andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Learn how to enable self-subscription in your B2B SaaS application and automate the Organization creation process using the Auth0.NET SDK.

Enable Self-Subscribing Model in Your Blazor B2B SaaS Application

Sam4-square

I'm an Identity nerd with many years of experience as a developer and advocate. I love explaining complex topics clearly and understandably. You can find me on stage at developer events worldwide or simply having great conversations in the hallway. Google has recognized me as a Google Developer Expert (GDE) in the domains of Web Technologies, Security, Privacy, Payments, and Identity.

Sam Bellen

Supercharge your Auth0-issued access tokens with information, like organizations a user belongs to, from your Auth0 FGA decision engine.

Auth0 supports Roles and Permissions and allows you to add users' permissions to your access tokens with a convenient toggle in the dashboard. But what if you’re using a more fine-grained solution to make access control decisions, like [Auth0 FGA](https://a0.to/auth0-fga-content) or its open-source counterpart, [OpenFGA](https://a0.to/fga-content)?

Actions are our way of offering developers flexibility. There are many different use cases for Auth0 Actions, and enriching an access or ID token is one of them. In this blog post, we’ll explore how we can add some relevant user data from our Auth0 FGA decision engine to the access tokens issued by our Auth0 tenant so that we can use that data in our application logic.

## Prerequisites

For this blog post, we assume you are familiar with either Auth0 FGA or OpenFGA and have an instance up and running. If you’d like to follow along, you can use the following model and tuples to set up a test store, or you could adapt the code for our Auth0 action later to reflect your use case.

> If you are unfamiliar with Auth0 FGA, OpenFGA, or how to get started, read [this blog](https://auth0.com/blog/fine-grained-access-control-with-okta-fga-nextjs/) post to learn more.

## The OpenFGA Authorization Model

Our [model](https://openfga.dev/docs/getting-started/configure-model) will contain a “user,” an “organization,” and a “document” type. An organization can have admins who are defined users and members who are either directly defined users or any user who’s already an admin for the organization. One or more organizations can own documents, and access rights are determined by the “doc_creator” and “doc_admin” relations from these organizations.

```
model
schema 1.1

type user

type organization
relations
    define admin: [user]
    define member: [user] or admin
    define doc_creator: [user] or member
    define doc_admin: [user] or admin

type document
relations
    define owner: [organization]
    define can_create: doc_creator from owner
    define can_delete: doc_admin from owner
```

### OpenFGA Test Tuples

These are [the tuples](https://openfga.dev/docs/getting-started/update-tuples) I’ve added to our Auth0 FGA Store. The ``auth0|62...7f`` is a user identifier within Auth0 and will be part of the Access Token as the `sub` claim. We’ll use these user IDs in our action code to look up all organizations belonging to the current user.

```js
[
    {
      "object":"organization:devrel",
      "relation":"admin",
      "user":"user:auth0|62...7f"
    },
    {
      "object":"organization:openfga",
      "relation":"member",
      "user":"user:auth0|62...7f"
    }  
]
```

## Let’s Write Our Auth0 Action

We can create our [Action](https://auth0.com/features/actions) from the Library page under the Actions menu item. Once we’ve navigated to this page, click the “Create Action” button in the top-right corner. This will allow us to install an action from the marketplace, start from an existing template, or write one from scratch. We’ll choose “Choose a template”, as there’s a template available that can serve as a solid basis from which to start.

![Let’s Write Our Auth0 Action](https://images.ctfassets.net/23aumh6u8s0i/6MUa1wOTUXVfJjelvLvUNT/d006cd1500a5dd4531ba4b6f0e9190a5/enrich-auth0-access-tokens-with-auth0-fga-data_01.png)

On the next page, select the “Enrich profile” use case and click on the “Add Email to Access Token” template. This template will add an email address to your access tokens, but we’ll adapt it to add organizations from Auth0 FGA instead.

![Template for Actions](https://images.ctfassets.net/23aumh6u8s0i/4NDnN6YTO3fMSBNBGUfYXh/ff765bc5ef61b437d2b8862cda074bc3/enrich-auth0-access-tokens-with-auth0-fga-data_02.png)

You can now preview the code from the template and click on the “Use This Template” button to install it. The following popup will ask you to give a name to the new action. We will leave the “post-login” trigger and node runtime as is and click “Create”.

![Add Email to Access Token](https://images.ctfassets.net/23aumh6u8s0i/3UhXvF3kmvyW5JuqLILbHn/4f2c28ffb2af2d164ba3bdc5ed2bf9a9/enrich-auth0-access-tokens-with-auth0-fga-data_03.png)

![Create Action](https://images.ctfassets.net/23aumh6u8s0i/6JWXbwZJVcgnltt0oI7JXM/c1a7905d5d73d68f6964bc7798493d17/enrich-auth0-access-tokens-with-auth0-fga-data_04.png)

### Namespace our custom claim

The [OpenID Connect specification](https://openid.net/specs/openid-connect-core-1_0.html#AdditionalClaims) recommends adding a namespace to [custom claim](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims#namespaced-guidelines) names. The first few lines of code in our `onExecutePostLogin` function do just that. They check for a secret called `namespace` and ensure that it ends with a trailing slash.

We can add the namespace to the secrets by clicking on the Key icon in the left-side menu of the Action editor and clicking on the “Add Secret” button. Namespaces are usually a URI, so we will add `https://example.com` as a `NAMESPACE` secret. Feel free to change this to a more appropriate namespace.

### Install and configure the OpenFGA SDK

The Actions editor also conveniently allows us to install packages from NPM. We can add the OpenFGA SDK by clicking on the box icon on the left side and clicking on the “Add dependency” button. The package name will be `@openfga/sdk`, and the version can remain “latest”. This will install the [`@openfga/sdk`](https://www.npmjs.com/package/@openfga/sdk) package so we can import and use it in the Action codebase.

Add the following line to the top of the Action’s codebase:

```js
const { OpenFgaClient, CredentialsMethod } = require('@openfga/sdk');
```

Now that we’ve imported the OpenFGA client, let’s create a new instance and configure the credentials. 

```js
const fgaClient = new OpenFgaClient({
    apiUrl: event.secrets.FGA_API_URL,
    storeId: event.secrets.FGA_STORE_ID,
    authorizationModelId: event.secrets.FGA_MODEL_ID,  // Optional, by default it will use the latest model
    credentials: {
        method: CredentialsMethod.ClientCredentials,
        config: {
            apiTokenIssuer: event.secrets.FGA_API_TOKEN_ISSUER,
            apiAudience: event.secrets.FGA_API_AUDIENCE,
            clientId: event.secrets.FGA_CLIENT_ID,
            clientSecret: event.secrets.FGA_CLIENT_SECRET,
        }
    }
});
```

It is a good idea to create a new authorized client through the [Auth0 FGA dashboard’s](https://dashboard.fga.dev/) settings page for us to use in the Actions editor. Once you’ve created this new client, you can add its Client ID and secret to the Actions editor’s secrets, together with all other necessary configuration parameters. 

Here’s a quick overview of what they should look like. Be sure to change the `eu1` region in the API URL and Audience to `us1` or `au1` depending on which jurisdiction you choose when creating your store.

```
FGA_API_URL=https://api.eu1.fga.dev
FGA_API_AUDIENCE=https://api.eu1.fga.dev/
FGA_API_TOKEN_ISSUER=auth.fga.dev
FGA_CLIENT_ID=0U...4q
FGA_CLIENT_SECRET=pB...kf
FGA_STORE_ID=01...1M
FGA_MODEL_ID=01...9C
```

### List all assigned organizations from Auth0 FGA

Auth0 FGA exposes a `list-objects` endpoint that can return a set of objects of a particular type assigned to a user, such as all organizations for which a user is a member. This will also consider all indirect relationships, such as when a user is a member because they are an admin for a specific organization.

To use this endpoint, the OpenFGA client we just created exposes a `listObjects` method where we can pass a user, relation, and object type. Notice that we pass along the `user_id` from `event.user`. This is the actual ID of the user who is currently trying to log in.

Add the following snippet below the OpenFGA client initialization code in our Action.

```js
const {objects} = await fgaClient.listObjects({
    user: `user:${event.user.user_id}`,
    relation: "member",
    type: "organization",
})
```

### Add the Assigned Organizations to the Access Token

The last thing left to do is to add the returned organization to our access token. We can re-purpose the last existing line from the template by adding the email to add our organizations instead. With some minimal changes, that code will look something like this.

```js
api.accessToken.setCustomClaim(
  namespace + 'organizations', 
  objects.map(organization => organization?.replace('organization:', ''))
);
```

The `list-objects` endpoint returns the object type together with the actual objects, so in our case, we can strip `organization:` from each returned organization. This will keep the organization names, which we can add to the custom claim.

### Putting it All Together

If we add some error handling, we’ll end up with an action that should look like this. 

```js
const { OpenFgaClient, CredentialsMethod } = require("@openfga/sdk");

exports.onExecutePostLogin = async (event, api) => {
  let namespace = event.secrets.NAMESPACE || "";
  if (namespace && !namespace.endsWith("/")) {
    namespace += "/";
  }

  try {
    const fgaClient = new OpenFgaClient({
      apiUrl: event.secrets.FGA_API_URL,
      storeId: event.secrets.FGA_STORE_ID,
      authorizationModelId: event.secrets.FGA_MODEL_ID,
      credentials: {
        method: CredentialsMethod.ClientCredentials,
        config: {
          apiTokenIssuer: event.secrets.FGA_API_TOKEN_ISSUER,
          apiAudience: event.secrets.FGA_API_AUDIENCE,
          clientId: event.secrets.FGA_CLIENT_ID,
          clientSecret: event.secrets.FGA_CLIENT_SECRET,
        },
      },
    });

    const { objects } = await fgaClient.listObjects({
      user: `user:${event.user.user_id}`,
      relation: "member",
      type: "organization",
    });

    api.accessToken.setCustomClaim(
      namespace + "organizations",
      objects.map((organization) => organization?.replace("organization:", ""))
    );
  } catch (error) {
    api.access.deny("Could not list organizations");
  }
};
```

The issued access token will now have a custom `https://example.com/organizations` claim, and when decoded, it can look something like the following:

```js
{
  "iss": "https://<your-tenant>.eu.auth0.com/",
  "sub": "auth0|62...7f",
  "aud": [
    "https://example.com",
    "https://<your-tenant>.auth0.com/userinfo"
  ],
  "iat": 1740579493,
  "exp": 1740665893,
  "scope": "openid profile email address phone",
  "jti": "rDk6D9GigyYTfi2WN492AB",
  "client_id": "T1...aW",
  "https://example.com/organizations": [
    "devrel",
    "openfga"
  ],
}
```

## Wrapping Up

In this article, we’ve gone through the steps to create a new Auth0 Action. This action will run every time a user logs into our application and adds all organizations that the user is a member of to the Access Token. We can use this information in our backend systems by decoding the Access Token, which will be a JSON Web Token, and looking for our custom claim `https://example.com/organizations`.

The action does the following steps to accomplish this:

* Import the [OpenFGA Node.js SDK](https://github.com/openfga/js-sdk).
* Make sure we have a namespace configured and that it ends with a slash.
* Create a new instance of the imported OpenFGA client.
* Use this client to list all organizations assigned to the user by using the exposed `listObjects()` method.
* Return the list of organizations as a custom claim prepended by our namespace in our Access Tokens.


Enrich Auth0 Access Tokens with Auth0 FGA Data

Enable multitenancy in your Blazor Web App with Auth0 Organizations and get ready for B2B.

Add Auth0 Organizations to Your B2B Blazor Web App

Jax Painter

Director, Product Marketing

To meet innovation, experience, and security requirements, organizations must establish digital Identity strategies and implement them into every product and service.

## The Multifaceted Challenges of Managing Digital Identities

People leading development, technology, security, and product strategies collectively seek to drive innovation and improve customer and employee experiences. Aligning those teams while managing an increasingly complex technology and security threat landscape is easier said than done.

Without a unified digital Identity strategy, developers and product teams often experience problems balancing customer experience, security, and speed. These challenges create delays and slow product development cycles, from planning and coding to maintenance and scale out. Technology and security teams can also struggle to streamline access for employees in ways that don't create vulnerabilities.

The stakes to get Identity correct are so high that fear often creates additional blockers. No one wants to make a mistake that could jeopardize their career or end up being tomorrow’s headline. An organization's reputation is now deeply tied to how well it protects customer data against rapidly evolving threats. So the bottom line is: Security breaches and regulatory compliance issues can result in devastating costs. In 2024, the global average cost of a data breach was [$4.88 million](https://www.ibm.com/reports/data-breach), a 10% increase since 2023.

To meet today's (and tomorrow's) innovation, experience, and security requirements, organizations of all sizes must establish intentional digital Identity strategies and implement them into every product and service from the ground up.  

## Seamless Experiences Are Driven by Digital Identities

Business efficiency and growth depend on seamless experiences for customers and employees. All of these experiences — from customer-facing digital services and AI-driven innovations to employee onboarding and business intelligence — are driven by scalable Identity and data access controls.

Achieving business efficiency and growth is easier when teams can take advantage of automation, no-code solutions, AI, and other technologies to eliminate rote work and focus on what drives the business forward. Along with equipping developers and product teams with intelligent, integrated tools for managing authentication, a unified digital Identity solution also empowers technology and security teams with flexible, scalable tools for managing customer and employee access. By implementing an integrated strategy for digital identities, organizations can:

* Infuse consistent Identity practices into agile development processes
* Implement critical changes like single sign-on and privileged access management faster
* Scale out solutions with less effort
* Help prevent risks associated with cloud usage, shadow IT, and anywhere collaboration
* Keep up with rapidly evolving cybersecurity challenges and regulations

## A Unified Digital Identity Approach Makes It Easier to Drive Innovation with Data

Effective and easy-to-use digital Identity solutions can empower any organization to fearlessly innovate and readily adapt to changing markets and customer demands. With the right authentication and access management tools, teams can safely leverage data to develop differentiating experiences and products using technologies like AI.

Organizations that successfully implement a unified digital Identity strategy realize measurable benefits across multiple fronts through financial savings and by improving productivity throughout the organization. In a research study, IDC found that companies using CIAM solutions [saved $4.3 million](https://www.okta.com/sites/default/files/2022-06/TheBusinessValueofOktaCustomerIdentityandAccessManagement.pdf) through productivity improvements alone, and for every customer-facing application they saw >$166,000 in combined annual benefits. IDC also found team efficiency benefits throughout organizations, with a 33% time savings for IT and infrastructure teams, 23% for developer teams, and 13% for security teams. 

## Identity Is Everyone’s Business 

When leaders spearheading development, technology, security, and product roadmaps understand how important a unified digital Identity strategy is, they can work together on a comprehensive strategy that equips everyone to achieve their goals. 

Developers can quickly and easily build and maintain required authentication flows that don't break and keep customers happy. Security teams can see who has access to what, when, and under whose authorization — on demand and across silos. 

Product teams can get to market faster while helping to ensure customers that their data is safe. Technology leaders can implement unified solutions that scale, lower risk, and ultimately improve the experiences of employees and customers. 

Interested in learning how to implement a collaborative strategy for digital identities? Stay tuned for the next four blogs in the Innovation Ignited series covering Identity responsibilities that development, technology, security, and product leaders face and the outcomes they can realize with a unified digital Identity strategy.

* Create a culture of synergy with digital identities: This piece explains how development leaders can empower teams to overcome authentication complexity and focus on creating differentiating solutions that improve customer experience 
* Ignite innovation with digital Identity: This piece explores how technology leaders can optimize Identity and Access Management and authentication to create a culture of alignment that fuels collaboration and continuous improvement
* How to keep your developers focused on development: Identity management burdens often overwhelm developers and delay product launches, but leaders can streamline authentication through unified digital identity solutions, allowing teams to focus on core innovation
* Accelerate product workflows and adoption: Learn how product leaders can create ambitious and realistic roadmaps that include differentiating authentication capabilities — while accelerating the journey from ideas to market success

## Accelerate Your Organization's Growth

Improve user experience, security, and innovation with a unified digital Identity solution. 

> [Read more from Auth0 thought leaders](https://www.okta.com/blog/)

## Resources

Auth0 equips organizations with an intelligent, integrated digital Identity solution that makes it easier to meet security and business requirements — and drive growth, differentiation, and impact. To learn more about how Auth0 equips businesses of all sizes with the tools they need for unified digital Identity strategies, check out the following resources.

* [Okta Named a Leader in 2023 Gartner® Magic Quadrant™ for Access Management for Seventh Consecutive Year](https://www.okta.com/press-room/press-releases/okta-named-a-leader-in-2023-gartnerr-magic-quadranttm-for-access/)
* [Okta named a Leader in first ever Forrester Wave™️ for Workforce Identity Platforms](https://www.okta.com/resources/analyst-research-okta-named-a-leader-in-first-ever-forrester-wavetm-for-workforce/)
* [Okta Recognized as a Gartner® Peer Insights™ Customers' Choice for Access Management](https://www.okta.com/resources/analyst-research-okta-recognized-as-a-2024-gartner-peer-insights/)

Innovation Ignited: How to Start Your Digital Identity Management Journey

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Demo Auth0 - a series where we explore auth use cases and demonstrate how to build them using Auth0

<AmpContent>
<amp-youtube
    data-videoid="fjzahoZQjLs"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/fjzahoZQjLs' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Welcome to Demo Auth0, where we discuss different identity use cases proposed by our customers and developers and how they each used Auth0 to solve their specific needs. If you missed our first episode, we featured our good friends at Vercel, where we discussed [our Vercel integration](https://auth0.com/blog/auth0-vercel-integration/), multi-tenancy, and boba; feel free to check it out [here](https://www.youtube.com/watch?v=aU9DWD1RLiM).

In this episode, we sat down with the [Mindfuel](https://www.mindfuel.ai/) team’s CPO and Co-founder, [Max Könnings](https://www.linkedin.com/in/mkoennings/), and Director of Software Engineering, [Anton Reindl](https://www.linkedin.com/in/anton-reindl/). Mindfuel is an [Auth0 for Startups](https://auth0.com/startups/profiles) graduate who helps their customers drive business value from their AI and data. By using Auth0, Mindfuel was able to get up and running quickly and securely. Read on to learn about their implementation journey and where they’re headed next.

## Mindfuel and Delight’s Origin Story

The Mindfuel team started as a consultancy leveraging data science, AI, and product management to support businesses. This resulted in helping clients build data and AI into their services, products, and internal processes, serving many different stakeholders.

“This year, about $150B was invested worldwide in AI and data, and 80% of the technologies never made it to production.” - Max Könnings, Founder and CPO, Mindfuel. To help tackle this problem, the Mindfuel team launched an application called Delight to bridge what they call the “AI business gap” — the gap between what a business needs and how teams can deliver on those needs using AI and data. Delight is a data impact platform that identifies AI opportunities aligned with business needs, assesses them, prioritizes them based on strategic fit, and builds visualizations and reporting to help ensure data-driven decisions. Mindfuel’s biggest competitor is Microsoft Excel. Just as sales teams use CRMs to manage deals, many AI and data leaders manage their projects using Excel. Mindfuel believes in a future where their product will help customers make the right business decisions and will highlight the impact these teams are creating.

<include src="QuoteCard" body="If we come back to the 80% [of technologies] that never make it into production. It’s mostly not because the technology isn’t there, it’s mostly because we have missing management capabilities." name="Max Könnings" title="Founder and CPO" team="" company="Mindfuel" children="" />

## How Mindfuel Leveraged Auth0

Delight is a tool built for businesses that need to collaborate within their teams. The customer base is primarily large enterprises. These enterprises, especially those in Germany and the EU, have very strict data privacy and protection laws that the Mindfuel team must adhere to, and Auth0 helped them navigate this challenge.

<include src="QuoteCard" body="Auth0 is a super partner because it offers flexible configuration options. We have support for multi-factor authentication, and we allow single sign-on for some of our customers. You can set this up instead of investing weeks of development into those features. We can really focus on the core product and not worry about authentication." name="Anton Reindl" title="Director of Software Engineering" team="" company="Mindfuel" children="" />

Many of the backend functions that Delight needed, like resetting passwords or changing a person's email or username, were available out of the box with Auth0. They didn’t have to worry about building their own backups or the overhead needed when you’re not using an out-of-the-box solution.

> Delight leveraged [**Auth0 Organizations**](https://auth0.com/docs/manage-users/organizations) to best support their enterprise customers within the early days of implementation. With Organizations, they created a secure flow for their business users, set up multi-tenancy, added MFA, and integrated SSO for certain customers—this cut weeks' worth of engineering resources down to hours.

Another feature the engineering team leveraged was [Actions](https://auth0.com/docs/customize/actions). Actions are secure, tenant-specific, versioned functions written in Node.js that execute at certain points within the Auth0 platform. The team was able to build Actions that would happen once the customer approached an event, like logging in. This was a real enabler for customization and allowed the team to add this information to each user’s account, for example, to manage users’ MFA settings and Roles.

When evaluating solutions, the ability to monitor logs and workflows was a priority for the Mindfuel team. With Auth0’s[ integration with Datadog](https://marketplace.auth0.com/integrations/datadog-log-streaming) and a few clicks, the team could see all of the data from Auth0 streamed into Datadog. For example, if one of their users has trouble signing in, the team receives a Slack alert so their customer success team can immediately reach out and help.

