four different authorization models to map users to the correct permission

> EDITOR’S NOTE: Welcome to the EMEA Blog Takeover, where our EMEA employees take over the Auth0 blog to share success stories from the region. This week, you’ll meet our thought leaders across the pond, discover some of our most compelling use cases, and read about the trends that influence how we do business.

## The Scene

Online media includes a vast world of mostly free and some exclusive paid content, consumed through a plethora of devices. We read the news and listen to music on our phones or smart assistants, skim articles and books on our tablets, and watch movies on our laptops or TVs. More and more, the shape of our devices is changing — from hand-held and large-screen TVs to standalone speakers and connected cars.

In the highly-competitive world of media, understanding the consumer can make the difference between going under or keeping your head above the water. Users need to be able to find media on their devices and consume it at the time they prefer. Keeping the user engaged by offering additional media choices builds loyalty and increases consumption, making room for additional revenue streams.

<include src="TweetQuote" quoteText="The shape of our devices is changing — from hand-held and large-screen TVs to standalone speakers and connected cars."/>

Understanding the consumer’s [social graph](https://www.google.com/url?q=https://en.wikipedia.org/wiki/Social_graph&sa=D&ust=1559296160314000&usg=AFQjCNETRz-kST9SoFHeZgzwLticknD59A) can provide a competitive edge, as it allows media providers to differentiate between different consumers sharing a subscription. This is critical to avoid mixing up personalization efforts, while correctly tailoring media access and subscription usage according to a user’s location, role, and age (e.g. restricting content for younger audiences). Knowing how the consumer relates to others in their network also helps to provide more relevant media recommendations.

Many established media providers are still grappling with [digital transformation](https://auth0.com/blog/solving-5-media-industry-challenges-with-auth0-identity-solutions/). While there are innovative ways to design a [paywall strategy](https://auth0.com/blog/the-role-of-ciam-in-implementing-a-sound-paywall-strategy/), paywalls can be challenging as content has increasingly become abundant and often free. A frictionless consumer onboarding process with a low barrier to entry is key, as well as an outstanding initial, and continued, digital customer experience. For this you need a minimal amount of effort needed to setup an account as well as a low commercial threshold, such as a 1-month free or low-entry monthly subscription.

Lots of providers today merely focus on a subscriber account, and perhaps attach some profiles, missing out on truly understanding their consumers. We all know how subscriptions are shared — even with attached profiles it doesn’t provide good separation — and consumers get annoyed when personalisation engines get confused. Furthermore, children grow up, employees move companies, users can become full-blown subscribers themselves, people move across countries … starting with a blank digital profile is painful for all parties involved.

<include src="TweetQuote" quoteText="A frictionless consumer onboarding process with a low barrier to entry is key."/>

## Authorization Models

As we’ve discussed, it’s important for every user to have his or her own account, or data gets mixed and becomes useless very quickly. Let’s imagine a simple traditional family setup: **mom** and **dad** manage the subscription (`1234`), also used by two children, an adult (`child_adult`), and a minor (`child_minor`). We also have a partner of the oldest child using the subscription (`partner_child_adult`). All of them have seperate accounts and we assume they can be recognized seamlessly by all the devices. We’re going to focus on how users are mapped to permissions, i.e. the authorization model used.

> **Note:** The examples below are simplified for illustrative purposes. Please reference the linked documentation for more information about the specific features can be used to implement these models.

## Discretionary Access Control (DAC)

In a DAC model, all permissions are assigned directly to users, so the model is basically a direct mapping between users and permissions. It holds little information as to why permissions are assigned they way they are, and hence makes it extremely inflexible and hard to manage. In our family example we have five permissions, administration of the subscription (`sub_admin`), access to minor-approved content (`content_minor`), access to High Definition streaming any content (`content_hd`), access to content for 18 years of age or older (`content_adult`), and access to admin-only content (`content_admin`). 

![Discretionary Access Control](https://images.ctfassets.net/23aumh6u8s0i/7kn3G5wVhONPOg2SyKCbZA/b2b348844ef44f90f79bc0ded46a22d1/dac)

Our example using DAC:

```javascript
// RULES: DAC
// set subscription
context.accessToken[`subscription`] = user.subscription;
	
// collect permissions
for (permission in user.permissions) context.accessToken.scope.push(permission);

// USER: MOM
“subscription”: 1234,
“permissions”: [“sub_admin”, “content_minor”, “content_hd”, “content_adult”, “content_admin”]

// USER: DAD
“subscription”: 1234,
“permissions”: [“content_minor”, “content_hd”, “content_adult”]

// USER: CHILD (ADULT)
“subscription”: 1234,
“permissions”: [“content_minor”, “content_hd”, “content_adult”]

// USER: CHILD (MINOR)
“subscription”: 1234,
“permissions”: [“content_minor”, “content_hd”]

// USER: PARTNER (CHILD ADULT)
“subscription”: 1234,
“permissions”: [“content_minor”, “content_adult”]
```

The amount of static decisions to make in this DAC model would be:

```javascript
complexity_dac = users * (subscriptions + permissions)
[users: 10.000, subscriptions: 5.000 & permissions: 5 => 50.050.000]
```

When faced with an extremely small number of users, subscriptions, and permissions, it might still be manageable. At Auth0, we provide support for DAC by [allowing permissions to be stored directly in the user’s account](https://auth0.com/docs/users/concepts/overview-user-metadata) in the `metadata` fields, which can store generic JSON information.