Pivoting from the development perspective, Auth0 also supported Mindfuel with its GTM motion. Since they are a small startup that sells to larger enterprises, the sales process is very complex, especially because more regulatory and compliance topics are surfacing in Europe and elsewhere. By using a trusted and well-known solution and leveraging features like SSO, Mindfuel was able to instill confidence in its enterprise buyers and seamlessly adapt to their requirements.

## What’s Next for Mindfuel

Mindfuel is launching its new product, Delight Spark, soon. With Delight Spark, the business side of a company can interact conversationally with AI and data teams. For example, if someone on the team wants to increase a conversion rate, the tool will extract information from the business users and ideate with them about more opportunities. This helps extend the Delight product and makes it more approachable for the entire company, meaning fewer Slacks and emails that block the data and AI teams from building and maintaining their products.

If you want to dig deeper into Mindfuel’s interview and hear their insightful advice to other startup founders, check out the video [here](https://www.youtube.com/watch?v=fjzahoZQjLs\&list=PLshTZo9V1-aFWgshQYa0w80tcv8HLffc6). If you’re interested in joining Mindfuel and 4000+ other startups that have been a part of Auth0 for Startups, apply [here](https://auth0.com/startups/profiles). Happy building!


How Mindfuel Builds and Monitors Auth with Organizations, Actions, and Datadog

peterfernandez_360

As an Architect, Consultant, and Engineer, I have more than 30 years of experience designing and developing secure and robust software solutions. When not helping teams deal with the complexities of Customer Identity, you can usually find me working behind the scenes, acting in or directing a show at my local theatre.

Peter Fernandez

Why a Multi-Tenant approach is fundamental to B2B SaaS, and how using Auth0 and the Auth0 Organizations feature can help implement it.

Demystifying Multi-Tenancy in a B2B SaaS Application

eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Senior Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Product Marketing Manager - Customer Identity Cloud

Eric Wu

Edgar Chirivella

I'm an engineer who focuses on creating high-performance solutions to address real-world problems.

When I'm not coding, you can find me playing musical instruments or dancing.

Software Engineer II

Machine-to-Machine Access for Organizations reaches General Availability (GA), unlocking SaaS APIs for developers

Within Auth0 by Okta, the [Organizations](https://auth0.com/docs/manage-users/organizations) feature allows business-to-business (B2B) software-as-a-service (SaaS) providers to manage their partners and customers and to customize the ways that end users access their applications.

Through a programmatic toolset of APIs and SDKs or directly on the Auth0 dashboard, B2B SaaS providers can use Organizations to:

* Represent their business customers and partners in Auth0 and manage their membership
* Configure branded, federated login flows for each business
* Build administration capabilities into their products, using Organizations APIs, so that those businesses can manage their own organizations

Until now, Organizations was limited to *user*-based authentication in browser-based flows — but with the General Availability (GA) of Machine-to-Machine Access for Organizations, B2B SaaS providers can now define the Organization(s) that a given app can access on its own behalf, via the Client Credentials Flow, for each API. This change allows B2B SaaS providers to open up their APIs, enabling machine-to-machine (M2M) use cases while allowing access to sensitive data and operations of each Organization to be restricted to authorized parties.

## Leading Use Cases

Let’s start with a quick look at what’s going on behind the scenes when a customer wants to interact with a B2B SaaS API via Client Credentials Flow. As depicted in the figure below:

1. First, the customer application gets an access token; with Machine-to-Machine Access for Organizations, the token request communicates new context through the `organization` parameter, and the token itself includes the corresponding `org_id `and `org_name`
2. Next, the customer application calls your API
3. Your API server validates that the target Organization for the requests matches the `org_id/name` included in the access token

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/7miaBmd81uEVLmiy2jshWR/22cd99d26b516d7f9564438ffb4341f5/01_saas.png)

Straightforward and familiar, right?

Indeed, by design, these are exactly the claims used in existing user-based Organizations login flows, allowing B2B SaaS providers to implement the same authorization logic for their APIs across both user and machine-to-machine access.

Now, let’s look at the two primary use cases that this additional context enables, using our fictitious [Travel0 company](https://auth0.com/docs/manage-users/organizations/organizations-overview#sample-scenario).

### Open up APIs to third-party applications

Using Auth0 Organizations and the Management API, Travel0 offers a self-service portal where customers can create and manage their own organizations.

Travel0 wants to make it easy for customers to build bots to help end users find and purchase adventures. Accordingly, as part of this portal, Travel0 allows customers to register their applications (e.g., the bots) to consume the Travel0 API on their own behalf.

In this use case, cross-organization access must be correctly controlled so that applications belonging to a particular organization can only access that organization’s data.

Machine-to-machine access for Organizations allows Travel0’s self-service portal to configure Client Credentials access for customer applications by associating them with a specific organization for each API.

<img src="https://images.ctfassets.net/23aumh6u8s0i/55EYuibQQxOqdyZTyPa2iZ/a0c8fe244c7529b84557c9630ec6c39f/02_saas.png" alt="SaaStart"  width="500" >

As a result, the applications of Travel0’s customer *Org X* can only access the Travel0 API within the scope of *Org X*.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/52X8GLuhURskYrc7ffrYCr/5189f8c7556abea89d01f86d3aae6de9/03_saas.png)

To accommodate aggregators, Travel0 could also configure access from a single application to several organizations.

### Isolation of organizations for internal applications

Travel0 also has internal processes and CLI tools that need to access the Travel0 API using the Client Credentials Flow. To apply a unified access control strategy on the API, Travel0 wants requests from its own applications to be scoped to a specific organization so that only the right data is accessed in each case.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5iwaR7wLph96ViCMEH3Tz1/bb2dc31d783483e9d7a99f10198fd14b/04_saas.png)

Travel0’s services aren’t bound to an individual customer, and Machine-to-Machine Access for Organizations enables Travel0 to configure an application to access any organization for each API using the Client Credentials Flow.

## How Does It Work?

### Extending Client Grants

You may have noticed that the use cases outlined above rely on knowing which Organizations an application is authorized to access.

To support this, we’ve built on the existing concept of [Client Grants](https://auth0.com/docs/api/management/v2/client-grants/get-client-grants), which represent the APIs an application is authorized to access via the Client Credentials Flow. You can now use the Client Grants (1) to specify whether an application can or cannot access an API in the context of an Organization and (2) to control which Organizations the Application can access, with two options:

1. Allow an application to access one (or several) specific organizations. This is especially relevant for the first use case.
2. Allow an application to access all organizations. This is especially relevant for the second use case.

Let’s take a look at the details!

### Configuring Machine-to-Machine Access for Organizations

To get started, you'll need to create one or multiple APIs and Organizations. After that, the process consists of three steps for each Application:

1. Create an Application and enable it to use the Client Credentials flow. To learn more, read [Create Applications](https://auth0.com/docs/get-started/auth0-overview/create-applications) and [Update Grant Types](https://auth0.com/docs/get-started/applications/update-grant-types).
2. Create and configure one or more Client Grants establishing the APIs that can be accessed by the Application.
3. Associate each Client Grant with one or more Organizations.

To create a Client Grant between the Application and an API, simply enable the toggle that can be found in the `APIs` tab under Application details:

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/7AuaxeC6y2TSIn6kVkiOPi/8b0b71bf6a1b209a9c0715a1fb8afebf/05_saas.png)

The Client Grant will now have two extra properties:

* **Organization Support: **Configures whether the Client Credentials requests will `deny`, `allow`, or `require` the `organization` parameter. When configuring the Client Grant using Management API, this field will be called `organization_usage`.
* **Allow Machine-to-Machine access to any organization:** Configures whether the Client Credentials requests will allow any Organization within the tenant. By default, access will have to be granted organization by organization. When configuring the Client Grant using Management API, this field will be called `allow_any_organization`.

The Client Grant can also be created and configured for Organization support using Management API:

```
curl -X POST --location 'https://{auth0Domain}/api/v2/client-grants' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "client_id": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga",
    "audience": "https://example-api",
    "scope": ["create:posts", "read:posts", "update:posts", "delete:posts"],
    "organization_usage": "require",
    "allow_any_organization": false
}'
```

If `allow_any_organization` has been set to `true`, you’re all set — jump to [Getting a machine-to-machine token in the context of an Organization](#Getting-a-machine-to-machine-token-in-the-context-of-an-Organization) to discover the next steps. On the other hand, if you only want to allow access to specific organizations, please continue reading.

### Granting access to concrete Organizations

Once the Client Grant has been configured, it’s time to authorize it to access a specific Organization. To do so, navigate to the organization you would like to grant access to and go to the new `Machine to Machine Access` tab. Click on the `Add Access` button and follow the steps to select the application and the API to which your Organization will have access. This will create an Organization Client Grant, which enables this permission.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5obFwj3Qrm6G1PO3NppmIn/4b095179337103291548d1a275a00aa3/06_saas.png)

The Organization Client Grants can also be created using Management API. Three new scopes control the access to this new resource:

* create: `organization_client_grants`
* read: `organization_client_grants`
* delete: `organization_client_grants`

This is an example request that will grant access to the  `org_Kpu9Q89v57IaZJVK` Organization for the Application and API defined in the `cgr_kapBApAJV3jYdfQq` Client Grant.

```
curl -X POST --location 'https://{auth0Domain}/api/v2/organizations/org_Kpu9Q89v57IaZJVK/client-grants' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "grant_id": "cgr_kapBApAJV3jYdfQq"
}'
```

### Getting a machine-to-machine token in the context of an Organization

Now that everything has been configured, we’re all set to use the feature. Let’s make a Client Credentials request, passing an `organization` parameter:

```
curl --location 'https://{auth0Domain}/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga' \
--data-urlencode 'client_secret=••••••' \
--data-urlencode 'audience=https://example-api' \
--data-urlencode 'organization=org_Kpu9Q89v57IaZJVK'
```

The response received from Auth0 is as follows:

```
{
  "access_token": "eyJhbGciOi...XptRHPuRkw",
  "scope": "create:posts read:posts update:posts delete:posts",
  "expires_in": 86400,
  "token_type": "Bearer"
}
```

Let’s decode the `access_token` payload:

```
{
  "iss": "https://{auth0Domain}/",
  "sub": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga@clients",
  "aud": "https://example-api",
  "iat": 1730308095,
  "exp": 1730394495,
  "scope": "create:posts read:posts update:posts delete:posts",
  "org_id": "org_Kpu9Q89v57IaZJVK",
  "gty": "client-credentials",
  "azp": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga"
}
```

As you can see, the `access_token` now contains the Organization ID in the `org_id` claim.

### Default Organization

If you have any restrictions preventing you or your customers from sending an `organization` parameter in the Client Credentials request or want to use a standard OAuth library that does not support Auth0 Organizations, you can set a Default Organization in the corresponding Auth0 Application, which will be used in all the subsequent Client Credentials requests:

```
curl --location --request PATCH 'https://{auth0Domain}/api/v2/clients/0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
  "default_organization": {
    "organization_id": "org_Kpu9Q89v57IaZJVK",
    "flows": ["client_credentials"]
  }
}'
```

## Additional Resources

Ready to use Machine-to-Machine Access for Organizations? Dive into our comprehensive [documentation](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) for details.

Need a quick refresher on Auth0 Organizations? Watch our [demo video](https://www.okta.com/customer-identity/#organizations) and browse the [documentation](https://auth0.com/docs/manage-users/organizations).

Want a hands-on experience with essential Customer Identity functionalities in B2B SaaS apps? Check out our reference B2B SaaS app [SaaStart](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/).

Your B2B SaaS App Just Got Better

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Explore how tools like Auth0 Organizations, OPA, and Okta FGA can streamline your authorization strategy for secure, scalable SaaS development.

When building a multi-tenant SaaS application, selecting the right authorization model is critical to ensure the security and scalability of your system. Authorization is not only about managing user access but also about ensuring that tenants remain isolated, protected, and—where necessary—able to collaborate. The right model for your SaaS depends on the complexity of your application, the relationships between users and resources, and how dynamic or flexible your access control needs to be. This guide provides a deeper dive into how **RBAC**, **ABAC**, and **ReBAC** can be implemented for multi-tenancy, focusing on what needs to be handled in code versus what can be centralized in a system. We’ll also touch on popular services like [Auth0 Organizations](https://auth0.com/organizations), [OPA](https://www.openpolicyagent.org/), and [Okta FGA](https://fga.dev/) to streamline your implementation.

## Role-Based Access Control (RBAC)

**Role-Based Access Control (RBAC)** is often the first choice for SaaS applications that have clear roles with distinct access privileges and is often the most familiar option among developers. It’s a straightforward model where users are assigned roles (e.g., admin, editor, viewer), and those roles come with specific permissions. In a multi-tenant environment, RBAC needs some enhancements to ensure roles are properly scoped to each tenant. This way, the users' permissions are restricted to their organization.

In a multi-tenant setup, RBAC handles tenant isolation primarily by scoping roles to individual tenants. This means that roles like “admin” or “viewer” are not globally applicable across the system but are assigned on a per-tenant basis. For instance, a user might be an “admin” in “Tenant A” but only a “viewer” in “Tenant B”.

To enforce this isolation, your application will need to ensure that roles are checked **within the tenant context** before allowing access to resources.

At the **code level**, this means ensuring that the application always verifies which tenant the user is operating under when making role-based decisions. For example, when a user tries to access a resource, the system should confirm whether their “admin” role applies to that specific tenant’s resources, not to another tenant’s resources.

> Notice that when using RBAC for authorization, a user under a certain role will get access to all the resources for that tenant. Other authorization models provide ways to scope the privileges of a user to specific resources within the tenant, and we’ll cover them later in the article.

There are simpler approaches to implementing RBAC into your application; for example, when using Auth0 for authentication, Auth0 offers an **Organizations** feature, which simplifies authentication and role assignments in multi-tenant environments. Auth0 Organizations allows you to easily manage users across multiple tenants (or organizations), where each user can be assigned roles specific to the organization they belong to. By using Auth0’s built-in support for multi-tenancy, you can delegate much of the tenant-specific role management to the identity provider, reducing the amount of tenant-scoped logic that needs to be hardcoded into your app.

### Example use cases for RBAC:

- **HR Management Platform**: In an HR platform used by multiple companies, each company (tenant) has its own set of roles, such as "HR Admin" and "Employee." When an HR Admin from Company A logs in, their permissions are limited to the records of Company A, while an HR Admin from Company B has access only to their company’s records.
- **AI-Powered Customer Support Tool**: A SaaS platform for AI-powered customer support allows companies to manage their support teams. Each team has a role structure, where the "Team Lead" has access to configure the AI responses, and the "Support Agent" can only see suggestions.

## Attribute-Based Access Control (ABAC)

ABAC allows you to define access control policies based on various attributes related to the user, resource, or environment. Unlike RBAC, which assigns static roles, ABAC dynamically evaluates attributes such as the user’s department, resource sensitivity, or even contextual factors like time and location. This makes ABAC more flexible for scenarios where access decisions depend on dynamic conditions.

In multi-tenant SaaS applications, ABAC can handle tenant isolation by including the tenant ID as an attribute in access control decisions. For instance, you can create policies that grant access to users based on their `tenantId`, `role`, and `department`. This allows for more granular control over what users from each tenant can access and when.

At the **code level**, the application needs to collect the relevant attributes (e.g., `tenantId`, `userRole`, `resourceSensitivity`) and pass them to the authorization engine for evaluation. The actual logic for determining whether access is allowed is centralized in the policy engine, reducing the need for complex, tenant-specific logic in your app.

There are some caveats, though; while ABAC allows for dynamic evaluation of the information, the relationships and structure of the information are hardcoded throughout the application, and if your attributes change, it may require code changes throughout the application. This is because the relationships between a user, its role, tenant, etc, are not inferred by the policy engine, but rather specified during authorization checks. For an inferred and more fine-grained approach, there’s a different authorization model which I will cover next.

For **system-level implementation**, ABAC policies can be managed using tools like **Open Policy Agent (OPA)** or a custom policy engine. These tools evaluate attributes dynamically, ensuring that access is granted only if all conditions are met. For multi-tenancy, this would include ensuring that users are only accessing resources within their tenant.
`

### Example use cases for ABAC:

- **AI-Driven Healthcare SaaS**: A hospital management system uses ABAC to grant access to patient records based on a doctor’s role, department, and the patient’s condition. Additionally, access is restricted to working hours.
- **AI-Powered Marketing Platform**: Marketing managers can access reports based on their role, the campaign they are working on, and the region of the campaign. ABAC policies check the region, `campaignType`, and `role` attributes to ensure the user is accessing data for their tenant’s campaigns only.

## **Relationship-Based Access Control (ReBAC)**

**Relationship-Based Access Control (ReBAC)** is ideal for SaaS applications where access control is based on complex relationships between users, resources, and organizations. Instead of simply granting permissions based on roles or attributes, ReBAC models relationships (e.g., "is the owner of," "can edit") and uses these to make access decisions. This is particularly useful for collaborative SaaS platforms where permissions are based on how users interact with resources.

> If your SaaS application handles user-generated content, you’ll likely benefit from a ReBAC model)

In multi-tenant ReBAC implementations, tenant isolation is enforced by defining relationships within and across tenants. For example, a user might "own" a resource within one tenant, and another user might have "edit" permissions for that resource based on their relationship. Unlike RBAC, which assigns roles based on predefined hierarchies, ReBAC focuses on how entities (users, resources, tenants) are related.

At the **code level**, your application doesn’t need to hard-code tenant checks. Instead, all access control decisions are based on querying the relationship graph, which models how users and resources are linked. This reduces complexity, as the app doesn’t need to maintain tenant-specific logic.

For **system-level implementation**, **OktaFGA** (or **OpenFGA**, based on Google Zanzibar’s model) provides a powerful platform for managing ReBAC at scale. OktaFGA stores and manages relationships in a graph database and allows your application to query these relationships in real time. You can model tenant-specific relationships and even handle cross-tenant scenarios, such as allowing external collaborators limited access to certain resources.

### Example use cases for ReBAC:

- **AI-Enhanced Document Collaboration Platform: In this multi-tenant SaaS, users can create, share, and edit documents within their tenant. ReBAC models relationships like "owner," "editor," and "viewer" for each document.**
- **AI-Powered Learning Management System**: A university (tenant) uses the platform to manage courses and student access. Students are "enrolled" in courses, and professors "teach" those courses. ReBAC models these relationships, ensuring that only enrolled students can access course materials. If a student transfers to a new university (tenant), their access is automatically updated based on their new relationships within the system.

## Summary

When it comes to building a multi-tenant SaaS application, your choice of authorization model determines how much of the access control logic is handled by your code versus the authorization system and how wide or fine grained the access control is over the resources of the tenants.

- **RBAC** requires tenant-specific role checks in your code, but tools like **Auth0 Organizations** can offload much of this complexity by managing roles and tenants externally.
- **ABAC** offers fine-grained, context-aware access control, where the system dynamically evaluates policies based on attributes like `tenantId` and `role`. Tools like **Open Policy Agent (OPA)** can centralize these decisions, reducing the need for custom code.
- **ReBAC** excels in scenarios with complex, dynamic relationships. Solutions like **OktaFGA** allow you to manage relationships at scale without embedding tenant-specific logic in your app. Instead, the relationship engine handles access control based on real-time relationships between users and resources.

By leveraging these models and tools, you can build a secure, scalable, and maintainable multi-tenant SaaS platform that fits your unique authorization needs.

Thanks for reading!

How to Choose the Right Authorization Model for Your Multi-Tenant SaaS Application

A guide to building B2B SaaS applications using Auth0 and the Auth0 Organizations feature.

A B2B SaaS Application Primer Using Auth0

How to authenticate and manage your business users in a multi-tenant app with Organizations.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>This tutorial uses the Auth0 Organizations feature, which is <a href="https://auth0.com/startups/vip"> available to early-stage startups </a>through our Auth0 for Startups program, free for one year.</b><br> 
</div>

## The Challenge

Developers on a tight schedule need to quickly implement a secure solution. You need to build a product with scalable infrastructure that can be iterated on weeks/months/years down the line. And you need to adhere to ever-changing industry standards and regulations.

<AmpContent>
<amp-youtube
    data-videoid="8s14Nhvgnb0"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/8s14Nhvgnb0' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Building B2B applications comes with many technical challenges, not least of which is how to set up [multi-tenancy](https://auth0.com/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices). [Multi-tenancy](https://auth0.com/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices) is when a single instance of software runs on a server that is accessible to multiple groups of users – managing this across various business communities can be broken down into three different considerations:

* Customizing the login experience for each business, from branding to SSO options,
* Managing users for each business with restricted access based on specific permissions,
* And giving businesses the ability to manage their own members.

## The Solution

Auth0 Organizations is our solution to multi-tenancy from an auth perspective – it’s a feature for developers to manage business users. **Simply put, each business is an Organization. Each Organization has members. Each member can have roles that define their permissions.**

When users log into your application, how they log in depends on the requirements defined by each business. For example, let’s say you have three customers with varying needs:

* Organization A is a small business, so they’re comfortable with letting their members log in with Google or another preferred[ Social identity provider (IdP)](https://marketplace.auth0.com/features/social-connections);
* Organization B is a larger corporation, so they’re expecting to leverage not only[ Enterprise IdPs](https://marketplace.auth0.com/features/enterprise-connections) but also multi-factor authentication (MFA) as an additional layer of security;
* Organization C is a brand new startup with only one employee – the founder – and all they want is a seamless experience.

The typical app user needs to be able to log in to the app and do some basic tasks. All of your business customers also want to distinguish a role for Admins who have additional permissions, like sending invites to cool new members or kicking problematic members out.

![Your App](https://images.ctfassets.net/23aumh6u8s0i/4y486Q5HiJbXmlVq5k71pc/57ab4fbab5c49c769a442b8e781d624e/shreyapost.jpg)

## The Process

Let’s explore what a potential solution with Organizations would look like. (Check out the video for a visual walkthrough.)

### Get Started

1. Open your [Auth0 Dashboard](https://manage.auth0.com/dashboard)
2. Select your Application (left menu) and [configure it for business users](https://auth0.com/docs/manage-users/organizations/configure-organizations/define-organization-behavior)
3. [Create Organizations](https://auth0.com/docs/manage-users/organizations/configure-organizations/create-organizations) for each business customer
4. Enable Social and Enterprise [Connections](https://auth0.com/docs/manage-users/organizations/configure-organizations/enable-connections) and [MFA](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa)
5. [Create roles](https://auth0.com/docs/manage-users/access-control/rbac), [invite members](https://auth0.com/docs/manage-users/organizations/configure-organizations/invite-members) and [assign roles](https://auth0.com/docs/manage-users/organizations/configure-organizations/add-member-roles)

### Get Technical

Integrate this login experience into your React app (or [explore other SDKs](https://auth0.com/docs/libraries)). Follow the[ React SDK quickstart](https://auth0.com/docs/quickstart/spa/react/interactive) for detailed instructions.


1. Install the Auth0 React SDK

```
cd <your-project-directory>
npm install @auth0/auth0-react
```

2. Configure the Auth0 provider component

```js
import React from 'react';
import { createRoot } from 'react-dom/client';
import { Auth0Provider } from '@auth0/auth0-react';
import App from './App';

const root = createRoot(document.getElementById('root'));

root.render(
<Auth0Provider
    domain="{yourDomain}"
    clientId="{yourClientId}"
    authorizationParams={{
      redirect_uri: window.location.origin
    }}
  >
    <App />
  </Auth0Provider>,
);

```

3. Add login to your Application

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const LoginButton = () => {
  const { loginWithRedirect } = useAuth0();

  return <button onClick={() => loginWithRedirect()}>Log In</button>;
};

export default LoginButton;
```

4. Add logout to your Application

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const LogoutButton = () => {
  const { logout } = useAuth0();

  return (
    <button onClick={() => logout({ logoutParams: { returnTo: window.location.origin } })}>
      Log Out
    </button>
  );
};

export default LogoutButton;
```

5. Show user profile information

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const Profile = () => {
  const { user, isAuthenticated, isLoading } = useAuth0();

  if (isLoading) {
    return <div>Loading ...</div>;
  }

  return (
    isAuthenticated && (
      <div>
        <img src={user.picture} alt={user.name} />
        <h2>{user.name}</h2>
        <p>{user.email}</p>
      </div>
    )
  );
};

export default Profile;
```

6. If you need to retrieve the organization the user belongs to, you can use the property [`org_id` in the user object](https://auth0.com/docs/manage-users/organizations/using-tokens), for example you can add the following line of code:

```
<p>{user.org_id}</p>
```

### Go Beyond

Eventually, you may want to do more. You could:

1. [Require multi-factor authentication for users outside their corporate network](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#enforce-custom-mfa-policy) to increase security,
2. [Assign default roles to users on sign-up](https://auth0.com/blog/assign-default-role-on-sign-up-with-actions/) or at another point in the identity flow,
3. And allow customers to self-manage their Organizations using an [admin portal](https://auth0.com/docs/get-started/architecture-scenarios/business-to-business/profile-management#admin-portal).

## The Next Step

Multi-tenancy is a common feature requirement for most B2B apps, but you shouldn’t have to spend all your time on building it. This is just the tip of the iceberg for what you can accomplish using Organizations. [Try it yourself for free](https://auth0.com/signup?utm_source=blog&utm_medium=auth0&utm_campaign=b2bsaas), and [let us know if you have any questions](https://community.auth0.com/)!

Are you an early-stage startup? [Apply now](https://auth0.com/startups/vip) to the Auth0 for Startups program, which is **free for one year** and supports 100 Organizations in prod (and much more).

## More Resources

* Get started with our [React quickstart](https://auth0.com/docs/quickstart/spa/react/interactive)
* Dive deep into the [Organizations docs](https://auth0.com/docs/manage-users/organizations)
* Read about [Solving Digital Identity Management for Your SaaS Application](https://auth0.com/blog/digital-identity-management/)
* Learn more about [Auth0 for Startups](https://auth0.com/startups)
* Ask questions in our [Community forum](https://community.auth0.com/)
* Don't have an app? Check out our [sample B2B app](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter/)

[Open a ticket](https://support.auth0.com/tickets/new) for technical support (available for customers in the Startup plan or other paid plans)


Build a Secure and Scalable B2B SaaS App in React

alex-sloan

Alex is the Director of Social Impact at Auth0, a product unit within OKTA. Auth0’s social impact arm, Auth0.org, seeks to provide Secure Access for Everyone (SAFE) to the resources needed to thrive through the provision of funds, time, product, and passion by our company and our people and to empower developers to strengthen the technological capacity of social impact organizations that drive change in our local communities.

Director, Social Impact

Alex Sloan

5 Nonprofits Joining Auth0’s Grant Partners Program

As we kick off 2022, we are thrilled to welcome the addition of 5 more nonprofit organizations, plus a renewed commitment to our current grant partner Techbridge Girls, to the 35+ amazing social impact organizations we have supported through Auth0’s social impact arm, Auth0.org. Each charity in the Auth0.org program is receiving substantial unrestricted grant support and volunteer hours from Auth0 employees (“Auzurios”).

Since its inception in mid-2020, Auth0.org has granted over $1.1 million to charitable organizations around the world, and Auziros have generously provided their time, money, expertise, and passion to many of these wonderful charities.

This latest cohort of partners is composed of amazing changemakers, globally-recognized institutions, and emerging social good orgs that are breaking down barriers and building people up – reaching new heights in what can be accomplished when care meets cause. 

The members of our latest cohort are:

* [Goodie Nation](https://goodienation.org/)
* [SCWIST (Society of Canadian Women in Science and Technology)](https://scwist.ca/)
* [Washington STEM (Science Technology Engineering and Math)](https://washingtonstem.org/)
* [Techbridge Girls](https://www.techbridgegirls.org/)
* [Coqual Black Equity Index](https://coqual.org/black-equity-index/)

Please be sure to take a moment to learn about our 5 latest cohort members below and consider engaging with them in the ways listed below. Every contribution, whether of your time, money, or expertise helps improve lives locally and globally.

## Auth0.org Fund Winter Cohort 4 Member Organizations

### [Goodie Nation](https://goodienation.org/)

Goodie Nation exists to eliminate the relationship gap that stands in the way of success for too many promising entrepreneurs, especially those who are people of color, women, or aren't located in coastal financial centers. By making sure that every entrepreneur, no matter their background or location, can access the relationships they need to thrive, they are building a more sustainable and prosperous future for all.

![Goodie Nation](https://images.ctfassets.net/23aumh6u8s0i/6IgDZdUUwBvamoaOuJmzNK/0c0100ecb58b7c48baf76ca3bb6007e2/Goodie_Nation.png)

**How You Can Support**

* [Help spread the word](https://goodienation.org/)
* [Make a donation](https://www.pledge.to/goodienation)
* [Purchase some Goodie Nation merch](https://goodienation.org/merch/)
* [Extend your expertise ](https://goodienation.org/intentionally-good/expert-application/)
* [Engage at a virtual speed networking event](https://visit.org/experience/engage-with-diverse-startup-founders-in-a-speed-networking-event_317e)

### [SCWIST (Society of Canadian Women in Science and Technology)](https://scwist.ca/)

The Society for Canadian Women in Science and Technology is a not-for-profit specializing in improving the presence and influence of women and girls in Science Technology Engineering and Math (STEM). Their organization promotes participation and advancement through education, networking, mentorship, collaborative partnerships, and advocacy to remove barriers and create environments where women and girls can flourish.

![SCWIST](https://images.ctfassets.net/23aumh6u8s0i/3rcGvDlZUPI9g0QBozHSp5/f71f054da6faee11ffedf4e122bb6708/SCWIST.png)

**How You Can Support**

* [Help spread the word](https://scwist.ca/)
* [Become a member](https://scwist.ca/get-involved/become-a-member/)
* [Volunteer](https://scwist.ca/get-involved/volunteer/)
* [Gift a membership](https://scwist.ca/shop/membership-gift/)
* [Make a donation](https://scwist.ca/get-involved/donate/)
* [Buy some SCWIST merch](https://scwist.ca/shop/)

### [Techbridge Girls](https://www.techbridgegirls.org/)

Techbridge Girls equips and galvanizes _gatekeepers_ – out-of-school time (OST) educators and STEM professionals – with gender-responsive, culturally relevant curriculum and equity training that empowers them to act as an advocate for BIPOC girls pursuing their STEM aspirations. With a focus on dismantling systemic and structural barriers, Techbridge Girls builds awareness of and advocates for practices and systems that support girls’ STEM persistence and amplifies the voices of educators and BIPOC girls from marginalized communities.

![Techbridge Girls](https://images.ctfassets.net/23aumh6u8s0i/7krKcIix3XiKUQQZSNlmtT/76c4476dd94fc1c133eb1b3ff8bc028d/techbridge_girls.png)

**How You Can Support**

* [Help spread the word](https://www.techbridgegirls.org/get-involved/)
* [Volunteer](https://www.techbridgegirls.org/get-involved/volunteer/)
* [Make a donation](https://www.techbridgegirls.org/donate/)
* [Explore ways to partner](https://docs.google.com/forms/d/1HUK3FJEJpQOU8_KJ5pYebqsN-LlWGOPCUkSA_rP_N5I/viewform?edit_requested=true) 

## [Washington STEM (Science Technology Engineering and Math)](https://washingtonstem.org/)

Washington STEM (Science Technology Engineering and Math) is a statewide, educational nonprofit organization leveraging STEM for social change, removing barriers to credential attainment, and creating pathways to long-term economic security for systemically underserved students.

![Washington STEM](https://images.ctfassets.net/23aumh6u8s0i/39StNKthnmJuDLRwPYll4y/78d7fe0ccf0c29a47954e4a44c78b8d4/Washington_STEM.png)

**How You Can Support**

* [Help spread the word](https://washingtonstem.org/)
* [Make a donation](https://interland3.donorperfect.net/weblink/weblink.aspx?name=E204918&id=25)
* [Check out other ways to give](https://washingtonstem.org/support-us/ways-to-give/)
* [Become a STEM Champion](https://washingtonstem.org/support-us/stem-champion/)

### [Coqual Black Equity Index](https://coqual.org/black-equity-index/)

Coqual is a global, nonprofit think tank and advisory group founded in 2004 to address bias and uncover barriers to advancement for underrepresented populations in the workplace. As champions of equity, researchers of culture, and creators of community, they empower companies to create diverse and inclusive workplaces where every person belongs.

![Coqual](https://images.ctfassets.net/23aumh6u8s0i/4d6JHcf1ZGXb8QPvwnS8Vz/618d480905e5082c4b6e25f2c4a74aa7/Coqual.png)

**How You Can Support**

* [Help spread the word](https://coqual.org/who-we-are/)
* [Check out their extensive research library](https://coqual.org/our-research/)
* [Request to join their Task Force](https://coqual.org/join-the-task-force/)

Auth0.org’s Latest Grant Recipients

Peter-Wheeler-author

Peter leads marketing, community, and customer engagements at Auth0.org. 
With a visceral passion for effective and sustainable Corporate Social Responsibility, Peter develops non-performative programs and engagements for social impact organizations globally. He believes all organizations deserve the opportunity to use technology as a force for good and provide solutions and support to help heroes save the world. Peter prides himself on being a polymath, entrepreneur, innovator, founder, proud failpreneur, strategic marketer, process improver, and sales enabler driving positive impact. Say hi on <a href="https://www.linkedin.com/in/jpeterwheeler/">LinkedIn</a>.



Senior Marketing Manager, Social Impact

Peter Wheeler

Continuing our Pledge to create SAFEr Social Impact Organizations

As a former business owner, nonprofit board member, developer, and volunteer; I know of one consistent, daunting, universal expenditure all modern organizations face - their tech stack. While some items, such as hardware, have a front-loaded cost that can be justified and managed through a lifetime; taking an uncertain “digital leap” for philanthropic entities can be challenging. Even when it's known and agreed that improvements to legacy systems and tools are needed, or that building something completely custom from the ground up to meet the demands of a digital-first economy is in order, there is always trepidation when it comes to modernization and understandably so.

All these issues are even more challenging for charitable, nonprofit organizations and social enterprises, collectively “SIOs,” or Social Impact Organizations. These organizations are critical to our society but sufficient unrestricted funds, tech expertise and time to upgrade their systems and processes are especially precious commodities.

## Digital Is Primal

As evidenced by the existence of social sector industry associations like [nten](http://nten.org) and [tagtech](http://tagtech.org) that seek to enhance technology capacity building, Social Impact Organizations (SIOs) have recognized the need to modernize their operations. A message we frequently hear from many sources is that younger generations are contributing to a better world as part of their core lifestyle, and SIOs need to “meet their audience where they are at.” What we have learned from these groups and analysts is that 80% of SIOs are smaller organizations that need sustainable, scalable growth - but that growth is dependent on utilizing and creating affordable digital solutions. Knowing this, we feel expanding our product offer to SIOs for all of our products, not just Enterprise plans but now including Self Service plans for small to medium-sized organizations we can support SIOs regardless of organizational size, internal tech expertise or IT budget levels.

Stakeholders expect a secure, quality digital experience from SIOs just as they would from commercial enterprises. We’re committed to creating an offer which helps SIOs satisfy that expectation with minimal cost, installation effort, and ongoing maintenance. We help SIOs secure their stakeholder identities and access so they can focus on what matters: delivering innovative, high-impact services to people most in need in our communities. There is no higher calling for them or for us.

## Understanding Your Need as an SIO

Nonprofits and for-profit social enterprises looking to upgrade the experience of their donors, staff, volunteers, and mission-beneficiaries without compromising on security and compliance, should look at the modern, platform-agnostic Customer Identity & Access Management solutions that Auth0 has to offer.

In fact, our products and services were built with the unique needs of nonprofit and social enterprise organizations in mind. Much like our Healthcare and Public Sector clients, we know yours is an industry with stringent trust requirements, and like these other verticals, we know that the ability to rapidly iterate, respond, and evolve has been a constant challenge plaguing everyone in a digital-first economy.

By reducing the hours and specialty skills required to create “a great login experience” (which we better know as identity, access, authentication, and security), application development becomes attainable and affordable for any size organization.

## We Want Everyone to Be SAFEr

SAFEr, where do we derive that from? Secure Access For Everyone, _but not just anyone_.

Auth0 has always offered a free plan to help everyone easily deploy modern identity and security in their websites and applications.

You do not need to have a sophisticated developer on staff to rapidly and simply begin utilizing Auth0.

We provide resources, documentation, SDKs, and plugins that support developers and non-developers alike deploy better security no matter if it’s a small website or an enterprise application. **Everyone**. **SAFEr**. This applies to SIOs, too.

## Enterprise Cost Savings

In addition to our free plan, unique cost savings are available on all Enterprise and Self Service plans for Social Impact customers. We established a resilient organization and funding structure, [Auth0.org](http://auth0.org), to make sure this discount is sustainable and attainable for the long-term.

For [Auth0 Enterprise Plans](https://auth0.com/pricing) eligible[^1] nonprofits receive a:

- 25% [discount](https://auth0.com/social-impact/pricing) on 1 year contract plans
- 30% [discount](https://auth0.com/social-impact/pricing) on 2 year contract plans
- 35% [discount](https://auth0.com/social-impact/pricing) on 3 year contract plans

Complimentary Design & Discovery sessions for Enterprise Plans are available.

## The Big Announcement - Our Newest Offer - Self Service!

Social Impact Organizations can rapidly become SAFEr Social Impact Organizations with a whopping 50% [cost-savings](https://auth0.com/social-impact/pricing) on our new [Essentials and Professional Self-Service Plans](http://auth0.com/pricing).

And with our free trial, no payment is required to start building today.

Not sure which plan may be right for you? Check out our compare plans feature on our [pricing page](https://auth0.com/pricing) or, [contact us](https://auth0.com/contact-us?place=subscription%20column&type=button&text=contact%20us&target=contact-us).

[^1]: Final approval for an organization to receive either cost-savings discount will be made at Auth0’s sole discretion. To see if your organization is eligible, please review our [eligibility guide](https://auth0.com/resources/whitepapers/social-impact-discount-eligibility-guide) and validate through our third party validation partner.

Introducing Cost Savings for Nonprofits on All Auth0 Plans

tyler-clark

Tyler works as a developer advocate engineer at Auth0. He's worked as an engineer at small to enterprise level companies and loves everything about tech. You'll frequently find him ether out with his family, playing sports, or coding something. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>, and his profile is online at <a target='_blank' rel='noopener noreferrer' href='https://tylerclark.dev'><strong><b>tylerclark.dev</b></strong></a>.

Senior Developer Advocate Engineer

Tyler Clark

Easily manage the business customers that access your applications



We're very excited to announce a new way to enable businesses and teams to access your applications: **Auth0 Organizations!**

Auth0 is a software-as-a-service product. Like many SaaS platforms, Auth0 can be used by individuals, but more often than not, it is used by teams. When building SaaS, or any B2B application, developers need a way to represent and manage those teams.

Often, SaaS products will have dashboards that allow each of their customers’ administrators to manage their organizations:

- Manage membership and access levels of their team members
- Invite new members with predefined roles
- Connect their identity provider for single sign-on
- Define authentication factors and security policies

We’re forced to build this all from scratch each time we create an application, which cuts into the time we have to build the app itself. We’ve struggled with this at Auth0 when building our applications, like [our Dashboard](https://manage.auth0.com/), and when we speak with engineers and architects that work at our customers’ companies, we’ve heard similar stories.

These problems are common enough to deserve a purpose-built solution, and that is why we built Organizations.

## How Does it Work?

We’re introducing a new “organization” entity that will live in your Auth0 tenant. You can create organizations representing teams, business customers, partner companies, or any logical grouping of users who should have different access to your applications.

![Screenshot of a list of organizations within the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/62tk5hrj3iPvHwgckwvkDJ/3b549543665a5ec999533d4da0ad52a5/approved-asset-three.jpeg.png)

Using Organizations and New Universal Login, you can configure and customize the log-in experience that end users in these organizations have when accessing your product. You can mix and match your branding with your customers in the login experience and email communications and easily configure federation for your larger customers and partners that need it.

![Side by side view of universal logins](https://images.ctfassets.net/23aumh6u8s0i/2UBgf6RIt2WX6kbToKKzg6/28717eead2542bdd0f7c463f030a72ab/asset-blog-2-APPROVED.png)

You can choose from various methods for membership and access management of the different organizations that access your product:

- Define roles for your applications, then invite users to organizations with those roles predefined. Also, the same user can have different roles in different organizations, so you can model user isolation or cross-organizational access as needed for your app.
- Turn on just-in-time membership so that anyone logging in from a specific federated connection becomes a member of the organization.
- Add members via the Manage Dashboard or API, or expose all of this functionality in your application so that your customers can manage their membership!

![Invite members to organizations and edit authentication of organizations](https://images.ctfassets.net/23aumh6u8s0i/12YZpXmHDIoEGhgHuESANn/3c834b9cee90b16711809f80f45b971b/asset-blog-3-APPROVED.png)

## Let’s Build a SaaS App with Organizations!

<AmpContent>
<amp-youtube
    data-videoid="BcUxeThMq74"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<iframe width="560" height="315" src="https://www.youtube.com/embed/BcUxeThMq74" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</NonAmpContent>

Before we walk through a demo application utilizing organizations, let’s chat briefly about who the target audience is again. As the title suggests, SaaS (Software as a service) companies provide cloud-based applications that typically charge on a subscription model. Their platforms help other businesses focus on their core product by relieving stress on other business needs. Think about products like Slack or DataDog. When you log in to these platforms, they need to know what company or workspace you belong to before getting you to the correct login flow and, ultimately, the appropriate tenant in their platform.

With businesses as the target customer for SaaS and B2B companies, handling authentication of users within these businesses can be complicated. How are users organized within a specific target business? What about separate branding, access control, and SSO for each business?

Let’s answer these questions with a demo application and Auth0 Organizations!

### Chat0

Introducing our demo app: Chat0, the demo SaaS company that provides state-of-the-art communication services 😀!

![Screenshot of Chat0 dummy app](https://images.ctfassets.net/23aumh6u8s0i/NlvSED8ZuEQz9KtKjMQ1D/134de05a845d028a5696c84b9e0e9332/orgs-overview-2.jpeg.png)

You can try Chat0 yourself by cloning and installing the repo found [here](https://github.com/twclark0/orgs-sample-app).

Once you have this repo cloned to your local machine, navigate into its directory and then run the following commands:

`npm install`

And then

`npm start`

After running this last command, open Chat0 on your browser of choice at `http://localhost:3000/`.

Chat0 is a React single-page web application for this demo, which means that it doesn’t have a back end. With our artificial SaaS company, we invite businesses to sign up for our communication services.

Once businesses have created an account with Chat0, they can send messages (not included in the demo app code) and view stats of their company’s communications.

![Screenshot of the Chat0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/2Ck8zg899VCR0VrTcJBDiR/e15c935d7db75b7d0ff9260b32efb811/chat0-dashboard.jpeg.png)

As you can see above, we want users of a business to see the data after authenticating. However, we want this page to be branded and have data specific to the user’s business/organization. Again, this is similar to the flow you see when you try logging into Slack and DataDog. The result is your company’s or workspace’s brand and data.

So let’s work with a SaaS company (Chat0), add authentication with organization capabilities, brand those two Universal Login experiences, set up individual connections, and invite new users to an organization.

### Set up Auth0 and Configure the React SDK

![Screenshot of Auth0 applications dashboard](https://images.ctfassets.net/23aumh6u8s0i/ECqJSSY7cAaG82huQqHGc/5b064214fb171f3bbf1a3112cd335d92/applictions.png)

You will first need to [sign up for an Auth0](https://a0.to/blog_signup) account if you do not already have one.

Once you’ve signed up for or logged into your account, you’ll land on the dashboard.

Within the left navbar, click on _Applications_ and then _Applications_ again. Press the _Create Application_ button in the top right corner. Choose the Single Page Web Applications option and give it a good name.

After the application is created, the only configuration you need to do is to update three text boxes:

- _Allowed Callback URLs_
- _Allowed Logout URLs_
- _Allowed Web Origins_

We will update these text boxes with `localhost` for local development.

![Screenshot of Auth0 magic mirror application](https://images.ctfassets.net/23aumh6u8s0i/4HphywO1Dwx0bLISHm8kYc/72cc3194241080779688cf8932013621/applicationsettings.jpeg.png)

I filled out those text boxes as follows:

_Allowed Callback URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they successfully log in.

_Allowed Logout URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they log out.

_Allowed Web Origins_

`http://localhost:3000/`

Now inside Chat0’s code, we need to update the React SDK provider values with the ones created when we created the new application within Auth0.

On the `AuthWrapper.js` page, we need to update the props provided to the `Auth0Provider` component. We need to update the `domain` and the `clientId` with the _domain_ and _clientId_ shown within the Auth0 Application page we just created.