## Role-Based Access Control (RBAC)

In an RBAC model, an abstraction layer is introduced using the concept of roles or groups. Each role or group can be attached to multiple users on one side and multiple permissions on the other side. In other words, instead of having permissions directly assigned to users, they’re now assigned to roles, which in turn get assigned to users.

![Role-Based Access Control](https://images.ctfassets.net/23aumh6u8s0i/23aOZR4SybM4AtiLhtF6aY/e275fd5129f75e6afaf986754aea8c77/rbac)

Our example using RBAC:

```javascript
// RULES: RBAC
// set subscription
context.accessToken[`subscription`] = user.subscription;

// collect roles and permissions
for (role in user.roles)
	for (permission in role.permissions) context.accessToken.scope.push(permission);
	
// ROLE: ADMIN
“permissions”: [“sub_admin”, “content_admin”]

// ROLE: FAMILY (MINOR)
“permissions”: [“content”, “content_hd”]

// ROLE: FAMILY (ADULT)
“permissions”: [“content”, “content_hd”, “content_adult”]

// ROLE: FAMILY (EXTERNAL)
“permissions”: [“content”, “content_adult”]

// USER: MOM
“subscription”: 1234,
“roles”: [“admin”, “family_adult”]

// USER: DAD
“subscription”: 1234,
“roles”: [“family_adult”]

// USER: CHILD (ADULT)
“subscription”: 1234,
“roles”: [“family_adult”]

// USER: CHILD (MINOR)
“subscription”: 1234,
“roles”: [“family_minor”]

// USER: PARTNER (CHILD ADULT)
“subscription”: 1234,
“roles”: [“family_external”]
```

The amount of static decisions to make in this RBAC model would be:

```javascript
complexity_rbac = users * (subscriptions + roles) + roles * permissions
[users: 10.000, subscriptions: 5.000, roles: 4 & permissions: 5 => 50.040.020]
```

When there are significantly fewer roles than permissions, it can vastly reduce the complexity. With Auth0, RBAC can be implemented through the use of [roles](https://auth0.com/docs/authorization/guides/manage-roles) — permissions can be assigned to roles and roles to users in a static way, either using the Administrator UI or the Management API.

## Attribute-Based Access Control (ABAC)

In an ABAC model, policies are introduced that can dynamically determine how permissions are assigned to users based on attributes of the user, but also whatever information is available to the policy engine (like request or context information). 

![Attribute-Based Access Control](https://images.ctfassets.net/23aumh6u8s0i/6rUta5WyLMmZSoL4Q7pxM6/33a1a814369958b0df2121b70e5c7a5a/abac)

Our example using ABAC:

```javascript
// RULES: ABAC
// set subscription
context.accessToken[`subscription`] = user.subscription;

// check if admin and add permissions
if (user.admin) context.accessToken.scope.push(["sub_admin", "content_admin"]);

// check if family and add permissions
if (user.external) context.accessToken.scope.push("content");

// check if adult and add permissions
if (user.age >= 18) context.accessToken.scope.push("content_adult");

// check if not external and add permissions
if (!user.external) context.accessToken.scope.push("content_hd");

// USER: MOM
"subscription": 1234,
"admin": true, "external": false, "age" : 45

// USER: DAD
"subscription": 1234,
"admin": false, "external": false, "age" : 47

// USER: CHILD (ADULT)
"subscription": 1234,
"admin": false, "external": false, "age" : 20

// USER: CHILD (MINOR)
"subscription": 1234,
"admin": false, "external": false, "age" : 16

// USER: PARTNER (CHILD ADULT)
"subscription": 1234,
"admin": false, "external": true, "age" : 21
```

The amount of static decisions to make in this ABAC model would be:

```javascript
complexity_abac = users * (subscriptions + attributes)
[users: 10.000, subscriptions: 5.000, attributes: 3 => 50.030.000]
```

When the number of attributes is significantly lower than the number of roles or permissions, it can vastly reduce the complexity. Of course, now a dynamic component of policies is introduced. At Auth0, we provide support for ABAC through [rules](https://auth0.com/docs/rules), which are JavaScript snippets that run after login and allow customizing the permissions returned to the applications.

## Relationship-Based Access Control (ReBAC)

In a ReBAC model, a graph-based model is introduced between users and subscriptions, and policies dynamically determine how permissions are assigned to users based on relationships of the user. This allows for a lot more expressive and powerful policies, enabling the business to truly understand the user’s environment and act accordingly. 

![Relationship-Based Access Control](https://images.ctfassets.net/23aumh6u8s0i/4ijiLd7E4K6FbKLYzfKVku/76e6faa1377b5e6f6311bae7d66e0518/rebac)

Our example using ReBAC:

```javascript
// RULES: REBAC
// if subscription is managed by user …
if (sub:subscription--managed_by-->user:user)
	context.accessToken[`subscription`] = sub:subscription.number;
	context.accessToken.scope.push([“sub_admin”, “content_admin”]);

// if user is related to admin of sub with max 2 hops …
if (sub:subscription--managed_by-->--related_with(2)--user:user)
	context.accessToken[`subscription`] = sub:subscription.number;
	context.accessToken.scope.push(“content”);

// check if adult and add permissions
if (user:user.age >= 18) context.accessToken.scope.push(“content_adult”);

// if user is related to admin of sub with max 1 hop ...
for (sub:subscription--managed_by-->--related_with(1)-->user:user)
context.accessToken.scope.push(“content_hd”);

//RELATIONSHIPS
sub:1234--managed_by-->user:mom
user:mom--related_with-->user:dad
user:mom--related_with-->user:child_adult
user:mom--related_with-->user:minor_adult
user:child_adult--related_with-->user:partner_child_adult

// USER: MOM
“age” : 45

// USER: DAD
“age” : 47

// USER: CHILD (ADULT)
“age” : 20

// USER: CHILD (MINOR)
“age” : 16

// USER: PARTNER (CHILD ADULT)
“age” : 21
```

Notice that we’ve now stated that everyone who’s related to the admin of the subscription within one hop is considered “close family” and is able to stream content in HD, and everyone who’s related to the admin of the subscription within two hops can access content, allowing all “in-law family” to access content as well, not only **child_adult_partner**.