```javascript
export const AuthWrapper = ({ children }) => {
const currentOrganization = localStorage.getItem("organization_id");
const options = {
domain: "dev-rm3u1yq4.auth0.com",
clientId: "OgdvG5snvJGpeIrW9FKXbB5D9UmSQufP",
redirectUri: window.location.origin,
...(currentOrganization ? { organization: currentOrganization } : null)
};
return <Auth0Provider {...options}>{children}</Auth0Provider>;
};
```

The `redirectUri` value is where you want your application to redirect to when logging out.

The `organization` prop is being conditionally passed depending on if we've stored an organization id within the browser yet. We'll talk more about this after we configure Organizations within this application. So hang tight!

If you want to learn more about the Auth0 React SDK, check out this [video](https://www.youtube.com/watch?v=1rgeO_EbSGg)!

### Brand Your Auth0 Application

Auth0 provides easy customization of your Universal Login. Back within your Auth0 account dashboard, click on _Branding_ and then _Universal Login_. This is the login page that Chat0’s business customers will see when they want to authenticate.

If you scroll down to the bottom of the page, you can provide a link to your SaaS company’s logo and colors. As you can see, these are the values I provided for Chat0.

![Screenshot of Auth0 Universal Login customization](https://images.ctfassets.net/23aumh6u8s0i/5TM8XsJKpyfPoSHrmAJjW4/452f8f2acd81876fb20e9502979448b9/universal-login-custom.jpeg.png)

### Configure and Set Up Organizations

At this point, we have a functioning application, complete with simple Auth0 powered authentication. Now, let’s enable organization support and add an organization to our Auth0 application.

Back within our Auth0 dashboard and Chat0 application, notice there is a tab called _Organizations_. Go ahead and click on that tab.

![Screenshot of Auth0 organization settings page](https://images.ctfassets.net/23aumh6u8s0i/2sEk40iRY0ADpuIxlm3WbO/f9c7befb5c3435147a65bfb2261c1210/enable.jpeg)

Go ahead and toggle the green _Display Organization Prompt_ button. As it states below, this will prompt users to enter their organization name before logging in.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/2fDmJPNHNWzbE2RAZBtN3d/69e8dcbc8fce760e5727e8f60822251c/universal-login-2.jpeg)

With the Universal Login ready to accept a user’s input for their organization, let’s now create an organization within our tenant.

On the left-hand sidebar, click on _Organizations_. Then on this page, click on the button that says _CREATE ORGANIZATION_.

![Screenshot of organizations tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/6Z3aYFlcAnFRQMXeG5VXQk/dc050e0f0d41dd03f2e5b044bc42ccaf/dashboardorganization.jpeg)

After clicking on the _CREATE ORGANIZATION_ button, we are directed to this page to add basic information about our new organization.

![Screenshot of how to add an organization](https://images.ctfassets.net/23aumh6u8s0i/2848XRMQCXWk7HWSw2S229/3e49ae7ede2ed1ab7d2481aac6159c73/addorganization.jpeg)

As the text on this page states, the name is a human-readable identifier for the organization. Also, the display name is a friendly name for the organization. For example, I choose `acme` for the name and then `Acme` for the display name.

Once you are satisfied with the new organization, click on _ADD ORGANIZATION_.

You will then see your newly created organization.

Within this screen, you have the power to do a lot of customization. As you can see in the picture below, I have branded my new organization with some colors and a logo.

![Screenshot of an individual organization view](https://images.ctfassets.net/23aumh6u8s0i/39FS8nQYPsJoCSuumYfLfH/fda0ecc4622cbe9952fb33bd8a94026f/individualorg.jpeg)

At the bottom of this page, you can add custom metadata about your organization for extensibility purposes.

The _Members_ tab shows all of the current members within the organization. The _ADD MEMBERS_ button allows you to add a member to this specific organization.

Let’s create a new user and add them to this organization. So on the left-hand side of the page, click on _User Management_ and then _Users_. Here we can click on the _CREATE USER_ button and enter information about a new user. Once this is saved, back in our organization, we can click on the _ADD MEMBERS_ and add this new user to the organization.

The _Invitations_ tab provides the functionality to invite users to this specific organization.

![Screenshot of the members’ tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/3YCjKOoeqzlgNV0Uwy6xnL/0b5d9be884e2813d6f1f182e954df635/invite.jpeg)

After clicking on the _INVITE MEMBERS_ button, you can choose your application from the initial dropdown (only ones with organizations enabled will show in the list).

Then you can add email addresses, determine which connections can be used and what role to assign them as a member of that organization (if there are any roles defined within your tenant).

Finally, on the _Connections_ tab, you can choose which connections you want to enable for this specific organization. Instead of enforcing the same connections to all applications within your tenant, you can control how each organization’s members can log in.

![Screenshot of the connections tab within organizations](https://images.ctfassets.net/23aumh6u8s0i/1kUkcgHRQYH7MrdIAviGLq/7cc069d1394cedade92f597ad6e9053d/connections.jpeg)

And that’s it!

When you go back to Chat0, which is running locally, click on the _login_ button in the header. It will show you the Chat0 Universal Login prompt asking for an organization.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/34QV5KntgVMfvl5m54Gh7l/1df56e270aa9144b368ef0e7f6c8166f/universal-login-2.jpeg)

After entering _acme_ (the name of the newly created organization), it’ll open up the Acme-specific login.

![Authentication prompt for the acme organization](https://images.ctfassets.net/23aumh6u8s0i/3R0aMeqwdCOzTq5I8MKMtH/8eba028a984741815073a7aeaabe06f2/acme.jpeg)

Login with the user you created earlier, and then you will be redirected to the Chat0 dashboard for Acme users.

![Screenshot of a dashboard branded with the acme logo](https://images.ctfassets.net/23aumh6u8s0i/3SLUeDBuqPkcMceXiPZZEi/198df05368106dbf4482cf1a41e7d2c9/acmedashboard.jpeg)

Remember when we discussed conditionally setting the `organization` prop on the `Auth0Provider` component above? Within the `Sidebar.js` component, we set this `id` within `localStorage` when we get it.

```javascript
const { user } = useAuth0();
useEffect(() => {
if (user.org_id) {
localStorage.setItem("organization_id", String(user.org_id));
}
}, [user.org_id]);
```

The Auth0 React SDK provides the `user` object. This includes basic information about the user after successful authentication.

Setting and retrieving the authenticated organization id is what keeps the user authenticated when refreshing the page.

## Taking It Further

This article barely scratches the surface of the full functionality of Organizations. Using these new features, you can:

- Represent the teams, business customers, and partners that use your applications as organizations in Auth0.
- Set up branded, federated login flows for each organization.
- Manage organization members in a variety of ways, including just-in-time membership and email invitations.
- Define roles to represent what end users can do in your applications and assign those roles to organization members to have different roles in different organizations.
- Build administration capabilities into your products so that administrators in those organizations can manage their membership and access levels.

## What’s Next

As of today, Organizations is available for Auth0 subscribers on our Enterprise and Startup plans. You can find [technical documentation here](https://www.auth0.com/docs/organizations). We’ll be introducing new capabilities to improve organizations. We’d love to hear your thoughts about what we should focus on next; just comment below or send us questions [in the community forum](https://community.auth0.com/).

Introducing Auth0 Organizations

jameeka_aron

Jameeka has over 20 years of Information Technology and Cyber Security experience. She is a versatile leader, successfully leading teams as both a CISO and CIO across various industries including; Aerospace & Defense, Apparel, Retail, and Manufacturing at both Fortune 100 and privately held companies and many spaces in between. <br>
She is highly skilled in Business Engagement (International and U.S. based) Audit, Compliance, Vulnerability, Risk and Identity Management, Digital Transformation, Mergers, Acquisitions, Divestitures, and leading Cross-Functional and Matrixed teams.

CISO

Jameeka Aaron

The causes of major data breaches are shifting. Here’s how to protect your organization.

Every six months, we compile a list of the worst data breaches that occurred during that period in order to learn from them. So far this year, the causes of the worst data breaches have shifted from human error and credential based attacks that we saw at [the end of last year](https://auth0.com/blog/the-nine-worst-recent-data-breaches-of-2020/) to ransomware, third-party vulnerabilities, and undetected security gaps.

This suggests that threat vectors may be changing, and organizations would be wise to bolster their cybersecurity efforts against new ways cybercriminals are now gaining access to data.

Below, we break down 10 of the worst data breaches in 2021 so far, as well as what organizations can learn from those breaches.

![Data Breaches](https://images.ctfassets.net/23aumh6u8s0i/3iuokX9OUndtAbdOcAZnoW/cb6066767d6ff4ff6e4ea80a417c8238/breach_zoom1)

## 1. Over 30K Organizations Exposed in Microsoft Breach

On March 2nd, 2021, [Microsoft reported](https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/) it was the victim of a state-sponsored cyberattack from the Chinese hacking group called Hafnium. Microsoft explained in their notification that the group “primarily targets entities in the United States for the purpose of exfiltrating information from a number of industry sectors.”

The attack affected over 30,000 organizations across the United States, including local governments, government agencies, and businesses. It is the eighth instance of a nation-state cyberattack against civil organizations and businesses Microsoft has reported in the last 12 months.

### How the Breach Occurred

The Microsoft breach was carried out through a sophisticated zero-day hacking campaign that targeted hundreds of thousands of on-premise servers running Microsoft’s Exchange software. Hafnium gained access to on-premise servers through a combination of stolen passwords and previously undetected vulnerabilities. Then, Hafnium created a web shell around those servers that provided them with the access they needed to steal email data remotely.

### What Data Was Exposed

Microsoft’s Exchange Server software handles email communications, and the attack exposed the emails of each organization.

### The Lesson for Businesses

> Keep on-premise third-party software up to date at all times.

Hafnium was able to carry out this attack because of undiscovered vulnerabilities in Microsoft’s software. Although Microsoft released patches designed to correct these vulnerabilities, their customers are still at risk unless they update their software with those patches:

![Chris Krebs tweet](https://images.ctfassets.net/23aumh6u8s0i/57bygcebmXoJCZOwWqwmki/6d93b60a31f6729c4fff519153bdeb5a/chris_krebs_tweet.jpg)
<p align="center"><i>Source: <a href="https://twitter.com/C_C_Krebs/status/1367673471669526528">Twitter</a></i></p>

## 2. More Than 220M Brazilians Exposed in Major Data Leak
<p align="left"></p>

On January 19th, 2021, security researchers found highly sensitive personal data of over 220M Brazilians for sale online, a number that is greater than the current population of Brazil. The data also included detailed information on over 104 automobiles and 40M companies.

### How the Breach Occurred

It’s unclear exactly how this data breach occurred. The nature of the data suggests it could have originated from Serasa, the Brazilian subsidiary of the credit bureau Experian. However, after an investigation, Serasa and Experian [found no evidence](https://www.reuters.com/world/americas/experian-says-investigating-if-involved-brazil-data-breach-2021-02-08/) that their systems had been compromised.

Brazilian consumer rights foundation Procon continues to investigate. “No hypothesis has been ruled out, and at the moment we consider it is more likely that the leak came from inside companies rather than hackers,” Fernando Capez, Procon’s executive director, [explains](https://www.zdnet.com/article/experian-challenged-over-massive-data-leak-in-brazil/).

### What Data Was Exposed

The data leaked in this breach affected nearly all the Brazillian population and included personal tax identification numbers, birthdays, full names, addresses, headshots, credit scores, personal financial information, social benefits information, and more.

### The Lesson for Businesses

> Familiarize yourself with Brazil’s new privacy law and ensure your organization complies if it processes the data of any person within Brazil.

The unclear cause of this data breach makes it difficult to draw a concrete lesson. However, it’s worth noting that, regardless of what caused the breach, the consequences for the responsible organization are crystal clear now that Brazil’s new privacy law is in effect.

Like the [EU’s GDPR](https://auth0.com/docs/compliance/gdpr), Brazil’s privacy law carries implications for businesses outside Brazil, as well as penalties up to USD $9M for non-compliance. If your business collects or processes the data of anyone who lives in or has visited Brazil, it’s worth familiarizing yourself with the law to ensure you’re in compliance.

## 3. Over 533M Facebook Users’ Personal Information Leaked

On April 3rd, 2021, hackers posted a database of over 533M Facebook users’ personal information online for free in a hacking forum. The data included information that could be used to identify individuals from 106 different countries, with the US, the UK, and India experiencing the greatest numbers of exposed records.

### How the Breach Occurred

Facebook [reported](https://about.fb.com/news/2021/04/facts-on-news-reports-about-facebook-data/) cybercriminals scraped data from their servers using a misconfiguration in their contact importer. 

### What Data Was Exposed

The leaked database contained personal information such as phone numbers, Facebook IDs, names, birthdays, and even some email addresses that could be used to carry out social engineering attacks on individuals on a large scale in the future.

### The Lesson for Businesses

> Find and fix misconfigurations before cybercriminals do.

[Verizon's 2020 Data Breach Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf) found that misconfiguration errors similar to that which caused this year’s Facebook breach have increased since 2015:

![Top Error varieties over time in breaches](https://images.ctfassets.net/23aumh6u8s0i/TprIbkWGRjVw2xe8NJmqb/6e2314fb2a1a21a722fe3bcfee51539d/01_Top_Error_varieties_over_time_in_breaches.jpg)

Verizon’s report also acknowledged the majority of these misconfigurations are discovered by security researchers rather than cybercriminals. However, the Facebook breach is a reminder to every organization that auditing and testing their systems for vulnerabilities is a worthwhile investment.

## 4. 17 Organizations Affected in Accellion Data Breach (So Far)

In December 2020, file transfer and collaboration software provider Accellion discovered a zero-day vulnerability in their File Transfer Appliance (FTA), a file sharing service [they acknowledged](https://www.accellion.com/sites/default/files/resources/fta-eol.pdf) was at the end of its life and released a patch to fix it. In January, they released four additional patches to address other vulnerabilities that bad actors used to attack their customers through their FTA service.

However, before 17 of their customers could install the patch, ransomware group Clop and financial crime group FIN11 exploited these vulnerabilities to access their data. Those organizations included The [US Department of Health and Human Services](https://www.beckershospitalreview.com/cybersecurity/accellion-data-breach-strikes-more-than-2-7-million-victims-nationwide.html), the [University of California](https://www.businesswire.com/news/home/20210510005214/en/UC-Notice-of-Data-Breach), and [HealthNet](https://www.hipaajournal.com/more-than-1-2-million-health-net-members-affected-by-accellion-cyberattack/).

Accellion now faces [lawsuits in multiple US states](https://www.law.com/americanlawyer/2021/03/05/accellion-turns-to-latham-in-litigation-over-hack-that-snared-big-law-firms/?slreturn=20210417155655) over the breaches.

### How the Breach Occurred

Bad actors used [Structured Query Language (SQL) injection](https://nvd.nist.gov/vuln/detail/CVE-2021-27101) to deploy a web shell on servers using Accellion’s FTA system. This provided remote access they could use to steal information and remove traces of their access from system logs.

### What Data Was Exposed

Accellion’s FTA system was designed for sending highly sensitive files. Although the nature of the information that passed through their software depended on the nature of their customers’ businesses, there was a strong likelihood that whatever bad actors gained access to was valuable.

### The Lesson for Businesses

> Update third-party software as soon as possible when a patch is made available.

The Accellion breach is a reminder that on-premise third-party software creates a vulnerability for organizations if it’s not kept up to date. When patches are released, ensure your software is updated immediately.

## 5. Millions Affected in Automatic Funds Transfer Systems (AFTS) Attack

Between February 3rd and 4th, 2021, third-party payment processor AFTS experienced a ransomware attack that led to a breach of millions of individuals’ data.

AFTS processes payments for local governments across North America, and the breach is estimated to have affected [up to 38 million automobile owners](https://www.dmv.ca.gov/portal/security-breach-at-address-verification-company-may-compromise-dmv-information/) in California alone. Multiple [local governments](https://www.kirklandwa.gov/Government/Departments/Finance-and-Administration/Customer-Accounts/Utility-Billing/AFTS-FAQ) and [their agencies](https://awwd.com/impact/emergency-information/afts-inc-security-issue/) have also released notices explaining how the breach may affect their residents. A full list of cities and agencies affected can be found [here](https://www.privacy.com.sg/databreach/us-cities-disclose-data-breaches-after-vendors-ransomware-attack/).

The attack was carried out by [Cuba Ransomware](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf), a cyber gang responsible for numerous attacks on financial, logistics, and technology organizations across North America and Europe over the past few years.

### How the Breach Occurred

At this time, it’s unclear how ransomware entered AFTS’s systems. However, ransomware is [most commonly installed](https://security.berkeley.edu/faq/ransomware/how-does-computer-become-infected-ransomware) by visiting an infected website or via a phishing email.

### What Data Was Exposed

According to Cuba Ransomware’s website page on the data breach, the files leaked included “financial documents, correspondence with bank employees, account movements, balance sheets, and tax documents.”

![Cuba Ransomware](https://images.ctfassets.net/23aumh6u8s0i/4Jn3taoCf8qRtXSgTh3Ype/851d40d90277040d1c93c3b517a3d69e/02_Cuba_Ransomware.jpg)

### The Lesson for Businesses

> Ransomware protection and third-party risk management should be a top priority.

According to a study by the [Ponenon Institute and CyberGRX](https://info.cybergrx.com/2019-ponemon-webinar), at least 53% of organizations have had one or more data breaches caused by a third-party they work with. So like many of the other breaches on this list, the AFTS breach reinforces the need for both managing third-party risks and also protecting your organization against ransomware.

## 6. MeetMindful Breach Exposes 2.28M Users’ Data

On January 20th, 2021, a 1.2GB file containing personal data from 2.28M people who use MeetMindful’s online dating services was posted on a well-known hacking site. MeetMindful’s investigation concluded that the breach only affected users who had created or updated their accounts prior to March 2020.

### How the Breach Occurred

MeetMindful found that cybercriminals were able to gain access to the data through a vulnerability in their system they have since resolved.

### What Data Was Exposed

MeetMindful’s notice states that first names, email addresses, city and state location information, and notification preferences were all included in the file that was released. No payment or user-generated content (messages, photos, etc.) were leaked in the breach.

### The Lesson for Businesses

> Consider hiring ethical hackers to find vulnerabilities before cybercriminals do.

Cybercriminals are always looking for undetected security gaps they can use to access your systems and data. Many companies have found [hiring ethical hackers](https://techgenix.com/ethical-hacking-cybersecurity/) helps them find those gaps before real cybercriminals do.


## Even Basic Information Can Pose a Threat if Leaked

Several of the breaches on this list were limited to information many would not consider sensitive by nature. While it’s good that companies are taking steps to protect their most sensitive data, it’s also important to remember that a leak of basic information could still be damaging to those who depend on your organization.

![Even Basic Information Can Pose a Threat if Leaked](https://images.ctfassets.net/23aumh6u8s0i/3rV2ZenLrXsIEawsbP3pJm/5766390f17cf6141ef7667fce8cc1c7b/breach_zoom2)

For example, an email address and a name may not seem like sensitive data. But sometimes, those simple pieces of information are all it takes to create a phishing email that’s convincing enough to get someone to hand over something more sensitive.

It’s in every organization’s best interest to ensure all of their customers’ and employees’ data is protected from unauthorized access, no matter how basic it might seem. A breach at one organization could lead to a breach at another.

The Worst Data Breaches of 2021 (Q1 and Q2)

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Learn how to address the risks that today’s top mobile security threats pose to your organization.

Mobile initiatives are a top priority for many organizations these days because research shows that increases in mobility help enterprises [improve operations](https://cdn2.hubspot.net/hubfs/1789978/Content%20Offers/enterprise-mobility-trends-report-2020.pdf) and [productivity](https://insights.samsung.com/2016/08/03/employees-say-smartphones-boost-productivity-by-34-percent-frost-sullivan-research/).

However, increases in organizational mobility typically result in an increase in the number of mobile devices that are accessing your systems from a remote location. And for your security teams, this means a growing variety of endpoints and threats they need to secure in order to protect your organization from a data breach.

As in the past, the most common threats to mobile security include mobile malware. However, as Verizon’s [2020 Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf) shows, there are new threats organizations need to consider as well in order to ensure they’re protected.

Below are the most common and critical mobile security threats that organizations face in 2021.

## 4 Different Types of Mobile Security Threats

Mobile security threats are commonly thought of as a single, all-encompassing threat. But the truth is, there are four different types of mobile security threats that organizations need to take steps to protect themselves from:

* **Mobile Application Security Threats.** Application-based threats happen when people download apps that look legitimate but actually skim data from their device. Examples are spyware and malware that steal personal and business information without people realizing it’s happening.
* **Web-Based Mobile Security Threats.** Web-based threats are subtle and tend to go unnoticed. They happen when people visit affected sites that seem fine on the front-end but, in reality, automatically download malicious content onto devices.
* **Mobile Network Security Threats.** Network-based threats are especially common and risky because cybercriminals can steal unencrypted data while people use public WiFi networks.
* **Mobile Device Security Threats.** Physical threats to mobile devices most commonly refer to the loss or theft of a device. Because hackers have direct access to the hardware where private data is stored, this threat is especially dangerous to enterprises.

Below are the most common examples of these threats, as well as steps organizations can take to protect themselves from them.

## 1. Social Engineering

Social engineering attacks are when bad actors send fake emails (phishing attacks) or text messages (smishing attacks) to your employees in an effort to trick them into handing over private information like their passwords or downloading malware onto their devices.

Reports by cybersecurity firm [Lookout](https://www.lookout.com/phishing-spotlight-report-lp) and [Verizon](https://enterprise.verizon.com/resources/reports/dbir/2020/results-and-analysis/) show a 37% increase in enterprise mobile phishing attacks and that phishing attacks were the top cause of data breaches globally in 2020.

![Social Engineering](https://images.ctfassets.net/23aumh6u8s0i/1wPMqUJN6nHgmQTVo4poQz/8b4fea1cb9600bcb1bc5b93f8881d49b/image1.jpg)
<p align="center"><i><a href="https://www.cybersecurityintelligence.com/blog/it-governance-cyber-security-phishing-awareness-course-180.html">Source</a></i></p>

<p align="left"></p>
### Phishing Attack Countermeasures
The best defense for phishing and other social engineering attacks is to teach employees how to spot phishing emails and SMS messages that look suspicious and avoid falling prey to them altogether. Reducing the number of people who have access to sensitive data or systems can also help protect your organization against social engineering attacks because it reduces the number of access points attackers have to gain access to critical systems or information.

## 2. Data Leakage via Malicious Apps

As Dave Jevans, CEO and CTO of Marble Security, [explains](https://www.esecurityplanet.com/mobile-security/10-trickiest-mobile-security-threats.html), “Enterprises face a far greater threat from the millions of generally available apps on their employees’ devices than from mobile malware.”

That’s because 85% of mobile apps today are largely unsecured. Tom Tovar, CEO of Appdome, [says](https://technologyadvice.com/blog/information-technology/cybersecurity-trends-2020-byod-mobile/), “Today, hackers can easily find an unprotected mobile app and use that unprotected app to design larger attacks or steal data, digital wallets, backend details, and other juicy bits directly from the app.”

For example, when your employees visit Google Play or the App Store to download apps that look innocent enough, the apps ask for a list of permissions before people are allowed to download them. These permissions generally require some kind of access to files or folders on the mobile device, and most people just glance at the list of permissions and agree without reviewing them in great detail.

However, this lack of scrutiny can leave devices and enterprises vulnerable. Even if the app works the way it’s supposed to, it still has the potential to mine corporate data and send it to a third party, like a competitor, and expose sensitive product or business information.

### How to Protect Against Data Leakage

The best way to protect your organization against data leakage through malicious or unsecured applications is by using mobile application management (MAM) tools. These tools allow IT admins to manage corporate apps (wipe or control access permissions) on their employees’ devices without disrupting employees’ personal apps or data.

## 3. Unsecured Public WiFi

Public WiFi networks are generally [less secure](https://www.wired.com/story/public-wifi-safety-tips/) than private networks because there’s no way to know who set the network up, how (or if) it’s secured with encryption, or who is currently accessing it or monitoring it. And as more companies offer remote work options, the public WiFi networks your employees use to access your servers (e.g., from coffee shops or cafes) could present a risk to your organization.

For example, cybercriminals often set up WiFi networks that look authentic but are actually a front to capture data that passes through their system (a “man in the middle” attack). Here's what that looks like:

![Unsecured Public WiFi](https://images.ctfassets.net/23aumh6u8s0i/3Zdz3P9nnZTNTMNPi2UMPZ/af3eb9262d8440b0fc875da00b0e1eaf/image2.png)
<p align="center"><i><a href="https://www.consumer.ftc.gov/blog/2014/03/how-secure-mobile-app"> Source </a></i></p>

If this seems far-fetched, it isn’t. Creating fake WiFi hotspots in public spaces with network names that look completely legit is incredibly simple, and people are very willing to connect, as shown by [experiments](https://hbr.org/2017/05/why-you-really-need-to-stop-using-public-wi-fi) run at the Democratic and Republican conventions in 2016 and by [an experiment](https://hackernoon.com/a-hacker-intercepted-your-wifi-traffic-stole-your-contacts-passwords-financial-data-heres-how-4fc0df9ff152) run by a researcher in 2019 from [Magic](https://magic.co/).

### How to Reduce Risks Posed By Unsecured Public WiFi

The best way for you to protect your organization against threats over public WiFi networks is by requiring employees to use a VPN to access company systems or files. This will ensure that their session stays private and secure, even if they use a public network to access your systems.

## 4. End-to-End Encryption Gaps
<p align="left"></p>
An encryption gap is like a water pipe with a hole in it. While the point where the water enters (your users’ mobile devices) and the point where the water exits the pipe (your systems) might be secure, the hole in the middle lets bad actors access the water flow in between.

![End-to-End Encryption Gaps](https://images.ctfassets.net/23aumh6u8s0i/75ICJ2SUKqSGKvX7OQoXxF/423b5c480a4c09939e62d411ba716b1b/image3.png)
<p align="center"><i><a href="https://heimdalsecurity.com/blog/the-best-encrypted-messaging-apps/"> Source </a></i></p>

Unencrypted public WiFi networks are one of the most common examples of an encryption gap (and it’s why they’re a huge risk to organizations). Since the network isn’t secured, it leaves an opening in the connection for cybercriminals to access the information your employees are sharing between their devices and your systems.

However, WiFi networks aren’t the only thing that poses a threat—any application or service that’s unencrypted could potentially provide cybercriminals with access to sensitive company information. For example, any unencrypted mobile messaging apps your employees use to discuss work information could present an access point for a bad actor.

### Solution: Ensure Everything is Encrypted

For any sensitive work information, end-to-end encryption is a must. This includes ensuring any service providers you work with encrypt their services to prevent unauthorized access, as well as ensuring your users’ devices and your systems are encrypted as well.

## 5. Internet of Things (IoT) Devices

The types of mobile devices that access your organization’s systems are branching out from mobile phones and tablets to include wearable tech (like the Apple Watch) and physical devices (like Google Home or Alexa). And since many of the latest IoT mobile devices have IP addresses, it means bad actors can use them to gain access to your organizations’ network over the internet if those devices are connected to your systems.

> Statistically, there are probably more IoT devices connected to your networks than you realize. For example, 78% of IT leaders from four different countries reported in [a study by Infoblox](https://www.infoblox.com/company/news-events/press-releases/shadow-iot-devices-a-major-concern-for-corporate-networks-infoblox-research-finds/) that over 1,000 shadow IoT devices accessed their networks each day.

### How to Combat Shadow IoT Threats
<p align="left"></p>
Mobile device management (MDM) tools can help you combat shadow IoT threats, as well as identity and access management (IAM) tools like Auth0. However, IoT/Machine-to-Machine (M2M) security [is still in a bit of a “wild west” phase](https://www.crn.com/news/internet-of-things/as-5g-nears-iot-connectivity-remains-a-wild-west-) at the moment. So it’s up to each organization to put the appropriate technical and policy regulations in place to ensure their systems are secure.

## 6. Spyware

Spyware is used to survey or collect data and is most commonly installed on a mobile device when users click on a malicious advertisement (“malvertisement”) or through scams that trick users into downloading it unintentionally.

Whether your employees have an iOS or Android device, their devices are targets ripe for data mining with spyware—which could include your private corporate data if that device is connected to your systems.

### How to Protect Against Spyware

Dedicated mobile security apps (like Google’s [Play Protect](https://developers.google.com/android/play-protect)) can help your employees detect and eliminate spyware that might be installed on their devices and be used to access company data. Ensuring your employees keep their device operating systems (and applications) up to date also helps ensure that their devices and your data are protected against the latest spyware threats.

## 7. Poor Password Habits

A [2020 study](https://www.balbix.com/resources/state-of-password-use-report-2020/) by Balbix found that 99% of the people surveyed reused their passwords between work accounts or between work and personal accounts. Unfortunately, the passwords that employees are reusing are often weak as well.

For example, a 2019 study by Google found that 59% of the people they surveyed used a name or a birthday in their password, and 24% admitted to using a password like one of these below:

![Poor Password Habits](https://images.ctfassets.net/23aumh6u8s0i/3f3dzG9WlC6gNqYnCyB9V3/00d5e8990be0124d4b140764ff769ec1/image4.jpg)
<p align="center"><i><a href="http://www.netimperative.com/2016/01/worst-25-passwords-prove-were-all-idiots/"> Source </a></i></p>

These bad password habits present a threat to organizations whose employees use their personal devices to access company systems. Since both personal and work accounts are accessible from the same device with the same password, it simplifies the work a bad actor has to do in order to breach your systems.

However, these behaviors also provide opportunities for credential-based brute force cyberattacks like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) or password spraying because cybercriminals can use weak or stolen credentials to access sensitive data through company mobile apps.

### How to Reduce or Eliminate Mobile Password Threats

The [NIST Password Guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) are widely regarded as the international standard for password best practices. Following these guidelines—and insisting your employees do the same—will help protect you against threats from weak or stolen passwords. Password managers can simplify the work required for your employees to follow these guidelines.

Requiring your employees to use more than one authentication factor (multi-factor authentication or MFA) to access mobile company applications will also help reduce the risk that a bad actor could gain access to your systems since they’d need to verify their identity with additional authentication factors in order to log in.

Finally, implementing [passwordless authentication](https://auth0.com/passwordless/) will help you eliminate password risks altogether. For example, in the event that a mobile device is stolen or accessed illegally, requiring a facial scan as a primary (or secondary) authentication factor could still prevent unauthorized access.

## 8. Lost or Stolen Mobile Devices

Lost and stolen devices aren’t a new threat for organizations. But with more people [working remotely](https://www.businesswire.com/news/home/20201215005287/en/Upwork-Study-Finds-22-of-American-Workforce-Will-Be-Remote-by-2025) in public places like cafes or coffee shops and accessing your systems with a wider range of devices, lost and stolen devices pose a growing risk to your organization.

### How to Protect Against Lost or Stolen Device Threats

First and foremost, you’ll want to ensure employees know what steps to take if they lose their device. Since most devices come with remote access to delete or transfer information, that should include asking employees to make sure those services are activated.

![How to Protect Against Lost or Stolen Device Threats](https://images.ctfassets.net/23aumh6u8s0i/44UaWTSZk2OlrI587JXGw1/1276e73d18bae71b074472dfb1ebd2db/image5.jpg)