The amount of static decisions to make in this ReBAC model would be:

```javascript
complexity_rebac = users * attributes + subscriptions + users * (users - 1) / 2
[users: 10.000, subscriptions: 5.000, attributes: 1 => 50.010.000]
```

When the number of attributes is significantly reduced through a small number of possible relationships, it can vastly reduce the complexity. Although harder to quantify, it’s clear it provides more power to define generalized policies. As with ABAC, Auth0 supports ReBAC through the use of rules, which can call out to external sources such as a graph database, where the model can be stored and queried efficiently.

The same model could also be used to enrich the information provided back to the application for improved personalization. This allows for a smoother migration of accounts, as social graphs don’t need to change, and can handle more complex setups. For example, an admin on one subscription could also have non-admin access to another subscription.

## Conclusion

We looked at four different authorization models to map users to the correct permissions:

1. **Discretionary Access Control** (DAC) where permissions are statically assigned to users directly and only proven manageable with extremely small amounts of users, subscriptions and permissions. Supported by Auth0 using [metadata](https://auth0.com/docs/users/concepts/overview-user-metadata) on accounts.

2. **Role-Based Access Control** (RBAC) where permissions are statically assigned to roles/groups which in turn are assigned to users, vastly reducing complexity when less roles than permissions. Supported by Auth0 using integrated [roles](https://auth0.com/docs/authorization/guides/manage-roles).

3. **Attribute-Based Access Control** (ABAC) where permissions are dynamically assigned in policies to users based on the attributes or roles/groups of the users, vastly reducing complexity when less attributes than roles/groups and permissions. Supported by Auth0 using [rules](https://auth0.com/docs/rules).

4. **Relationship-Based Access Control** (ReBAC) where permissions are dynamically assigned in policies to users based on the relationships or attributes of the users, vastly reducing complexity when attributes are significantly reduced through a small number of possible relationships. Not only does it provide some complexity gains it also allows for far more complex scenarios to be modeled. Supported by Auth0 using [rules](https://auth0.com/docs/rules), calling out to an external graph database.

<include src="asides/AboutAuth0" />

---

Understanding a Media Consumer’s Social Graph

pamela-oldfield

Pamela Oldfield

Help your offering thrive by crafting engaging (and personalized) audience interactions with Auth0

> EDITOR’S NOTE: Welcome to the EMEA Blog Takeover, where our EMEA employees take over the Auth0 blog to share success stories from the region. This week, you’ll meet our thought leaders across the pond, discover some of our most compelling use cases, and read about the trends that influence how we do business.

Media companies, once dependent on hardcopy newspapers and broadcast television must now build, maintain and monetize an online subscriber base. This isn't a recent thing — media was among the first industries to be impacted by digital transformation — but there is still no silver bullet for thriving in a digital media world.

![Media companies can use Identity Management to solve challenges](https://images.ctfassets.net/23aumh6u8s0i/20LwKMDP0CXFzTiYeMRwXI/4d2cb9bdd4161bde760e2f1ee0f23c8c/media-industry-dismantle-01)

Content is no longer the product, the user is. In talking with our customers, the closest thing to a silver bullet is to focus on learning more about the users who are logging in to view free content, so you can market to them on a one-to-one basis. At the same time, it is also critical to minimize the risk of data breaches and fraud that compromise sensitive user information, not to mention adhere to data privacy regulations.

Identity sits at the core of media digitalization. While there are many use cases, here are five of the most common where identity and access management (IAM) can provide a solution.

<include src="TweetQuote" quoteText="Learn how to solve 5 major media industry challenges with Identity Management"/>

## Integrating Modern Streaming Devices

For the first time last year, the number of [UK subscribers to streaming services](https://money.cnn.com/2018/07/18/technology/amazon-netflix-uk-subscribers/index.html) (15.4 million) exceeded those who pay for traditional satellite and cable services, according to UK media regulator Ofcom.

Media companies are very good at supporting web browsers and broadcast formats. The challenge is connected "smart" devices, especially those with limited input capabilities (e.g. no keyboard or touch screen).

Auth0 makes it simple for media companies to authenticate their users on any device with an internet connection, including smart TVs, media consoles, digital picture frames, etc. On his blog, Auth0 CEO and co-founder Eugenio Pace describes how these devices receive an access token that can then be used to [securely call an API](https://eugeniopace.org/api/deviceflow/arduino/auth0/devicegrant/2019/04/25/calling-secure-apis-from-arduino-part-i.html).

## Content Retail

According to Reuters, [the Nordic countries](https://auth0.com/blog/auth0-expands-european-presence-with-customers-in-belenux-and-nordics/) lead the world in [paying for online news](https://www.pressgazette.co.uk/just-7-per-cent-of-people-in-uk-pay-for-news-reuters-digital-news-report-reveals/), with 22 percent of people on average having paid for online news in the past year. While the numbers are bleaker in other parts of Europe, there is a growing consumer willingness to pay for a [compelling customer experience](https://www.zendesk.com/resources/why-companies-should-invest-in-the-customer-experience/).

Customer experience starts at login -- but the self-destructive tendency is to ask for too much data right away. Customers are turned off by a long sign up form: 86% of users will [quit at registration](https://auth0.com/blog/progressive-profiling/) if the form is too long, while reducing form fields from 11 to 4 increases conversion rates by 120 percent. As one Auth0 customer said, "You shouldn't have to write War and Peace every time you want to register an account."

Auth0 allows media companies to collect information over time as users interact with their platforms. Media customers can use Auth0 to build powerful progressive profiling capabilities. The first time a user signs in, you might ask for their name and email. The second time, you could ask for their location to improve the experience. The third time could be topics of interest, etc.

Using Auth0's flexible Rules, media companies can also [redirect users to a paywall](https://auth0.com/blog/the-role-of-ciam-in-implementing-a-sound-paywall-strategy/) at the most opportune time, based on user behavior. Subscribers can be assigned a "paying" role or group so they never have to log in twice while navigating paid content.

## Family Setup and (Age) Restrictions

When different family members have access to the same system, it can be challenging to ensure that each user gets a personalized set of content.

Many major streaming companies focus on the subscriber and allow users to create sub-profiles, but have no real concept of the family dynamic. In a single subscription account, the billing contact controls the family setup, and can specify ages, assign roles (parent, child, etc.), and restrict access as needed. This works for keeping younger viewers from accessing adult content, but misses the mark in identifying and learning about other family members.

With Auth0, media customers have complete flexibility to specify exact scenarios for end-user roles and assign them on-the-fly as the user switches between web and mobile applications. Media customers can use Auth0 to create a Family Authorization Model to properly identify all users, and create personalization and cross-sell opportunities. Since users typically give consent at login, Auth0 can also easily integrate with best-in-class consent management platforms to ensure data is never collected without permission.

Similar to a family setup, media houses with multiple demographics or user types can use Auth0 to identify frequent readers and give them an elevated experience. Attention to each unique customer journey is key to turning free users into loyal subscribers.

![Users can access content using multiple devices](https://images.ctfassets.net/23aumh6u8s0i/5thwMutvBKJsFi5CoBpJkG/4982337f9d017cafd180b8568cd36933/media-industry-dismantle-02)

## Multi-Brand Strategy

Media companies with multiple brands must not only create a compelling, one-touch customer experience, but also allow customers to move freely and securely between their platforms, without having to sign in a second time.

It's a tall task, but not an impossible one. From a technical point of view, the first and most challenging step is to merge customer information from different brands and login types into one customer profile.

Auth0's multi-tenancy setup, Account Linking/Migration, and Single Sign-On (SSO) capabilities  empower media companies to create a single view of the customer across brands. Once established, they can personalize the user experience across channels and remove any friction to login, while reducing the cost of developing identity for each brand. [Finland-based Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) saw 30 percent total savings using Auth0 to reduce friction across their brand portfolio.

## Content Geo-Fencing

Media companies make money by licensing their content to various distributors in different parts of the world. Then to protect licensing profits, they use geofencing technology to create a virtual geographic boundary, and keep users outside the boundary from viewing the content within.

Unfortunately most geofencing relies on the IP address of a user's device, and can be easily thwarted by using a modern proxy server. The proxy acts as a gateway between the user and the internet, obscuring the actual locale of the user's device.

With Auth0, a user's identity is tied to their account — not to their device or gateway — and can be located out-of-band and compared with the device's location. This makes it much easier for media companies to protect territorial licensing; and identify individual users, understand where they are coming from, and assign access rights accordingly.

## Which Use Case Are You?

While there is no silver bullet for digitization, media companies can thrive by focusing on learning how and where users are interacting with their content.

Users can come from web-browsers and broadcast, but are more likely to access content in new  ways, like smart devices and streaming services. Accounting for their location, family dynamic, and preferences is key to providing an experience they are willing to pay for.

Extending your subscriber base can make a huge difference in your bottom line. Imagine if an extra 10% of visitors to your site decided to spend money with you? Building and monetizing an online subscriber base starts at login. To learn how Auth0 can support your use case in the media industry, reach out to an [Auth0 resource](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />

Solving 5 Major Media Industry Challenges with Identity

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Leading media companies choose Auth0 to authenticate and monetise digital subscribers

LONDON  ** June 3, 2019 ** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced rapid customer growth in Northern Europe. In the last year alone, Auth0 has tripled its customer base in the region, signing on well-known enterprises Elsevier and Atea Norge; as well as prominent media leaders, such as TV 2 Danmark, broadcaster of the Danish "X-Factor" show; Danish Broadcasting Corporation; and Alma Media.

Northern Europe boasts the EU's [top five most advanced digital economies](https://ec.europa.eu/digital-single-market/en/desi), and the Nordic countries lead the world in [paying for online news](http://media.digitalnewsreport.org/wp-content/uploads/2018/06/digital-news-report-2018.pdf?x89475) through subscription, membership, donations, or per-article payments, according to Reuters. The digitisation of the media industry in the region has created an urgent need for identity management, as media companies seek to reduce friction for their users to sign up and access content, and turn free users into subscribers.

"What if an extra 10 percent of visitors to your app or online publication decided to spend money with you? Identity makes this possible, giving companies the tools to streamline their login, collect first-party data, and personalise experiences for their customers, which drive additional revenue opportunities," said Steven Rees-Pullman, GM of EMEA at Auth0. "Northern European companies understand this value, and turn to Auth0 for a modern identity platform and a roadmap for getting started."