<p align="center"><i><a href="http://www.idownloadblog.com/2014/08/08/how-to-activate-lost-mode-iphone-ipad/"> Source </a></i></p>

[Mobile device management](https://auth0.com/blog/what-is-enterprise-mobile-management/) (MDM) tools can also help you secure, encrypt, or wipe sensitive company information from a device that’s lost or stolen, so long as those tools were installed before the device went missing.

## 9. Out of Date Operating Systems

Like other [data security](https://auth0.com/blog/what-is-data-security/) initiatives, mobile security requires continuous work to find and patch vulnerabilities that bad actors use to gain unauthorized access to your systems and data.

> Companies like Apple and Google address a lot of these vulnerabilities with operating system updates. For example, in 2016, Apple realized it had three [zero-day vulnerabilities](https://us.norton.com/internetsecurity-emerging-threats-how-do-zero-day-vulnerabilities-work-30sectech.html) that left its devices open for spyware attacks and released a patch to protect users against these vulnerabilities.

<p align="left"></p>
However, these patches only protect your organization if your employees keep their devices up to date at all times. And according to Verizon’s [Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf), operating system updates on 79% of the mobile devices used by enterprises are left in the hands of employees.

### How To Keep Mobile Operating Systems Up To Date

Google and Apple both allow organizations to push updates to managed Android and iOS devices. Third-party MDM tools (for example,[ Jamf](https://www.jamf.com/)) often provide this functionality as well.

## IAM Tools Can Help Secure Company Mobile Applications

Identity and Access Management (IAM) tools can help organizations secure the apps and data that users access from their mobile devices, including:

* **Restricting which devices and users can access enterprise applications and data,** as well as which parts of those applications they’re allowed to access.
* **Tracking user behavior** and securing access in the event that something looks suspicious with security features like [multi-factor authentication](https://auth0.com/blog/multifactor-authentication-mfa/) (MFA),[brute force attack protection](https://auth0.com/docs/attack-protection), and more.

Auth0 simplifies the work required to implement secure authentication for mobile enterprise applications—learn more about Auth0’s IDaaS platform [here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The 9 Most Common Security Threats to Mobile Devices in 2021

Matt Duench

Matt is a product marketer that loves helping people solve complex identity-related challenges through technology. As the Senior Director of Product Marketing at Auth0, he is focused on helping companies deliver a customizable balance of convenience, security, and privacy to their end-users through identity.

Senior Director, Product Marketing

Learn how a low-code approach can help organizations save time and money on software development.

As [more customer interactions move online](https://www.mckinsey.com/business-functions/marketing-and-sales/our-insights/a-global-view-of-how-consumer-behavior-is-changing-amid-covid-19) post-2020, [a recent report from McKinsey](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/how-covid-19-has-pushed-companies-over-the-technology-tipping-point-and-transformed-business-forever) suggests that organizations must “recognize technology’s strategic importance as a critical component of the business, not just a source of cost efficiencies” if they haven’t already.

However, rapid digital transformation is easier said than done for most organizations, given most are [already struggling to find enough tech talent](https://www.daxx.com/blog/development-trends/software-developer-shortage-us). And it’s why more organizations are turning to low-code development to help them deliver the digital experiences their customers now demand.

Below is what executives need to know about low-code and how it can help them save time and money on software development.

## What Is Low-Code Development?

Low-code is an approach to software development that reduces the amount of custom coding required to build an application by incorporating drag-and-drop interfaces, process modeling, reusable code templates, and [software development kits](https://auth0.com/blog/what-is-an-sdk/) (SDKs) into the software development process.

Low-code platforms do not replace the job of a software developer but rather make app development faster by providing developers and non-developers with prebuilt sections of code they can assemble (either visually or in a traditional development environment) instead of hand-coding every line.

### Low-Code vs. No-Code

The terms “low-code” and “no-code” are often used interchangeably. But in practice, they’re two separate approaches to software development.

* **No-code development** eliminates the need for coding altogether by making the entire application design process a visual drag-and-drop experience. As a result, anyone can use a no-code platform to build an application or website. However, the accessibility of no-code development usually limits the functionality a user can build into their application based on the prebuilt capability of the editing environment.
* **Low-code development** also makes the development process more accessible to non-developers. But low-code platforms are still primarily designed for professional developers because they do not completely eliminate the need for coding skills. Low-code development platforms offer greater flexibility than no-code platforms, but they also require a higher technical aptitude to fully implement a functional application.

[Adalo](https://www.adalo.com/) is an example of a no-code platform because it allows anyone to build a mobile app by dragging and dropping elements inside its editing environment. But a platform like [Retool](https://retool.com/) is considered a low-code tool since it still requires developers to write custom code to build a functional internal business tool.

## The Benefits of Low-Code Development

Low-code development can save businesses [hundreds of development hours,](https://retool.com/blog/avo-story/) cut their development times [by 50-90%](https://www.redhat.com/cms/managed-files/mi-451-research-intelligent-process-automation-analyst-paper-f11434-201802.pdf) compared to developing an application from scratch with custom coding, and reduce their IT spends by [as much as 20%](https://www.appian.com/resources/nucleus-research-low-code-application-platforms-lcap-technology-value-matrix-2020/). As a result, it helps solve several common challenges that hinder digital transformation efforts for many organizations.

### Improved Agility

Low-code development shortens the Software Development Lifecycle (SDLC), which helps your organization respond to market or business changes faster than you’d be able to if your development team had to code everything from scratch.

Low-code also makes it easier to incorporate non-developers into the development process, which is something most highly agile businesses are good at, according to [PMI](https://www.pmi.org/-/media/pmi/documents/public/pdf/learning/thought-leadership/achieving-greater-agility-series/vital-role-culture-commitment.pdf?sc_lang_temp=en&utm_source=&utm_medium=&utm_campaign=&utm_term=&utm_content=). For example, since low-code software development is visual, a developer can [spin up a sample app](https://flows.auth0.com/) for business teams to evaluate much faster than they could with custom coding, which shortens the feedback loop and helps improve the finished product.

### Smaller Project Backlogs

Many enterprises have [project backlogs that cost them billions of dollars](https://www.techrepublic.com/article/low-code-platforms-help-with-project-backlogs-and-software-development-training/) in sales opportunities because they can’t find the right talent or software to address business opportunities fast enough. Low-code can help reduce costly backlogs because it helps your development team(s) [get more done](https://www.appian.com/resources/nucleus-research-low-code-application-platforms-lcap-technology-value-matrix-2020/) in less time.

### Increased Scalability

Low-code development turns application elements like user interfaces, integrations, and custom logic into visual building blocks that developers can reuse anywhere by dragging and dropping them into the design interface. Depending on the platform, a low-code approach often simplifies the work required to scale and maintain custom applications across an entire enterprise or for millions of customers, since a developer can build something once and implement it everywhere [in minutes](https://auth0.com/case-studies/cimpress/).

### More Developer Time For Innovation

According to [a global study by Stripe](https://stripe.com/files/reports/the-developer-coefficient.pdf), nearly 75% of the average developer’s week is spent on maintenance and dealing with technical debt. Since low-code development helps simplify the work required to scale and maintain software, it reduces the burden of updating legacy systems and the accrual of technical debt in the first place.

As a result, low-code can free up developer time for higher-value projects, like finding ways to innovate for your employees (which helps reduce their need to find their own software solutions ([shadow IT](https://en.wikipedia.org/wiki/Shadow_IT))) or customers.

## Low-Code Development Use Cases

Low-code development is a broad term that covers a lot of different use cases. Although most commonly used via standalone platforms for application development, low-code tools can also be incorporated into platform-as-a-service (PaaS) or other software-as-a-service (SaaS) solutions to reduce the time developers need to build applications or integrate services into their business apps. Below are the most common places low-code can help you save time and money on development costs.

### Websites

Many website builders are both a no-code and a low-code environment. For example, [Webflow](https://webflow.com/no-code) allows a user to design a website without any coding at all. But it also[ offers the option](https://webflow.com/blog/webflow-custom-code-tips) to inject HTML, CSS, and JavaScript into a site to customize it beyond what its no-code environment allows.

### Internal Business Applications

Not only does low-code development free up developer time to build internal apps or dashboards for business users, but it also helps developers build and scale those internal software solutions more effectively. For example, low-code automation platforms (LCAPs) help organizations turn business processes and tasks into automated software workflows [faster than coding them from scratch](https://www.appian.com/).

### Customer-Facing Applications

Low-code platforms often reduce the amount of time required to bring a web application or mobile application to market, as well as help businesses incorporate end-user feedback to improve those applications [faster](https://www.mendix.com/customer-stories/suez/).

### Replatforming

Low-code PaaS solutions make it easier to replace or upgrade critical components of your legacy systems with cloud-based solutions rather than trying to code everything from scratch.

For example, Auth0 [Marketplace](https://marketplace.auth0.com/),[ Actions](https://auth0.com/docs/rules), [Universal Login editor](https://auth0.com/docs/universal-login/universal-login-page-customization), and [SDKs](https://auth0.com/docs/libraries) with sample code for many technology platforms all save developers [hundreds of hours](https://auth0.com/case-studies/gymshark/) required to implement user-friendly authentication features while ensuring compliance with important data security standards (for example, [HIPAA](https://auth0.com/learn/why-hipaa-compliance-is-vital-your-business/) or [ISO 27001](https://auth0.com/blog/what-is-iso-27001-2013-a-guide-for-businesses/)).

## Consider Making Low-Code a Part of Your Strategy

Low-code can reduce the need for custom coding and allow developers to focus more of their time on the things that make their products unique rather than common (but necessary) tasks like identity. 

It’s why we continue to invest in low-code development tools for Auth0’s platform: to ensure developers can integrate identity quickly and get back to high-value tasks that will help your business grow.

Learn more about how Auth0 designs for developer experience using low-code, no-code, and pro-code [here](https://auth0.com/blog/designing-for-devs-at-auth0/).

<include src="asides/AboutAuth0" />

What Is Low Code? How Low Code Can Speed Digital Transformation

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

If your organization stores customer data in the cloud, SOC 2 compliance is table stakes.

In the last two years alone, cloud-based cyberattacks[ more than doubled](https://www.trustwave.com/en-us/resources/library/documents/2020-trustwave-global-security-report/) — even though SaaS spending[ grew just 18%](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/). 

While these numbers are merely a correlation from a statistical standpoint, it does indicate that if your business stores customer data in the cloud, it’s more important than ever for your business to take measures to secure that data. Especially given SaaS spending is[ expected to increase an additional 36%](https://www.statista.com/study/31317/software-as-a-service-statista-dossier/) between 2020 and 2022. 

A SOC 2 certification from the AICPA is a foundational step that will help every service provider reduce security risks. Below is a guide to SOC 2 compliance requirements and certification.

## What Is SOC 2?

SOC 2 is an independent audit report that evaluates the security controls a tech service business uses to protect the data they process in the cloud. Possession of a SOC 2 report is considered table stakes in the SaaS industry, as the answers to most security questions a customer may have about their business’s security posture can usually be pulled from this report.

### SOC 1 vs. SOC 2 vs. SOC 3

“SOC” stands for “System and Organization Controls” and was created by the American Institute of Certified Public Accountants (AICPA). SOC 2 is one of three SOC reports, each with different purposes and/or levels of transparency:

1. **SOC 1.** Used to audit internal controls relevant to a customer’s financial systems. Report usage is “restricted,” meaning its use is limited to auditors, the service organization, and authorized users.
2. **SOC 2.** Used to audit the overall management of customer data. Report usage is also “restricted” the same way SOC 1 is.
3. **SOC 3.** The same as SOC 2, but the report is simplified and publicly available to increase transparency.

![What Is SOC 2](https://images.ctfassets.net/23aumh6u8s0i/5LsphelbdnIZtLBd7NOrZQ/3e05f625deb2ff6588f9bffbf2dc3449/sep_compliance_02.jpg)

## Why SOC 2 Compliance Matters

SOC 2 compliance isn’t a legal requirement for a tech business. However, having a SOC 2 report is a common compliance objective for service providers that store their customers’ data in the cloud because it’s a necessity from an assurance (and therefore[ competitive](https://www.forbes.com/sites/forbesbusinesscouncil/2019/10/09/using-cyber-security-as-a-competitive-advantage/?sh=260c85237ff7)) perspective.

For many small to medium-sized operations that store marginally-sensitive data (for example, information that’s already publicly available), a SOC 2 report usually provides enough assurance of their controls and procedures to their customers. 

However, for businesses whose data is considered[ sensitive](https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en) (health data, for example), a SOC 2 report is the minimum a business should have in order to assure their customers they’ve taken steps to protect their data.

![Why SOC 2 Compliance Matters](https://images.ctfassets.net/23aumh6u8s0i/2gAtMudqliW2LiC3h7imD9/db7be0b8025f315b137a7744e7d5d469/sep_compliance_03.jpg)

## The SOC 2 Certification Process

SOC 2 certification is completed by a third-party auditor who assesses the extent in which service provider’s controls comply with one or more of SOC’s five Trust Services Criteria (TSC): Security, Privacy, Confidentiality, Processing Integrity, and Availability.

SOC 2 is different from other security certifications because it lets each business decide how best to implement the SOC 2 framework. The auditor evaluates how well the business has implemented controls relative to each of the TSC and its operations and gives their opinion of overall effectiveness.

The auditor then compiles their opinion and findings into a report (the SOC 2 Report) you can then use to assure your customers of the steps you’ve taken to manage their data.

The SOC 2 Report comes in two different types (Type 1 and Type 2), and each has an impact on how the certification process proceeds. However, since each requires an evaluation of your practices against the five Trust Services Criteria (TSC), we’ll address those first and explain how each of the report types affects certification in more detail afterward.

### SOC 2 Trust Services Criteria

Tech service businesses can choose to certify in as many or as few of the TSC as they like. Most businesses choose to earn a certification for one to three of the criteria. However, businesses that process sensitive data will benefit from earning certification in all five.

Below is what earning certification in each of the SOC 2 Trust Services Criteria entails:

1. **Security.** An evaluation of both the electronic and physical controls a business uses to protect the customer data they process. Auditors will examine security measures, like, network security, vulnerability management, and security monitoring, as well as the steps you’ve taken to secure any access to the physical devices and locations your customers’ data, is stored on in order to prevent unauthorized access.
2. **Privacy.** An evaluation of how a service business collects and uses customer data. Auditors will compare a company’s privacy policy(ies) to the actual operational procedure(s) to ensure they’re in alignment with the AICPA’s Privacy Management Framework ([PMF](https://www.aicpa.org/interestareas/informationtechnology/privacy-management-framework.html)).
3. **Confidentiality.** An evaluation of how data is stored, accessed and shared. Auditors will examine the procedures and access controls you have in place to restrict who has access to customer data, as well as any technical measures, like encryption, you’ve implemented to keep data safe.
4. **Processing Integrity.** An evaluation of your quality assurance and processing-monitoring practices. Auditors will examine whether data is called from your servers in the same state it was stored — and that it’s only called for the people who are authorized to access it.
5. **Availability.** An evaluation of whether your customers have access to your system as outlined in their contractual agreement(s). Auditors will examine controls and procedures-performance monitoring, business continuity, disaster recovery, and incident management to ensure they match what was promised.

![SOC 2 Certification Process](https://images.ctfassets.net/23aumh6u8s0i/3lefYYa9FsqqIVecGGpIlV/88a934fa5d9dbb876787096be7536747/sep_compliance_04.jpg)

## The SOC 2 Report

Once an auditor completes their evaluation of the security measures you’ve implemented, you’ll receive either a SOC 2 Type 1 Report or a SOC 2 Type 2 Report (depending on which you chose to certify for). Both reports contain an explanation of everything you’ve done to keep your customers’ data safe:

1. The controls you’ve implemented
2. How they align with the Trust Services Criteria
3. An explanation of your company’s operations
4. How the auditing process was conducted
5. How you’ve implemented controls to secure the user environment

However, the differences between each report type mean that obtaining a SOC 2 Report can create a substantial increase in the effort and work required to comply.

### SOC 2 Type 1 Report

A SOC 2 Type 1 Report is an evaluation of the design of your controls at a specific moment in time. This means the certification process required for a Type 1 Report can occur relatively quickly (in the time it takes for an auditor to evaluate your systems and procedures).

### SOC 2 Type 2 Report

A SOC 2 Type 2 Report is an assessment of the operational effectiveness of your controls. The evaluation is done over a period of time to observe how effective those controls are in practice instead of just at one specific moment, as in a Type I Report.

A SOC 2 Type 2 Report typically requires months of auditing to obtain. But the increase in assurance it provides is often worth it for service organizations that process sensitive data. Traditionally a SOC-2 Type 2 covers a 6-12 month period. 

![Additional Security Certifications That Are Worth Pursuing](https://images.ctfassets.net/23aumh6u8s0i/Xb8Z3o1JWLQE9ZlM2vcQw/303397e92ee5a143b23112d7f055e4cb/sep_compliance_01.jpg)

## Additional Security Certifications That Are Worth Pursuing

A SOC 2 Report helps you demonstrate a baseline of security to your customers, and the more Trust Service Criteria you certify for, the more assurance you can provide (it’s why Auth0 meets all 5). 

But given[ the rate](https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cloud-adoption-and-risk-report-work-from-home-edition.pdf) at which cloud-based cyberattacks are increasing in the wake of the pandemic (and[ the average cost of a data breach](https://auth0.com/blog/what-is-data-security/) across most industries), doing more than the minimum to secure your customers’ data is in your best interest.

Auth0 has earned certifications in several additional information security frameworks for this reason. We’ve created guides to earning certification with the ones we’re experienced with via the links below:

* **[ISO/IEC 27001](https://auth0.com/blog/auth0-achieves-iso-27001-certification/).** The International Organization for Standardization’s framework for building an information security management system (ISMS).
* **[ISO/IEC 27018](https://auth0.com/blog/what-is-iso-27018-2019-everything-executives-need-to-know/).** The International Organization for Standardization’s cloud-specific controls that cloud-based businesses should follow when certifying for ISO 27001.
* **[CSA STAR](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/).** The Cloud Security Alliance (CSA) offers some of the most relevant and cutting-edge controls for cloud security in the industry.

Learn more about how Auth0’s IDaaS platform can help you better secure and scale your authentication process[ here](https://info.auth0.com/video-platform-overview.html?_ga=2.10769394.753376883.1611345990-439625938.1611345989).

SOC 2 Compliance and Certification: What SaaS Businesses Need to Know

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Enhanced identity management for builders and providers of B2B SaaS applications enables faster implementation and best-in-class security, branding, and administration

**BELLEVUE, Wash. – April 26, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Organizations](https://auth0.com/organizations), a purpose-built feature enabling providers of B2B SaaS applications to seamlessly manage their business customers—a use case Auth0 defines as Business Customer Identity. Organizations is Auth0’s enhanced way for enterprise app teams to manage customers and partners in any multi-tenant, B2B, or SaaS application. With Organizations, B2B implementations are less complex, enabling faster speed-to-market and a better overall experience for business customers and partners. 

Business Customer Identity remains largely unaddressed by today’s Workforce Identity and Customer Identity Access Management (CIAM) solutions, forcing those who build and deliver B2B SaaS applications to cobble together features to address their unique use case. This requires significant customized configuration leading to high ongoing maintenance and configuration costs, slower time to market, and more difficult use case expansion and new app development.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5AGLt3QorElIYSuC43J2TE/c3db1cfffa3649353fab74e01dcdd511/approved-asset-three.jpg)

Business apps are not just used by individuals but by teams and entire companies, all of which need easy and secure onboarding, flexible membership provisioning, access control, and SSO setup. Convenience for B2B users is also increasingly in demand, prompting enterprises to provide similar seamless experiences to business partners as they do for consumers. Auth0 Organizations solves all of these issues and more, offering customizable identity management of any business customer or partner.   

Key benefits of Auth0 Organizations include: 

* **Simple Business Customer Onboarding:** Auth0’s APIs and SDKs can easily model entire business organizations, and rapidly-implemented admin dashboards manage SSO, Role-Based Access Control, and flexible user management workflows.
* **Custom-Branded Federations:** The ability to customize the login experience with branded login and registration flows ensures that business customers feel at home. 
* **Faster, Easier Deployment:** Less complex implementations shorten time to market, and integrations are accelerated as new products are built or acquired. 
* **Identity Engineering & Maintenance Costs Reduction:** Engineering resources can shift to work on core product innovation instead of focusing on complex identity issues.

“We were initially looking for a platform solely to handle SSO for our enterprise customers. Organizations is a great fit and offers enough flexibility to replace authentication for our 300+ non-enterprise customers, too,” said Steven Easton, Lead Engineer at Amiqus. “We’ve been really impressed with how powerful Auth0 is and yet have barely scratched the surface. We are excited to roll out Organizations as an improvement to our business customers’ experience and value how easy Auth0 makes it to do so.”

“We see Business Customer Identity as a standalone use case, one that our customers have increasingly been confronted with and had trouble fully addressing—until now,” said Shiv Ramji, Chief Product Officer at Auth0. “B2B identity management represents a sizable portion of our business and is consistently growing, demonstrating the need that Business Customer Identity addresses. We are thrilled to launch Auth0 Organizations as our next-generation offering for easy onboarding, authentication, and administration of business customers.”

More information can be found at [Auth0 Organizations](https://auth0.com/organizations).

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Launches Organizations, Transforming the Way Enterprises Manage Business Customer Identity

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

Explore how FastFed is looking to shorten the time it takes to join organizations into a federation.

## The Overview

In this episode of _Identity, Unlocked_, principal architect at Auth0 and podcast host Vittorio Bertocci focuses on OpenID foundation’s FastFederation ([FastFed](https://openid.net/wg/fastfed/)) group. Vittorio chats with Darin McAdams, a software engineer at AWS and the author of FastFed’s specifications, to explore how FastFed is looking to shorten the time it takes to join organizations into a federation.

Darin explains that Dick Hardt, one of the founders of FastFed, zeroed in on him to edit and draft the spec for FastFed. Darin began at the beginning, creating a sample G Suite and trying to set up a federation between both AWS and Salesforce. When he finally arrived at a place to begin joining the orgs, he was stuck - the first line, the first page, the needle scratches, and he doesn’t know how to proceed.

Eventually, after reading the SAML specs and following Google’s directions for integration, a long drawn out process of over 40 steps, Darin was finally able to integrate his sample G Suite with AWS, but never Salesforce. It became clear to him this process could be made much faster through automation.

FastFed is going after integrating a push-button single-sign-on experience for users of a federation, and to do so, they have to develop the communication between different authentication programs used by the organizations. FastFed also runs into the complications of communicating between identity providers, enterprise security preferences, and creating trust between the orgs. 

Darin and Vittorio dive into more details of the problems faced creating FastFed and scaling down a program with a vast scope into a push-button user experience.

## Key Takeaways

Darin explains how he discovered the problem FastFed is trying to solve:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/976ce3a6"></iframe>

How FastFed is looking to make the problem better:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/d79c5e15"></iframe>

Darin discusses the logical problems FastFed had to solve:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/1e42983d"></iframe>

SCIM’ing the problem. Funneling the multiple implications of SCIM into a single solution:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/a4e48489"></iframe>

Darin calls on engineers:

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/220d2e54"></iframe>


### Links/Resources:

Connect with Darin McAdams on [LinkedIn](https://www.linkedin.com/in/darin-mcadams-3950b52/)<br />
Connect with Vittorio Bertocci on [LinkedIn](https://www.linkedin.com/in/vittoriobertocci/)<br />
Connect with Vittorio Bertocci on [Twitter](http://www.twitter.com/vibronet)<br />

Learn more about [Identity, Unlocked](https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/episodes)<br />
Learn more about [Auth0](https://auth0.com/)<br />
Learn more about the sponsor for this season, the [OpenID Foundation](https://openid.net/foundation/)<br />

<include src="asides/IdentityUnlocked" />

<include src="asides/AboutAuth0" />

Identity, Unlocked... Explained: Season 2, Ep 6

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

Introducing these two new programs to bring new and diverse talent to our organizations.



Like many other technology companies, we are kicking off 2021 plans with a focus on bringing new and diverse talent to our organizations. This is why today, I am excited to announce two new programs we are kicking off this summer at Auth0: **The Summer Internship Program** and the **Engineering Launch Program**.

At Auth0, we are a company of builders who come to work every day to solve complex problems for our customers so that they can focus on the business problems that matter to them. For our customers, authentication and authorization are vital to every application. Implementing these in the right way is a hard problem for them, and it's only getting worse.