Danish Broadcasting Corporation (DR), Denmark's largest media company and producer of a broad variety of Danish content, uses Auth0 to authenticate users of their various video, audio, and live voting apps. Auth0 supported both the implementation and assisted DR in mapping out an identity strategy for the near-and far-term.

For more on how Auth0 supports the media sector, including a case study with [Finland-based Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/), please visit: <https://auth0.com/media-publishing/>.

<include src="asides/AboutAuth0" />

### Media Contacts:

Mark Fowler 
Racepoint Global for Auth0, EMEA 
(auth0@racepointglobal.com)[mailto:auth0@racepointglobal.com] 
+44 (0) 77 1124 4113

Auth0 Expands European Presence with Customers in Benelux and the Nordics

How hackers got in, what they stole, and how to prevent more incidents in 2019.



> [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) have become commonplace — yet some industries are more vulnerable than others. Unfortunately, media is notorious for being a magnet for cyberthieves. 

In the last decade, dozens of media companies, ranging from prestigious publications like the *Washington Post* to social media platforms like [Facebook](https://mashable.com/2018/06/08/facebook-media-company-news-shows/#UMeaOo_oDsqI), have seen customers’ and the companies’ private data exposed.

Why? One reason is that billions of people have accounts with media companies. Facebook users alone hit [2.27 billion](https://www.statista.com/statistics/264810/number-of-monthly-active-facebook-users-worldwide/) in Q3 2018. As more and more people consume their news online, the surface area for cybercriminals continues to expand. Another reason, according to [Security Magazine](https://www.securitymagazine.com/articles/89404-media-and-entertainment-industry-unprepared-for-cyber-risks), is that media companies often rely on outside vendors. Even if the media companies themselves are confident in their security processes, it’s hard to track how safe third parties are. 

While some vendors like Auth0 take compliance seriously — acquiring [security certifications](https://auth0.com/security/) such as ISO 27001 and 27018, as well as SOC 2 and HIPAA  — this isn’t always the case with third parties.

Below is a roundup of 11 of the worst media breaches in the past decade. Hackers hit teams large and small, niche and high-profile, new and established. It’s clear that no company is immune.

We deliver tips for how all media teams can bolster their cybersecurity practices in 2019. 

## 1. BuzzFeed Data Breach

In 2016 BuzzFeed was hacked by a group called OurMine. On several BuzzFeed articles, headlines read  "HACKED BY OURMINE" with a link to the group's website. Several of the headlines also included profanities.

An [article in *Wired Magazine*](https://www.wired.com/2016/10/hack-brief-hackers-breach-buzzfeed-retaliation-expose/) described how the group had a history of getting into systems using passwords that were previously leaked in large-scale data breaches. They used the compromised passwords to access BuzzFeed accounts with the same login data.

## 2. Dow Jones Data Breach

In October 2015, hackers uncovered the personal data of current and former Dow Jones subscribers between July 2012 and August 2015. [Reports](https://www.wsj.com/articles/dow-jones-discloses-customer-data-breach-1444406517) divulged that the hackers got credit card information from close to 3,500 individuals — along with names, addresses, email addresses, and phone numbers.

The hackers' goal was to send fraudulent solicitations, according to the [*Wall Street Journal*](https://www.wsj.com/articles/dow-jones-discloses-customer-data-breach-1444406517)*. *The company suspected the incident was part of a much larger, multi-company data breach.

## 3. Avid Life Media Incident 

Also in 2015, the parent company to Ashley Madison, Avid Life Media, released a [statement](https://www.prnewswire.com/news-releases/ruby-corp-and-plaintiffs-reach-proposed-settlement-of-class-action-lawsuit-regarding-ashley-madison-data-breach-634551783.html) saying that hackers had gained access to computer networks and published nearly 10 gigabytes of sensitive personal information. These [included](https://www.wsj.com/articles/ceo-of-ashley-madison-parent-steps-down-1440773362?mod=article_inline) customers' names, email addresses, and credit card details contained in individual accounts.

Hackers, part of a group called The Impact Team, released nearly 10 gigabytes of data stolen from Avid Life. 

The company fought back, denying the severity of the attack:

![Avid Life Media Incident](https://images.ctfassets.net/23aumh6u8s0i/3wCntqxyboNdz1k6lpLMyo/062ee3dc8df5e5a760fd672bde6a2feb/avid-life-media)
[Image Source](https://www.databreaches.net/statement-from-avid-life-media-august-19-2015/)

Ultimately, the data breach led to Avid Life Media's CEO resigning. In 2017, Avid Life (now Ruby Corp) [reached a settlement of $11.2 million](http://www.prnewswire.com/news-releases/ruby-corp-and-plaintiffs-reach-proposed-settlement-of-class-action-lawsuit-regarding-ashley-madison-data-breach-634551783.html) with potential plaintiffs.

## 4. Facebook Scandal

Facebook's series of data breaches — including the [Cambridge Analytics scandal](https://auth0.com/blog/what-data-did-facebook-really-give-cambridge-analytica/), Russian interference in the U.S. elections, the realization that major apps continue to [illegally share user data](https://siliconangle.com/2018/12/31/report-finds-major-apps-illegally-sharing-data-facebook/) with the company, and recent exposure of [_50 million accounts_](https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-breach.html) in September 2018 — are some of the most high-profile of the year. 

To make matters worse, many believe the most recent breach of personal accounts actually began as far back as July 2017. For months, hackers were rooting around for private information, including names, sexes, hometowns, and photos. After obtaining the data, attackers used people's lists to steal access tokens for third-party apps like Spotify and Instagram. 

While the hack didn't expose [_financial information_](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), the breadth of personal data they were able to access still had enormous value. 

## 5. Sony Data Breach 

In 2014, hackers [accessed and wiped personal data](https://www.forbes.com/sites/josephsteinberg/2014/12/11/massive-security-breach-at-sony-heres-what-you-need-to-know/#23bcec9144d8) from Sony customer accounts. In addition, they alluded to attacking theaters set to release the film “The Interview,” with James Franco and Seth Rogen. (Sony was forced to release the film online instead.) 

Hackers released information to the public like the salaries of tens of thousands of employees and Hollywood stars and [sensitive email traffic between executives and movie moguls](http://time.com/3629480/sony-pictures-hack-amy-pascal-emails/). Reports noted the incident amounted to [100 terabytes](http://time.com/3639275/the-interview-sony-hack-north-korea/) of data. 

Sony employees immediately knew something was wrong when they arrived at work and found images of grinning red skulls on computer screens. Hackers identified themselves as #GOP — Guardians of Peace. 

## 6. Washington Post Scam

In 2011, [1.27 million](https://www.pcmag.com/article2/0,2817,2388200,00.asp) *Washington Post* user accounts were hacked. This was a major incident because it was one of the first attacks on a prestigious media institution. It shook public confidence in the security of the trusted company. 

Hackers were able to get in via the *Washington Post*'s Jobs site.They stole usernames and email addresses — likely in order to conduct [phishing scams](https://auth0.com/blog/phishing-attacks-with-auth0-facts-first/), according to [*PC Mag*](https://www.pcmag.com/article2/0,2817,2388200,00.asp).

The company released an informational piece on online scams following the attack.

![Washington Post Scam](https://images.ctfassets.net/23aumh6u8s0i/7ikzMFxC9eaSZVyOhAzsIt/f294320bf73f546245712e4b8f80632c/washington-post)
[Source: Washington Post](http://www.washingtonpost.com/wp-srv/jobs/product-pages/fraud-email.html?noredirect=on)

Because such an attack was relatively new at the time, the piece helped users [understand the risks](http://blog.idonethis.com/security-ringcaptcha/)and what they could do to move forward.

## 7. DailyMotion Personal Data Theft

When DailyMotion was hacked in October 2016, it was one of the most visited sites online. A Russian hacker named Peace breached 85.2 million accounts and stole email addresses and usernames. *The Hacker News* reported that [18 million users](https://thehackernews.com/2016/12/dailymotion-video-hacked.html) had [hashed passwords](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/).

In 2018, DailyMotion was fined [€50,000](https://www.broadbandtvnews.com/2018/08/03/dailymotion-fined-for-data-breach/) for the incident.

## 8. Myspace Data Breach

Hackers were suspected of taking usernames and passwords from [360 million stolen Myspace accounts](https://techcrunch.com/2016/05/31/recently-confirmed-myspace-hack-could-be-the-largest-yet/) and selling them to a forum online in 2016, according to [TechCrunch](https://techcrunch.com/2016/05/31/recently-confirmed-myspace-hack-could-be-the-largest-yet/).

At the time, the Myspace attack was suspected to be the largest data breach of all time. Although data was mostly from accounts that weren't currently active, because people [reuse the same passwords](https://auth0.com/blog/avoiding-password-reuse-attacks/), hackers had the potential to use the information to log into other active accounts of the users.

## 9. Quora Security Incident

The attack on Quora occurred just a few weeks ago — in December 2018. The company released a [comprehensive statement](https://blog.quora.com/Quora-Security-Update?awc=15748_1545351800_5f9ec96c657ae3bee293392a15c47366&uiv=6&txtv=8&source=awin&medium=ad&campaign=uad_mkt_en_acq_us_awin&set=awin) detailing what occurred, what information was involved, and what Quora was doing to rectify the situation. 

A portion of the statement is below: 

![Quora Security Incident](https://images.ctfassets.net/23aumh6u8s0i/5dP0e79zrDmeTkosePu77k/0aec22bc42bd30ac30c2a74e1024ed95/quora-security-update)
[Image Source: Quora Blog](https://blog.quora.com/Quora-Security-Update?awc=15748_1545351800_5f9ec96c657ae3bee293392a15c47366&uiv=6&txtv=8&source=awin&medium=ad&campaign=uad_mkt_en_acq_us_awin&set=awin)

The company continues to have up-to-date FAQ on security [here](https://help.quora.com/hc/en-us/articles/360020212652-Quora-Security-Update-FAQ).

## 10. Associated Press Attack

Taking a different approach, hackers in 2013 accessed the Associated Press's Twitter account and [tweeted](https://www.marketwatch.com/story/this-day-in-history-hacked-ap-tweet-about-white-house-explosions-triggers-panic-2018-04-23) that there were explosions in the White House and that Obama was injured. In six minutes, before order was restored, the Dow Jones Industrial Average plummeted. The hack impacted the stock market by [$136 billion](https://www.washingtonpost.com/news/worldviews/wp/2013/04/23/syrian-hackers-claim-ap-hack-that-tipped-stock-market-by-136-billion-is-it-terrorism/?utm_term=.6795bf505121). 

A group called the Syrian Electronic Army [claimed responsibility](https://www.marketwatch.com/story/this-day-in-history-hacked-ap-tweet-about-white-house-explosions-triggers-panic-2018-04-23) for the attack.