Identity is the only technology that sits at the intersection of convenience, privacy, and security. For their consumers, it is the place to make (or break) a good impression. This is what fuels our mission at Auth0 &mdash; to secure the world's identities so that innovators can innovate.

Today, I am excited to share two new programs in our global product delivery organization to attract aspiring developers, designers, data engineers, and students to join us in our mission **to enable easy and secure access to any application**. We have purposefully designed both programs with the following in mind: 

**Mentorship**: Program participants will benefit from ongoing support from leadership, a dedicated mentor, and a buddy for the entire program. Every engineer should feel encouraged, developed, and supported. Our commitment to growing our team, especially through mentorship, means we value and prioritize these relationships as part of our culture. 

**Meaningful Projects**: Our interns and ELP (Engineering Launch Program) participants will own meaningful projects and contribute to our roadmap. Their assignments will offer challenging and hands-on opportunities to learn about our products while delivering real customer value.

**Continuous Learning**: These roles will collaborate across teams to solve technical and non-technical challenges, get a well-rounded view of our business, diversify their skills, and stay ahead of the curve with a specialized curriculum to propel their careers. 

**Development**: We will challenge the cohorts to meet their personal and professional goals &mdash; while having fun along the way. In addition to project work and mentorship, they will learn from key members of the team through our Speaker Series, Lunch & Learns, and Coffee Chats. 

**Remote Culture**: Born as a globally-distributed organization out of necessity, Auth0 has tried and tested strategies for making remote work successful. With over half of our workforce working fully remotely before COVID-19, we've worked hard to establish a strong remote-friendly culture. Our unique culture will teach young minds to thrive as they sharpen their ability to excel in asynchronous work environments. 

## Introducing the Summer Internship Program

We are introducing our very first **summer internship** program. The internship program runs over the summer and is geared towards undergraduates looking to gain experience, solve real problems, and develop technical and soft skills. **The program is fully remote and open to anyone in the US**. 

![Summer Internship Program](https://images.ctfassets.net/23aumh6u8s0i/5T6FWeGLZ9qAYH5HqyVXvV/961fef91b8f1290167c2d9665ba657d2/summer-internship-program)

The internship assignments will be project-based and supported by a manager and mentor to maximize hands-on learning. Our internship program is going to offer students a unique experience:

* **Hackathons**: We'll kick off onboarding week with a Hackathon and close out the program with a second Hackathon.

* **Speaker series**: Twice a month, there will be a speaker series featuring leaders across Auth0. These sessions will have an interactive Q&A so that our interns and leaders get to learn about each other.
 
* **Learning and impact**: Our projects will be appropriately challenging, allow for cross-team collaboration, learning opportunities, and will make a direct impact on our 2021 roadmap.

* **Coffee chats**: These are weekly virtual coffee meetings with fellow Auziros. Mentors will facilitate these connections so that our interns can get an inside look at the day-to-day work of different departments.

* **Personal Development**: Fridays will be reserved for personal development towards their goals.

* **Lunch & Learn**: 45-minute sessions with key members from across Auth0 for a crash course on all things Identity. 

* **Project demos**: The program will finish off with a demo where interns will showcase their projects and outcomes to the entire company.

We have plans to expand this program beyond the US, and those will be unveiled later this year.

**Anyone who is an undergraduate student in the United States can apply for one of our 2021 summer virtual internships by visiting the [Auth0 careers page](https://auth0.com/careers/positions?title=interns)**. We have open intern positions in a wide array of fields, such as Data Engineering, Design, Security, and Software Engineering. Each internship career post will help you learn more about the projects that we have identified as ideal for our first intern class. [Check them out!](https://auth0.com/careers/positions?title=interns)

## Introducing the Engineering Launch Program (ELP)

We are also excited to introduce the **Engineering Launch Program**. This program is tailored for **new graduates and Bootcamp graduates**. The program participants will begin their 15-month program with a 3-month Foundations course to prepare them for success.

The Foundations course is a multi-faceted training curriculum that will effectively prepare new engineers to begin contributing in their development roles and warmly introduce them to our Auth0 and Engineering culture.  

![Engineering Launch Program](https://images.ctfassets.net/23aumh6u8s0i/5ccBubNErwBcVQHglzdE6J/cfbcb37430b4e30edb46ecebf000344e/engineering-launch-program)

The ELP will likely begin remotely until it is safe to return to [our headquarters in Bellevue, WA](https://goo.gl/maps/RCbP44EDSXWuiNek6). 

Undergraduate students and Bootcamp graduates with the right to work in the US, who are graduating this Spring, are all invited to [**apply today as a New Grad Software Engineer**](https://auth0.com/careers/job/software-engineer-new-grad-remote-bellevue:dc8674e2-7e11-49de-8ad9-0055c2af6571) to our Engineering Launch Program.

We are excited to open our doors to the next generation of talent and look forward to expanding these opportunities to our global applicants in the future. 

Happy coding, and stay healthy!

Shiv.

<include src="asides/AboutAuth0" />


Auth0 Launches Virtual Summer Internships and Junior Engineer Program

The way you respond could significantly reduce the impact it has on your organization.



Statistically, there’s almost a one in three chance (29.6%) that your business will experience a data breach in the next two years, according to [a 2019 study by IBM and the Ponemon Institute](https://www.ibm.com/account/reg/signup?formid=urx-42215). Your company [might even be getting hacked](https://www.cnbc.com/2015/07/29/most-firms-face-significant-daily-or-weekly-cyberattacks-accenture.html) as you read this because of almost two-thirds experience attacks on a weekly basis.

However, [IBM’s 2020 study](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/) found that teams that had a tested incident response plan (and a team to run it) saved an average of $2M (51.8% savings on the cost of an average data breach) compared with those that didn’t.

So although prevention is an essential part of your cybersecurity efforts, the way you respond following a breach is just as important with regard to how it impacts your organization.

The right way to respond after a breach has occurred is different in every case (it depends highly on what type of data was taken, how the breach occurred, and more). But there are a number of strategic best practices to follow that will help you limit the [impact on your business](https://auth0.com/blog/data-breaches-and-business-resilience-what-s-the-relationship/).

Here are four critical high-level steps that your response should include.

## 1. Consult With Legal Counsel

Most states/countries have legislation around security breaches involving personal information (in various levels of comprehensiveness and completeness). And you’ll need to follow them after a breach; otherwise, you could face severe consequences.

The General Data Protection Regulation ([GDPR](https://gdpr-info.eu/)) is a great example of legislation that has severe penalties for not following its requirements. In the event of a breach, you’re required to notify your users within 72 hrs; if you fail to do so, you could see fines as high as €20M or 4% of the previous year’s annual revenue.

However, the legal ramifications of a breach are often hard to assess in some countries ([the United States, for instance](https://iclg.com/practice-areas/data-protection-laws-and-regulations/usa)) because their data protection laws are fragmented and inconsistent. So it’s worth considering independent legal counsel with data privacy expertise to ensure that you’re doing everything that’s required.

Bottom line, your legal requirements will affect everything you do next. So start here to ensure you have an accurate picture of your obligations.

## 2. Secure Your Data and Systems

After a breach, you need to secure your systems and limit further data loss right away. It could save you an average of $164,386, according to [IBM’s 2020 study](https://www.ibm.com/security/data-breach). However, you’ll want to ensure that you do it the right way &mdash; you don’t want to obstruct a criminal investigation. Here are the best practices you’ll want to follow.

### Determine The Scope of The Breach

First things first: Determine the **entire** scope of the breach. Otherwise, you may miss something and fail to completely stop it.

To determine the scope of a breach, assemble a team of experts (your Incident Response (IR) team) who are capable of determining the following:

1. **What was accessed?** Which parts of your systems were affected, and what data did it contain?
2. **How was it accessed?** What were the vulnerabilities that allowed unauthorized access?
3. **What (if anything) was taken?** Not all breaches result in stolen data, but you’ll need to determine if anything was stolen because it determines the steps you’ll need to take next.
4. **Is your data available to the public on the internet?** If you’re unsure, start searching right away to determine if it is.

The best people for your IR team will depend on the breach. But they could include your legal counsel, IT team, cybersecurity team, HR team, communications team, and more. Consider hiring an independent forensics team to help you collect evidence because some of the actions you take to stop a breach may affect an investigation.

Ideally, you should have your IR team predetermined and trained to assess the scope of any breach before one occurs. It’s one of the [most effective ways to limit the effects of a breach on your business](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/).

### Secure Relevant Equipment

As you determine the scope of the breach, immediately take any affected equipment (servers, computers, etc.) offline, and secure related physical locations associated with them. This will prevent any further unauthorized access.

However, be sure to leave that equipment turned on until forensics has a chance to look at it. Otherwise, it may obscure the collection of important evidence (like traces of malware, etc.).

Additionally, [update the login credentials](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) of people who have authorized access to the systems/physical locations that were breached, regardless of whether that was the cause. Compromised credentials are the cause of [over 19% of all breaches](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/), and this extra step ensures that you won’t receive another attack on the same data this way.

### Remove Breached Data From The Internet (If Possible)

The faster you remove any breached data from the internet, the less impact it will have on your users. So if yours is posted somewhere (the dark web, for instance), take steps to remove it immediately by contacting the site and requesting that they take it down and delete it from their archives.

Keep in mind that some search engines also store your data in a cache for a certain period of time. Don’t forget to [contact them](https://support.google.com/webmasters/answer/7479439?hl=en) and make sure they haven’t archived it mistakenly.

## 3. Notify Relevant Parties

Legally speaking, if you don’t notify the right people at the right time about a breach, you could be slapped with a significant fine (like [the $35M fine](https://a-lign.com/sec-issues-first-civil-penalty-for-failure-of-data-breach-disclosure/) the SEC hit Yahoo with for failing to notify investors for almost two years).

However, notification is more than just a legal issue &mdash; it’s also about maintaining the trust (and business) of your customers. Failing to notify your users of a breach is a very bad move, from a PR perspective, [as Uber learned in 2018](https://www.vox.com/2018/2/6/16980356/uber-congress-senate-commerce-committee-2016-security-breach).

### Determine Your Legal Obligations

Many countries have specific requirements in their data privacy legislation that dictate whether, when, and how you should notify those affected by a security breach.

Unfortunately, there’s no one-size-fits-all best practice here: You must check the specific laws or regulations as they pertain to your business. Keep in mind that the type of information leaked in the breach might have special legal requirements as well (for example, medical data).

Here are a few links to resources that can help determine your requirements:

1. [U.S. Data Breach Notification Laws by State](https://www.itgovernanceusa.com/data-breach-notification-laws): A complete breakdown of U.S. data protection and notification requirements for every state
2. [GDPR](https://gdpr-info.eu/): European data privacy laws and notification requirements
3. [HIPAA](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html): Medical specific data protection and notification requirements per the U.S. Department of Health and Human Services

### Notify Law Enforcement

Law enforcement officials can help you navigate the aftermath of a breach, so you’ll want to get them involved early in the process to help you with your investigation. The right law enforcement to notify will vary depending on where you’re located and what laws your business is subject to. Check with your legal counsel on who you need to contact.

Additionally, make sure the law enforcement you’re working with is experienced in dealing with cybercrimes. If your local police department isn’t equipped for the task, you may need to escalate it to one that is.

### Notify Users

The sooner you notify your users, the better they’ll be able to protect themselves from damages associated with the breach. For example, if their credit card numbers were stolen, they can call their provider and lock their cards to prevent unauthorized purchases.

Or, if their Social Security numbers were taken, users can take steps to reduce the effects of identity theft right away &mdash; for example, by contacting a credit bureau and implementing a credit freeze.

Most countries/states have specific laws about how to notify your users if they are affected by a breach. So follow any legal requirements to the letter. However, for the sake of trust and transparency, you’ll generally want to share the following information with anyone who was affected:

* How the breach happened
* What information was taken, and how it affects your users
* How cybercriminals have used that information (if you know)
* What you’ve done to correct the situation
* What you’re doing to help your users with any negative consequences they may experience as a result of the breach (credit monitoring, for instance)
* How to get in touch with questions about the breach

As [Target](https://www.forbes.com/sites/daviatemin/2013/12/30/targets-worst-pr-nightmare-7-lessons-from-targets-well-meant-but-flawed-crisis-response/?sh=7f4115a943cf) proved with the way they handled their 2013 data breach, consumers value transparency when their personal data is exposed. So while you will experience a loss of trust, being upfront about it and controlling the narrative will help you retain some of that trust that you might not otherwise.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  <i>If you're in the United States, <a href="https://www.ftc.gov/tips-advice/business-center/guidance/data-breach-response-guide-business">the Federal Trade Commission (FTC)</a> has an excellent email template you can use to notify your users. </i><br> 
</div>

## 4. Correct Vulnerabilities to Prevent Future Breaches

Once the immediate threat of your latest cyberattack has passed, it doesn’t mean it’s OK to cross your fingers and hope that the rest of the security systems you have in place will do their jobs. It means it’s time to audit and address other vulnerabilities in your systems right away to prevent another incident and limit the [further impact to the business](https://auth0.com/blog/how-to-talk-about-breach-prevention-with-your-customers/).

The loss of trust from a breach is extensive. Studies show that anywhere from [65%](https://www.centrify.com/media/4772757/ponemon_data_breach_impact_study_uk.pdf) to [80%](https://www.forbes.com/sites/forbestechcouncil/2017/12/08/mind-the-trust-gap-how-companies-can-retain-customers-after-a-security-breach/#40b4b2806c95) of your customers will lose faith in a breached company. The impact? Millions in lost business, according to IBM/Ponemon:

![Correct Vulnerabilities to Prevent Future Breaches](https://images.ctfassets.net/23aumh6u8s0i/5w4MJYCAaovZlZ8EG3tTyQ/1273f480e751c4efd22d5b8c217ce6ec/01_IBMPonemonInstitute)
<p align="center"><i>Courtesy of <a href="https://www.ibm.com/security/data-breach">IBM/Ponemon Institute</a></i></p>

Simply put, another data leak could be devastating for your business. So here’s what we recommend doing to strengthen your information security in the wake of a breach.

### Audit and Reduce Access to Critical Data

Internal human error is a major cause of data security incidents, which means that as more people within your organization gain access to data, your risk for an incident skyrockets:

![Correct Vulnerabilities to Prevent Future Breaches](https://images.ctfassets.net/23aumh6u8s0i/NsneT5SdcElSTWaVMebDK/b8199f8e45a8203014a667cb75dd85e5/02_IBMPonemonInstitute)
<p align="center"><i>Courtesy of <a href="https://www.ibm.com/security/data-breach">IBM/Ponemon Institute</a></i></p>

That’s why Verizon consultants who assessed the aftermath of Target’s epic data breach recommended reducing access to critical data as an important step forward for the retailer, which was outlined in their [report](https://krebsonsecurity.com/2015/09/inside-target-corp-days-after-2013-breach/):

_“Target should limit the access to portions of the network containing business-critical systems to only the employees who directly manage those systems. Where possible, Verizon recommends restricting employee network access based on job function.”_

Bottom line, one of the best things you can do following a breach is audit who has access to sensitive information and limit it to essential personnel only. The fewer people who have access to important data, the less likely something is to go wrong.

### Encrypt Everything

Robust [data encryption](https://digitalguardian.com/blog/what-data-encryption) will make your data useless to hackers (even if it’s breached) because most don’t have the mathematical muscle or the patience to decrypt it.

Unfortunately, it’s taken quite a while for companies (even major ones with extremely sensitive data) to follow through &mdash; and they’ve paid the price.

For example, In 2014, hackers stole millions of customer records (all unencrypted) from Anthem, the second-largest health insurer in the United States. And although you’d think that would be a wake-up call for other companies, unencrypted records for over 140 million people were stolen from Equifax [three years later](https://www.cbsnews.com/news/equifax-ex-ceo-hacked-data-wasnt-encrypted/).

Given the constant barrage of cyberattacks that have a proven track record of breaking into the most advanced security systems, every company should be encrypting their data, no matter what. Here are three ways to encrypt yours:

* **Data encryption** converts information into another form, kind of like a secret code. The only way to read the data is to decipher it with a unique key. Modern encryption uses algorithms that make it extremely hard to crack.
* **Tokenization** replaces your data with unique symbols that retain all the information without compromising it. When the token is processed through the right tokenization system, it reveals the actual data.
* **Data de-identification** separates personal identifiers, such as name or Social Security number, with its related data, making it hard for hackers to figure out which data belongs to which individual.

### Improve Authentication Security

Compromised credentials are one of the two largest causes of all data breaches, according to IBM and the Ponemon Institute. So taking steps to improve the security of your authentication process following a breach is essential to ensuring one does not occur this way in the future.

Here are two easy ways to improve authentication security:

* [**Breached Password Detection**](https://auth0.com/breached-passwords/): Breached password detection checks users’ credentials against a database of breached credentials in real-time (that is, right when they log in). It will notify them if their password is breached, and you can even prevent access until the user has reset their password.
* [**Multi-Factor Authentication**](https://auth0.com/multifactor-authentication): Multi-factor authentication requires users to confirm their identity in [two or more ways](https://auth0.com/blog/multifactor-authentication-mfa/) in order to log in. This prevents unauthorized access, even if their credentials are compromised.

### Hack Yourself to Anticipate Future Attacks

If you are going to get hacked, it’s better (and [cheaper](https://www.ibm.com/security/data-breach)) to pay someone to do it intentionally first. You’ll tighten up your systems, and your team will be more prepared if the real thing happens.

This approach is also better than an automated scanner because penetration testers actually attack your network and exploit your system’s weak points, as a real hacker would. The goal is to test the real-world effectiveness of your security system against savvy human hackers, who will try everything in the hacker playbook to break in. And you can’t replicate that with an automated system (yet).

Major tech companies, including Google, Facebook, and Microsoft, are already doing this and have taken penetration testing a step further by creating [bug bounty programs](https://auth0.com/blog/bugcrowd-s-bug-bounty-program/). These programs challenge independent “pink hat” hackers to find vulnerabilities or other bugs that affect the security of their systems. And Google paid out [over $6.5 million](https://www.zdnet.com/article/googles-bug-bounty-program-just-had-a-record-breaking-year-of-payouts/) in 2019 alone to those who found gaps in their networks.

## Strengthen Your Weakest Link: Humans

Humans are by far the weakest link in your cybersecurity efforts. Phishing scams, ransomware, and weak passwords lead to [almost 50%](https://www.ibm.com/security/data-breach) of data breaches.

Plus, now that more people are working remotely in the wake of COVID-19, employees are also taking their work outside the office, using several portable devices that contain sensitive data (which opens up more opportunities for theft and unsanctioned devices lacking proper encryption).

So effective cybersecurity in 2020 is a lot more than just 1s and 0s &mdash; it’s a culture.

[Studies](https://www.isaca.org/-/media/info/cybersecurity-culture-report/index.html) show that strong ownership at the employee level improves cybersecurity and [reduces the number of incidents](https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2018/the-business-benefits-of-a-strong-cybersecurity-culture) an organization experiences. And training (plus the right tools) can help you encourage it:

1. **Educate employees with comprehensive and constant security training**. Whether it’s handling data or recognizing spam emails/social engineering practices, employees need to know how to identify and address security issues. Training is the most important security measure you implement to combat these attacks.
2. **Give employees the tools to better secure their devices**. Implementing [multi-factor authentication](https://auth0.com/learn/two-factor-authentication/) adds another layer of security on your employees’ devices. This eliminates the concern of an employee losing a device or inadvertently sharing their password. Even if their password is stolen, the account can’t be accessed without the second factor, like a physical device or a biological feature, such as a fingerprint.
3. **Improve user experience**. A seamless user experience that supports proven security practices and encourages secure behaviors is essential to building a strong cybersecurity culture. Avoid complexity at all costs.

Above all else, the key to creating a cybersecurity culture is showing your employees why it matters. Policy alone won’t encourage them to care &mdash; you have to help them see what’s at stake. Their vigilance could prevent the next breach altogether.

<include src="asides/AboutAuth0" />


4 Security Measures Companies Implement After a Breach

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Official UK Digital Marketplace accreditation makes it easier for public sector organizations to access Auth0’s identity and authentication management



Auth0 has once again been named as a supplier in the Cloud Services category of the G-Cloud 12 framework, part of the United Kingdom's official [Digital Marketplace for the Public Sector](https://www.digitalmarketplace.service.gov.uk/). G-Cloud accreditation prequalifies Auth0 to participate in public sector tenders for critical software and security services. It is the gateway to servicing government departments (such as HMRC) and non-governmental organizations (such as Homes England and the NHS).

This is the fourth year in a row that Auth0 has achieved G-Cloud accreditation, demonstrating Auth0's commitment to the vital public sector. This accreditation ensures continued access to Auth0's world-class security platform for public sector organizations in the UK.

## What Is G-Cloud 12?

The G-Cloud 12 framework helps ensure that public sector organizations have the ability to make informed and competitive choices in choosing cloud service providers (CSPs). The platform's internal marketplace of pre-negotiated service terms provides transparency on CSP pricing models and allows the public sector to avoid negotiating per-product contracts. This significantly streamlines the tender process, providing a base level of legal protection and pricing benchmarks for public sector entities. 

![Auth0 Search Results](https://images.ctfassets.net/23aumh6u8s0i/6njj9d9z8Ud2dgohq8Wv8l/ca3e6746ed06452932631bde00097f3f/01-auth0-search-results)

The framework clearly outlines pricing structures, security protocols, cost, platform compatibility, and more, serving as a central repository that makes it easy for public sector organizations across the UK to assess the cloud-based software tools available to them.

G-Cloud 12 encourages organizations to make the best choices for their own use cases, allowing them to use implementations that might not be feasible through a traditional government procurement system. As in the private sector, public sector software needs aren't one-size-fits-all, and pre-approved pricing structures make it easier to try software on any scale. The G-Cloud hub is a vital resource helping the public sector update their workflows faster and more cost-efficiently.

As the UK Government moves to better serve the public by making online services more available, protecting user identity is a critical security priority. Building identity solutions themselves can tie up valuable resources and expose public sector entities to risk, so they are moving toward utilizing standardized solutions such as those offered by Auth0. These offer world-class security, reduce risk, and free up internal resources for other key tasks.

For example, the West Midlands Fire Service (WMFS) is one of the few government departments in the country with its own in-house software development team. WMFS has been a leader in [creating award-winning digital applications](https://www.itproportal.com/features/how-open-data-helps-put-out-digital-fires/), including Tymly, a low-code, an open-source software platform that allows businesses to create and use flexible applications to gather, process, and distribute data.

However, rather than spend months building its own authentication system for Tymly, WMFS chose to outsource it. WMFS used the G-Cloud framework for its search, ultimately choosing Auth0's Identity-as-a-Service (IDaaS) to provide GDPR-compliant, cloud-based authentication for the Tymly platform. 

Using Auth0, WMFS can implement multi-factor authentication (MFA), biometrics, single sign-on (SSO), and social login to provide ease of access and the high level of security needed for public sector data.

## Recent Changes to G-Cloud Frameworks

The G-Cloud 12 framework is the 2020 update of the cloud services portion of the UK's Digital Marketplace, the central hub for approved services and suppliers operated by the [Crown Commercial Service (CCS)](https://www.gov.uk/government/organisations/crown-commercial-service) since 2019.

The latest iteration is largely similar to G-Cloud 11, but with a few changes. 

New this year is a requirement that suppliers who hold or work with government data need to meet "buyer requirements in respect of AI ethical statements." The Government Digital Service (GDS) has joined with the Office for Artificial Intelligence (OAI) to offer guidance on using AI in the public sector, with the goal of making sure "the public sector is leading from the front in the safe and ethical deployment of AI and other emerging technologies."

This year, G-Cloud 12 also requires in-depth service definitions for each listing explaining the service and how it works — something that Auth0 has always provided for its G-Cloud listings.

![Auth0 Digital Marketplace](https://images.ctfassets.net/23aumh6u8s0i/3ek6TCIybEXqkMBVOXpUhP/2d158a8b6285aa918bb42d73d77f0782/02-auth0-digital-marketplace)

G-Cloud 11 features about 4,200 suppliers and nearly 31,100 services, both an increase over G-Cloud 10. CCS has tracked spend data since the inception of G-Cloud in real-time via an [online dashboard](https://app.powerbi.com/view?r=eyJrIjoiNTEyMTZhZDAtZGNiNi00OWQxLWI5ODYtMjg1ZWNlMmNkODVhIiwidCI6IjlmOGMwZDc5LTNlODctNGNkMy05Nzk5LWMzNDQzMTQ2ZWE1ZSIsImMiOjh9).