## 11. Twitter Data Breach

Finally, even Twitter hasn’t escaped unscathed. In May 2018, the company [shared](https://blog.twitter.com/official/en_us/topics/company/2018/keeping-your-account-secure.html) that they had identified a bug in their internal log of user passwords that prevented Twitter from completing the [hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) process and fully securing them. 

![Twitter Data Breach](https://images.ctfassets.net/23aumh6u8s0i/27CklKf5h0eco99KcmDXEi/98504ef54775e3f97b08b80fd18bf00a/twitter)
[Image Source](https://blog.twitter.com/official/en_us/topics/company/2018/keeping-your-account-secure.html)

They asked users to re-set their passwords to prevent unwanted access — but the company's reputation suffered.

## What These Data Breaches Have in Common

Many of these attacks have common threads:

* Cyberthieves use [passwords that have been recycled](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/) — allowing them to access multiple accounts for a single individual.
* Hackers often get in through [vulnerabilities](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/) in a company’s or third party’s system.
* Companies don’t always know how to respond to an incident in productive ways (although some are bold and clear with their communications).

Given similar issues among major data breaches, these are the areas to double down on to prevent future attacks.

## What You Can Do to Protect Yourself

There is no one-size-fits-all solution to protect your company against a data breach. If you’re new to [managing customer data](https://blog.getbase.com/8-ways-to-effectively-manage-your-customer-data) you might start with comprehensive employee training or make it a point to store only the data you really need.

_[Outsourcing cybersecurity to an expert team](https://auth0.com/forrester-total-economic-impact/)_ is increasingly popular among companies that deal with vast amounts of customer information. While internal IT teams are usually quite capable, they simply have too much on their plates to stay on the cutting edge of security — which is where you need to be to keep up with cybercriminals.

Solutions like Auth0 that come with [built-in security certifications](https://auth0.com/security/) can give you peace of mind knowing that you have a group working 24/7 on your security systems. It can free you up to build and roll out new products directly tied to your bottom line.

Among our many offerings, Auth0 has a special [breached password detection feature](https://auth0.com/breached-passwords) that monitors large-scale data breaches and notifies your users when their credentials are leaked. You can opt to block access until the user has reset their password.

See [here](https://auth0.com/) for our full suite of offerings to help you stay safe in 2019!


11 of the Worst Data Breaches in Media

Customer identity and management technology plays an important role with media and publishing companies as they optimize their paywalls to convert more subscribers.

The media and publishing industry has been through the wringer in the last decade losing a whopping [$31 billion](http://www.pewresearch.org/fact-tank/2017/06/01/circulation-and-revenue-fall-for-newspaper-industry/) of their total advertising revenue, and the forecast for the future is more of the same.

But before you give up hope for the future of digital media, there may be a reason for optimism: people don't prefer ads and are willing to pay for ad-free content. Ad-blocking software is on the rise with [25% of internet](https://www.emarketer.com/Article/US-Ad-Blocking-Jump-by-Double-Digits-This-Year/1014111) users currently blocking ads. In fact, publishers are turning to CIAM (Customer Identity and Access Management) technology to help them deliver [personalized ads](https://auth0.com/learn/media/) to enhance the experience.

According to a recent study by [Media Insight Project](http://fortune.com/2017/05/02/paying-for-the-news/), over 50% of adults already pay for some form of news or magazine content. Since the Wall Street Journal took a stand in the 1990's and implemented a [hard paywall](https://en.wikipedia.org/wiki/Paywall), consumers have shown that they can be willing to pay for written content.

![Protecting content with a paywall](https://images.ctfassets.net/23aumh6u8s0i/7hueNFqSY22hrY2RHPi6ms/7f081a88c720fe6b07bef57f2c131310/paywall)

This willingness to pay has shifted the revenue model where acquiring new paying subscribers is more lucrative than relying on advertising revenues. But with so much free content just a click away, media and publishing companies must deliver a compelling [customer experience](https://www.zendesk.com/resources/why-companies-should-invest-in-the-customer-experience/) to compete and attract new customers.

**A key driver in converting new subscribers is your [paywall](https://en.wikipedia.org/wiki/Paywall) strategy.**

Paywalls, which were once used to keep non-paying users out, are evolving to entice new customers to pay. In this post, we’ll share how these paywall strategies work with CIAM technologies to help publishers attract new customers and drive revenue through three standard approaches: metered, freemium and hybrid.

## **1. Soft Paywalls: Hook them with a sample of your content**

Metered paywalls give users access to a fixed amount of articles before they are forced to subscribe. This is the popular approach for brands with a larger, more established readership, such as NY Times and Financial Times. Metered access allows publishers to show their value and then upsell their readers to access more.

![Metered paywalls give users access to a fixed amount of articles before they are forced to subscribe](https://images.ctfassets.net/23aumh6u8s0i/4YJRZaOYZ5MxWrXzJcxPSV/e671abd47f9bbdc58962b8f414a64616/metered-content)

If your company consistently delivers high-quality content, the metered paywall can be very effective. Over the past year, the NY Times has increased first quarter [circulation revenues](https://www.forbes.com/sites/greatspeculations/2017/05/04/new-york-times-digital-subscriptions-continue-to-drive-growth/#714b6047295c) by 11% with digital-only subscription revenue growing at 40% year-over-year to $76 million.

<include src="TweetQuote" quoteText="Soft paywalls can hook potential customers."/>

### How CIAM Helps Convert Your Anonymous Users

Metered paywalls are most effective when you can accurately track users to ensure they don't go beyond their article limit, while also [leveraging their behavioral data](https://amplitude.com/blog/2016/09/21/interpret-emotion-intent-through-behavioral-analytics/) to recommend additional articles that they would like to read in order to improve a conversion.

CIAM technology gets the most out of your metered paywall by giving every visitor, even if they don't sign up, a unique ID that follows their activities and gathers relevant behavioral data.

The [anonymous data](https://github.com/auth0-samples/auth0-anonymous-tracker) informs your marketing efforts to attract like-minded users, but, more importantly, you can personalize your paywall pages with relevant content based on the behavior of your anonymous user. When you customize your paywall messaging to speak directly to a user based on their interests, your conversion rates will skyrocket.

## **2. Freemium Paywall: Give away your core product with compelling add-ons**

The freemium model divides content into free and premium sections where users are able to access most of the site indefinitely, but there are special areas that are walled off and require paid access.

Freemium gives publishers control over the content and services that are set aside for paying customers, which allows them to test prices, subscription offerings, and features to acquire new customers. ESPN has developed several premium products to upsell their free readership, including their Insider content series.

![Insider content series from ESPN](https://images.ctfassets.net/23aumh6u8s0i/4SgN6iT7JSSYIw1eixs8xr/faa9a8ddc4bc9623392659c150b02fff/insider-content)

As the trend towards paid subscriptions continues to grow, the freemium model has become a popular strategy for lesser-known content providers who need exposure before they can prove themselves as a subscription business. But for larger companies, like ESPN, there is still a benefit in collecting user data from their free users to develop more relevant products.

<include src="TweetQuote" quoteText="Freemium content is a great way to get known before trying to upsell."/>

### How CIAM Removes The Friction To Sign Up For Free Content

The freemium model gives publishers a few avenues to upsell premium products, but there is also an opportunity to generate user sign-ups. By asking users to sign up for limited access to premium content, to allow commenting on articles or to receive a newsletter, you can collect their registration data. But it needs to be super easy and painless.

When you implement a CIAM [social login](https://auth0.com/learn/social-login/), sign-up is quick with a 1-click registration. Once they log-in to your service, the social login gives you access to their social media data, which will help you personalize your marketing and content efforts in the future.

![CIAM social login helps you personalize your marketing and content efforts](https://images.ctfassets.net/23aumh6u8s0i/7F1OTYw4GrdDZc55wdLgFk/f11de0fad442752b70bcb9772dfff5e6/social-login)

You get permission-based access to the user's data including their interests, preferences, locations as well as accurate demographic data. These customer attributes are key in developing customized offers for upsell, informing content and new product decisions and developing customer relationships that drive future referrals.

With a CIAM tool like [Auth0](https://auth0.com/learn/social-login/), you can choose from over 30 social networks for your social login including Facebook, Twitter and PayPal.

## **3. Hybrid Paywalls: Deliver unique offers based on the customer**

Digital marketing success relies on giving your [customers a personalized experience](https://www.fullstory.com/resources/marketers-customer-experience-guide/measuring-customer-experience/), where the right message is delivered to the right person and the right time. A hybrid paywall approach mixes offers to reach a broader audience.

The Wall Street Journal, known as one of the first to implement the strict hard paywall, has been experimenting with a 24-hour guest passes for non-subscribers who click on a story shared by a current subscriber or a WSJ writer.

![Hybrid Paywalls](https://images.ctfassets.net/23aumh6u8s0i/6yi41aRvNkZRpQ85YLlRUp/572912ec16b2792b61bfdbdbc2a11eb1/hybrid-paywall)

While the social strategy is sound to entice users based on articles they like, we should point out that the WSJ is not using a social sign-in, which is a huge missed opportunity. Especially when their traffic for this promotion is coming from a socially-driven effort.

That said, leveraging social sharing in this way creates an organic way for people to join the WSJ based on an article that was shared within their social network with a topic that uniquely interests them. [More than 50%](http://www.niemanlab.org/2016/12/the-wall-street-journal-is-confident-a-loosened-paywall-will-draw-the-paying-readers-it-needs-to-survive/) of the Journal’s subscription sales now come from individual articles.

The hybrid paywall is a broad approach that opens the door for experimentation. If you approach your paywall as a conversion tool, the best strategy is always to test, measure and iterate until you find your sweet spot.

### How CIAM generates Customer Insights To Customize your Paywall

If the WSJ used a social login, they would instantly gain a single view of their customer across all their marketing initiatives. Social profiles on sites like Facebook represent the true identity of a user, so once you connect with that social network via social login, you have the actual identity of your subscriber.

You can then integrate this data with your CRM and marketing automation technologies to create highly-targeted marketing campaigns that deliver relevant and compelling offers to those customers. This type of personalized messaging ends with a custom paywall that delivers the right offer to the right user.

[Acquiring customers in the digital age](https://www.interana.com/blog/how-leading-companies-are-tackling-the-challenges-of-digital-transformation/) hinges on giving your users an experience that is relevant and adds value to the individual. CIAM technology can give you the [customer insights](https://auth0.com/blog/customer-data-is-king-four-ways-to-know-your-customers-better/) you need to execute this type of personalized marketing campaign.

## Optimized paywalls just might be the future of media and publishing

The media and publishing industry will experience a revenue renaissance, as long as they are able to attract and retain new subscribers.

Paywalls will play an important role within the sales funnel as the point of conversion. Although there are different paywall methods, the end goal is to drive revenue. In each approach, CIAM has an important role in increasing conversions and generating new customer insights that lead to more relevant marketing.

The next decade is up for grabs for the digital media industry, and the companies that embrace customer access and identity technologies will have a data-driven edge in attracting new customers with paywalls that entice rather than deter.

"media"