## Benefits of Identity Management in the Public Sector

The UK public sector has been criticized for being reactive to new technologies, which often doesn't take into account the complexities and sheer scale of public sector requirements. The G-Cloud regime is an ambitious program designed to help streamline the procurement of best in class CSPs &mdash; which, in the world of identity, means Auth0. 

Identity and access management are clearly critical issues for almost all public sector organizations, but adhering to the constantly changing standards is difficult when an organization is locked into a rigid software stack. Having the flexibility to pursue up-to-date software helps organizations nimbly respond to changing security needs and threats.

Auth0's ability to identify and protect against ever-evolving security threats and our agile development methodology ensures that our customers have accelerated access to security updates and enhancements. With our continued presence in the G-Cloud market, public sector organizations can also benefit from our expertise in this area. 

Our continued G-Cloud accreditation underscores our commitment to democratizing access to our software and mainstream security practices, much like the platform itself aims to improve accessibility and choice for the UK public sector.

## Auth0's Mission

We believe that world-class security protections don't have to be reserved for elite companies or users but should be applied in broad contexts and accessed on platforms such as G-Cloud 12. Auth0's mission is to provide users with secure access to any application with one click or less. Whether you're a public sector organization, a small business owner, or a security-minded user, Auth0 helps ensure that you can access the most up-to-date security standards with low overhead and a seamless user experience.

![Auth0 Identity Platform](https://images.ctfassets.net/23aumh6u8s0i/469d5UiPrrjSZE0cDLMAbC/27a2b8459e326c9b052ab326ca6d34f8/03-auth0-identity-platform)

<include src="asides/AboutAuth0" />


Auth0 named to G-Cloud 12 framework for fourth year in a row

kerry-ok

Kerry is a marketer that loves to partner with the sales organization. As our SVP for Marketing, she is focused on sharing the Auth0 narrative across the globe. Before Auth0, Kerry spent many years working in B2B Tech at Skytap and F5 Networks. She spends her spare time with her family, dog, working in the yard, and enjoying fantasy football.

Chief Marketing Officer

Kerry Ok

Auth0 teamed with SD Times to discover how organizations evaluate and purchase technology



Over the last decade, most organizations have transformed into software companies. [As Marc Andreessen famously said](https://a16z.com/2011/08/20/why-software-is-eating-the-world/), “Software is eating the world, in all sectors. In the future, every company will become a software company.” Additionally, you often hear expressions like, “In the application economy, software developers reign supreme.” And yet, there is a persistent stereotype that executive management holds all of the power in how organizations evaluate and purchase technology. We wondered: is this still true? Do developers and technologists actually hold more power now? Can the way a company buys technology to be a competitive advantage?	

To uncover the answers, Auth0 partnered with SD Times to survey developers, managers, and executives in application development across the globe. We discovered their views on the importance of SaaS components to their teams and on how they research, evaluate, and purchase these platforms. All of the research findings have been pulled together into the Auth0 Report: [_How Development Teams Purchase SaaS_](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas). Here are a few of the insights we found:

* Companies that innovate fast (speed/frequency of releases) use SaaS components far more often than those that don’t.

![Percentage Apps](https://images.ctfassets.net/23aumh6u8s0i/2yrBhT0Q5hbBt0vreKpASv/8b82d69eec462155337af2fc3c05a3b3/saas_01_percentage_app)

* Outsourcing authentication can help companies reduce their time to market.

![Reduce your Time](https://images.ctfassets.net/23aumh6u8s0i/75kiSjLIngUxTKfqMtPmSh/3b788f7511a3db4a05390352b0fde11d/saas_02_reduce_time)

* Company size does not have a large impact on how they research third-party SaaS components.

![Researching](https://images.ctfassets.net/23aumh6u8s0i/3rA8zPrHqSad7vKs6P75TW/0b88a1e19eb9897d2862802a4823e9d5/saas_03_researching)

* Developers initiate 34% of SaaS component purchases, which is slightly higher than both technology management or technology executives.

![Product](https://images.ctfassets.net/23aumh6u8s0i/3hNCCyr8pdqYAEQXQyXLwX/787f028184e311d74a927f3c9af09b27/saas_04_product)

* Developers care greatly about being consulted in SaaS component purchase decisions. It impacts both job satisfaction and productivity.

![Developers](https://images.ctfassets.net/23aumh6u8s0i/1e7ug06moZrxRfQZaruvHK/5926f8ffff6ca7320524bd0c7f54c6ee/saas_05_developers)

* These are just a few of the insights for the How Development Teams Purchase SaaS report; [you can download the full research report here](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas).

<include src="asides/AboutAuth0" />


How Development Teams Buy SaaS

Pamela Dingle joins the show to discuss how standard organizations operate, and how the industry is evolving.



## The Overview

In this episode of Identity, Unlocked, host Vittorio Bertocci, principal architect at Auth0, is joined by Pamela Dingle, Director of Identity Standards at Microsoft and a founding member of Women in Identity. Pamela has been working with identity standards and related organizations for a long time: in this episode, she sheds light on the fundamental value proposition of open standards, how standard organizations operate, and how the industry is evolving. 

Standards are the main mechanism through which we harness collective intelligence and avoid continuously reinventing the wheel, as Pamela masterfully states before launching in a historical review of how the world of identity standards evolved. Starting with cornerstone standards such as LDAP and SAML, and associated standard bodies such as the Liberty Alliance, Pamela and Vittorio reminisce about a time in which only large companies had a say on industry standard’s direction. The discussion quickly branches out, moving toward organizations such as IETF and the OpenID Foundation responsible for the main modern standards (such as the OAuth 2.0 and OpenID Connect families of specs) we work with today. Throughout the chat, Pamela provides her perspective on concrete aspects of working on standards such as driving consensus while being inclusive of diverse perspectives, the fine balance between extensibility and strict guidance every standard strives towards, and more.

As the episode ends, Pamela discusses Women in Identity, where she serves as a director. Women in Identity is a non-profit organization creating identity solutions for and built by everyone. They’re working to drive a more diverse workforce in the digital identity industry. Their membership is open to women and their allies. 

## Highlights 

**[3:55]** - What are identity standards? 

The cast of characters mentioned here includes Anthony Nadalin ([@drsecure](https://twitter.com/drsecure)), Dale Olds ([@daleolds](https://twitter.com/daleolds)), and Mark Wahl ([@markwahl](https://twitter.com/markwahl)).

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/527e6dfc?clip=0308906d&embed=true"></iframe> 


**[6:12]** - How did identity standards come into practice? 

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/527e6dfc?clip=73d0ab82&embed=true"></iframe> 


**[7:37]** - What is LDAP?

You can find more details about LDAP [here](https://tools.ietf.org/html/rfc4510), but nowadays, chances are you won’t run into any situation requiring you to know so much about it.
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/527e6dfc?clip=0147dbc8&embed=true"></iframe> 


**[16:05]** - What is IETF? 

The IETF site, at [https://www.ietf.org/](https://www.ietf.org/), reflects the incredible breadth of the organization’s scope, which concerns itself with all things internet hence goes well beyond Identity. All the OAuth related activity (specs, smiling list traffic, etc.) can be found at [https://datatracker.ietf.org/wg/oauth/about/](https://datatracker.ietf.org/wg/oauth/about/).

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/527e6dfc?clip=0cd38fe6&embed=true"></iframe> 


**[20:37]** What is the OpenID foundation?

The OpenID foundation can be found at [https://openid.net/foundation/](https://openid.net/foundation/). If you want to go straight to the specs, you’ll find them on [https://openid.net/developers/specs/](https://openid.net/developers/specs/).

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/2475502a"></iframe> 


**[32:50]** - What is Women in Identity? 

Women in Identity’s home page is on [https://womeninidentity.org/](https://womeninidentity.org/) - you can follow them on twitter at [https://twitter.com/WomeninID](https://twitter.com/WomeninID).

<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/527e6dfc?clip=0cd38fe6&embed=true"></iframe> 

## Links/Resources

Learn more about [Pamela Dingle](https://www.linkedin.com/in/pameladingle/)<br />
Learn more about [Women in Identity](https://womeninidentity.org/)<br />

Vittorio Bertocci on [LinkedIn](https://www.linkedin.com/in/vittoriobertocci/)<br />
Vittorio Bertocci on [Twitter](https://twitter.com/vibronet)<br />

Learn more about [Identity, Unlocked](https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/episodes)<br />
Learn more about [Auth0](https://auth0.com/)<br />

<include src="asides/IdentityUnlocked" />

<include src="asides/AboutAuth0" />


Identity, Unlocked... Explained | Episode 3

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

No organization or violation is too small to avoid costly penalties.



## No Organization or Violation Is Too Small to Avoid Costly Penalties.

Since the EU’s [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) took effect in May 2018, EU authorities have issued more than [370 million euros](https://www.itgovernance.co.uk/dpa-and-gdpr-penalties) in fines. The headlines about GDPR enforcement have been dominated by a few well-known companies hit with big penalties: $57 million for [Google](https://www.nytimes.com/2019/01/21/technology/google-europe-gdpr-fine.html), $123 million for [Marriott International](https://www.forbes.com/sites/kateoflahertyuk/2019/07/09/marriott-faces-gdpr-fine-of-123-million/), and $230 million for [British Airways](https://www.cnet.com/news/british-airways-faces-record-breaking-230m-gdpr-fine-for-2018-data-breach/).

If you’re an executive following these stories, you might walk away with the mistaken impression that European authorities are prosecuting only multinational corporations for massive data breaches or privacy violations. But authorities in EU member states haven’t hesitated to issue significant fines to smaller organizations, sometimes for seemingly minor infractions.

Broadly, EU data protection authorities can fine any organization (or private citizen) that collects or processes personal information of EU residents and fails to obtain appropriate consent, does not have an adequate legal basis for collection, does not have appropriate security in place to protect such data, or fails to comply with individuals’ right to access, alter, and delete their data.

Executives in the European Union and beyond can learn valuable lessons from these lesser-known GDPR fines. Here are a few particularly interesting cases of GDPR violations the EU authorities are pursuing, and ways your business can avoid being fined for noncompliance.

<include src="TweetQuote" quoteText="Doing business in the EU? Even if you’re not a Facebook or Google, there are lessons to be learned by the track record of significant GDPR fines for smaller companies."/>

## Dutch Insurers Hit With GDPR Fine for Not Using MFA
Dutch public insurance company UWV was penalized for neglecting to implement adequate security measures when processing health data. According to the [_National Law Review_](https://www.natlawreview.com/article/dutch-supervisory-authority-imposes-gdpr-security-standard-processing-broadly), UWV had a public portal where employers could submit the dates of employee absences due to illness, pregnancy, or parental leave. Though employers did not specify what medical situation employees missed work for, even alluding to the fact that someone had been sick still qualified this as “health data,” which is highly protected under the GDPR.

UWV was prosecuted under [Article 32 of the GDPR](https://gdpr-info.eu/art-32-gdpr/), which mandates that organizations “shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.” The Dutch supervisory authority deemed that UWV violated Article 32 by failing to implement [multifactor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) in its portal. With MFA, logins require an additional form of authentication, such as a one-time code or a biometric credential. This form of login is more secure than simple username-password combinations, which are vulnerable to improper access and [credential stuffing attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks).

UWV is far from the only organization to be penalized for inadequate security. According to [GDPR Enforcement Tracker’s](https://www.enforcementtracker.com/#) database, there have been 37 fines levied to date under Article 32, making it the third-most-quoted article in enforcement actions, after articles 5 and 6. While 5 and 6 are quite broad in scope and could be considered catchalls, Article 32 singles out organizations with inadequate technical safeguards on personal data, whether that data was exposed or not.

UWV was made to conduct a privacy impact assessment and was given a year to put improved security in place, after which they would be fined €150,000 per month, with a maximum fine of €900,000.

**How to avoid this type of GDPR fine:** First, determine whether your business processes information that falls under one of the GDPR’s [special categories of personal data](https://gdpr-info.eu/art-9-gdpr/), which is defined as “data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership and the processing of genetic data, biometric data to uniquely identify a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.”

Any organization that engages in this type of data processing (even if, like UWV, it only obliquely alludes to it) will be held to a higher standard of data protection. That means it’s a good idea to put MFA in place to achieve GDPR compliance, and not just for your end-users but your employees as well. In a similar case in the Netherlands, a [hospital was fined](https://cloudprivacycheck.eu/latest-news/article/fine-of-EUR-460000-imposed-on-dutch-haga-hospital-by-dutch-data-protection-officer-the-first-dutch-fine-under-gdpr-july-19-2019/) €460,000 for not having two-factor authentication in place to prevent staff members from improperly accessing the medical records of a Dutch celebrity.

## Misplaced Files Earn a Hefty GDPR Fine

[Norway’s supervisory authority](https://aigine.se/en/one-file-in-the-wrong-place-price-170-000e/gdpr/) fined the municipality of Bergen €170,000 under articles 5 and 32 of the GDPR. This case came to light after a student in a local school discovered that several files, containing login credentials for 35,000 students and employees, were accessible to the public. This oversight was exacerbated by the fact that the school system also didn’t have MFA in place, so anyone who had login credentials could then access the school’s digital learning platform, which contained highly personal information, such as schoolwork and teacher evaluations.

Norway’s data protection authority, [Datatilsynet](https://www.datatilsynet.no/en/regulations-and-tools/reports-on-specific-subjects/administrative-fine-of-170.000--imposed-on-bergen-municipality/), said the size of the fine was partly due to “aggravating factors.” Specifically, they cited the fact that the majority of the data subjects were children, and that the town had been warned repeatedly, both by outsiders and “an internal whistleblower,” that it needed to improve its [data security](https://www.voicesage.com/blog/mobile-messaging-and-the-implications-on-data-security-best-practices/).

**How to avoid this type of GDPR fine:** As Datatilsynet explained in its decision: “In the GDPR, children are defined as a particularly vulnerable group that shall be given special protection.” So any business that processes the data of minors must exercise special care, both in ensuring that data is secure and in obtaining consent.

Also, this fine speaks to how imperative it is for every company to [get a clear view](https://auth0.com/blog/yes-data-privacy-applies-to-you/) of where their data is and who can access it. A good place to start is a user management system, with a [dashboard](https://auth0.com/docs/dashboard) that lets you easily grant and revoke permissions to sensitive data and delete it on request, by data subjects' rights under the GDPR.

<include src="TweetQuote" quoteText="The pace of GDPR is expected to pick up in 2020. Discover what even smaller companies need to do to avoid significant fines."/>

## Similar Data Breaches, but Very Different GDPR Fines

In the summer of 2018, German social media company [Knuddels](https://threatpost.com/knuddels-flirt-app-slapped-with-hefty-fine-after-data-breach/139384/) and EU fintech company [MisterTango](https://digitalguardian.com/blog/lithuanian-dpa-hopes-first-gdpr-fine-wake-call) each suffered data breaches that exposed personal information, but they were treated very differently by authorities.

Knuddels got away with a €20,000 administrative fine under Article 32, which [German supervisory authorities](https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/) attributed to its transparency, cooperation with authorities, and efforts to institute additional security measures.

MisterTango, meanwhile, was fined €61,500 under articles 5, 32, and 33. Lithuania’s data protection authority held the company to account for failing to report their security breach to the [Information Commissioner’s Office](https://ico.org.uk/)(ICO) within the requisite 72 hours. This initial misstep triggered an investigation, which revealed that MisterTango was collecting data with an insufficient legal basis and storing it for too long and had only one employee charged with handling data security.

**How to avoid this type of GDPR fine:** Both Knuddels and MisterTango made significant data security errors. Knuddels stored unencrypted versions of its users’ credentials, and MisterTango inadvertently exposed customer data in a public setting. There are lessons here about the importance of anonymizing personal information and keeping close track of data.

The biggest lesson, however, is in the vast disparity of the fines for two similar violations. Knuddels minimized the damage by coming forward about the security breach immediately and devoting adequate resources to ensure it would never happen again. [EU authorities have emphasized](https://auth0.com/blog/data-privacy-2019-the-lowdown/) that they will be more lenient with organizations that act in good faith and can show a commitment to fixing mistakes and prioritizing cybersecurity. By devoting adequate resources to data privacy—such as partnering with an expert third party like Auth0—you can prove that your business is serious about getting GDPR compliant.

## Embrace GDPR Compliance Now or Risk Penalties Later

What these fines should teach us is that no one who processes the data of EU citizens is small enough to pass under GDPR’s radar. (That even includes private individuals, like the man who was fined €300 by Austria’s data protection authority for [illegally using a dashcam](https://easygdpr.eu/gdpr-incident/strafe-gegen-privatperson-wegen-dashcam/).)

The pace of regulatory actions under the GDPR is expected to only increase in the coming year, and all it takes is a single individual’s complaint to trigger an investigation. Given the potential costs of GDPR infringement, along with the new data protection laws coming into effect around the world, now is the time to put appropriate security measures in place and prove that you’re serious about protecting personal information. If you’d like to learn how the right identity management partner can be part of the solution, don’t hesitate to reach out to [Auth0’s experts](mailto: sales@auth0.com) today.


GDPR Fines Hit These Companies Hard. Here’s How to Avoid Them.

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

A strong password storage strategy is critical to mitigating data breaches that put the reputation of any organization in danger. Hashing is the foundation of secure password storage.

Hashing Passwords: One-Way Road to Security

umut-benzer

MSc. in Computer Science, working as a Software Engineer since 2011. My passion is building high quality products that solve real life problems. I like traveling. One day I'll visit all countries in the world.

Umut Benzer

Learn about the things to pay attention to, and what to automate while reviewing code so that you can increase the speed and the quality of code reviews in your organization.

Conducting Effective Code Reviews

Stay organized, access the largest and most up-to-date storage capabilities, and gain more visibility into user behavior.



The healthcare industry is the second largest in the United States, but average spend on cybersecurity is just half as much as other industries, according to a recent [TechCrunch report](https://techcrunch.com/2018/08/09/the-healthcare-industry-is-in-a-world-of-cybersecurity-hurt/). This is surprising (and unfortunate), given how valuable patient records can be to cybercriminals. If a thief obtains medical records, he or she can do a host of things, including the following:

* Purchase medical equipment or drugs in the patient's name
* Submit false health insurance claims
* Tamper with a patient’s medical devices
* Use personal information on file (such as addresses or Social Security numbers) to access other sensitive data, like financial accounts.

Hospitals, private practices, and third parties that store and process patient data are ripe for hackers.

In 2017 there were [more than twice the amount of attacks](https://techcrunch.com/2018/08/09/the-healthcare-industry-is-in-a-world-of-cybersecurity-hurt/) on healthcare organizations vs. other industries—and is just the start of what we've seen so far this year. According to a recent [Protenus report](https://marketing.protenus.com/hubfs/Breach_Barometer/2018/Q2%202018/Q2%202018%20Protenus%20Breach%20Barometer.pdf), between April and June of 2018, more than 3 million patient records were exposed. Threats are multiplying, and healthcare cybersecurity across teams is not keeping pace.

Last year, we highlighted how many healthcare organizations were facing challenges in [modernizing their legacy systems](https://auth0.com/blog/why-healthcare-is-moving-to-the-cloud-but-isnt-there-yet/). Since then, the issue of security has become more acute in the industry. Below, we detail four key reasons why cloud solutions are critical for healthcare organizations, and we offer suggestions on how to make the transition.

## 1. The cloud helps keep sensitive data in one location.

When you [move data to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/), it gives you the chance to aggregate disparate streams of information in a single place. Even if the majority of your patient data is protected, when you have information in many different sources, such as spreadsheets, hard drives, and even hard copies, it can be easy for something like a prescription or a note from an operation to get lost in the flood.

Moving data to the cloud opens new opportunities for [data management and integration (DMI) practices](https://auth0.com/blog/all-you-need-to-know-about-data-management-and-integration/). While DMI is a complex and evolving space, in a nutshell, it is a set of policies and procedures that an organization puts in motion to be sure the right people have timely access to accurate data.

For hospitals, it's essential that records are clean and up-to-date before an IT professional moves them or merges them with other information. If errors occur in patient names, medical histories, [financial information](https://www.teampay.co/insights/when-to-excel-and-when-to-automate/), or prescription information, for example, it can end in a costly lawsuit and a stained reputation— not to mention physical harm if patients are not treated correctly.

## 2. A cloud solution helps avoid downtime.

For many organizations, downtime means lost business opportunities. Teams can't [respond to customer requests](https://blog.ujet.co/how-to-elevate-customer-support-from-within), follow up on leads, and deliver products and services if computer systems are suspended. 

(Some companies are so concerned about this, given the [enormous uptick in data breaches in 2018](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), that they've begun to take out cybersecurity insurance policies that can help recoup losses.)

In healthcare, more than money is on the line. If systems are down, staff aren't able to book emergency appointments, and doctors and nurses aren't able to confirm medications or timing for procedures. Lives are at risk. 

In 2018, at New York's Jones Memorial Hospital, [computer systems were down for a week](https://www.healthcareitnews.com/news/cyberattack-knocks-new-york-hospital-offline-week) after a cyberattack. Jones Memorial is a small acute-care facility in a rural area. During the time it took to detect and clean up the issue, the hospital had to revert to manually entering patient data into medical charts and recreating prescription lists. Although the hospital had prepared for these downtime procedures, it still left more room for error and wasted time that staff could have spent delivering care.

Cloud vendors like Microsoft and IBM offer additional precautions, like up-to-date software, that can help mitigate the chances of a breach due to holes. They can also help solve common problems such as load balancing, which often leads to outages. If activity is too much for a single server to handle, these larger providers are able to spread demand over multiple servers, ensuring that you don't short-circuit in times of high activity.

## 3. A cloud solution affords better insight into user behavior.

Cloud computing is far more than a repository for your information. It opens up a world of new opportunities for IT admins, helping them better understand how employees and third parties use their systems — and who is accessing what digital files at any time.

When you're based in the cloud, you can begin to tack on additional features, such as Auth0's user-management software, which quickly pulls details on existing users at any time.

![Auth0 User Profile](https://images.ctfassets.net/23aumh6u8s0i/76L9nLzxwq7H8f4HsAnRSn/99249132de75059ed85ebb89af0d2c7e/healthcare-cybersecurity_auth0)

This level of visibility makes it easier for admins to monitor for unknown visitors or strange behaviors. If, for example, they see “John” trying to gain access to a database he isn't permitted to view, an IT executive can pull his profile, understand why he might be trying to get in, and either grant or block access. Admins even have the ability to log in as any user and attempt to troubleshoot from his or her vantage point.

Additional cloud solutions, such as identity management, can also help protect you from your own employees. Nearly [one-third](https://www.healthcareitnews.com/news/142-healthcare-data-breaches-q2-30-caused-repeat-offenders) of the attacks on patient records in 2018 came from within the organizations themselves. You want to be sure you don't have medical data still floating in file cabinets or on unprotected servers. 

## 4. The cloud gives you flexibility as you grow.

Providers like Amazon Web Services, Google Cloud, and Microsoft Azure come with on-demand teams and resources that can help customize cloud plans as organizations develop over time. Even if hospitals aren't necessarily in hypergrowth mode like many startups, they still have shifting needs. These could be for increased or reduced load capacity, depending on staffing and patient demand; more [private cloud requirements](https://auth0.com/docs/appliance/private-cloud-requirements), given a larger volume of high-touch data; or a desire to move more to the public cloud, due to cost restraints. 

Many healthcare organizations opt for a combination of public and private cloud deployment. Both offer flexibility for expansion and require less maintenance than in-house storage. The public cloud is less expensive; however, teams often go for at least a portion of data storage in the private cloud, given the following:

* A higher level of customization (since you're not sharing resources with others)
* A more stringent selection of user permissions
* No need for backup hardware or software

Due to the confidential nature of their work, government agencies and financial institutions also often opt for private cloud use. This gives an even greater sense of its capacity.

## Better healthcare cybersecurity starts with the cloud.

Security for healthcare teams is only getting more complicated. Medical devices, for example, are a growing concern. In a worst-case scenario, a cyberattack could tamper with pacemakers or other life-supporting devices. To this end, the U.S. Food and Drug Association recently released a new [cybersecurity playbook](https://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm622074.htm), which, in part, sets new guidelines for creating medical devices with software that is adaptable to new threats.

The interconnected nature of delivering care reveals how an attack on one portion of the organization has the potential to affect all others. While cloud computing won't guarantee protection against cybercrime, it will keep a team's data organized and as secure as possible.

Finally, as healthcare teams work to [comply with HIPAA](https://auth0.com/learn/why-hipaa-compliance-is-vital-your-business/), cloud computing helps providers and third parties stay prepared in the event of an audit with more visibility into day-to-day operations and tighter user permissions.

<include src="asides/AboutAuth0" />


4 Ways Cloud Computing Can Improve Healthcare Cybersecurity

biodun-chris

Experienced Founder with a demonstrated history of working in the information technology and services industry. Skilled in Python, iOS Development, Bootstrap, Java, and Node.js. Strong entrepreneurship professional with a Bachelor of Science focused in Computer Science from University of Ibadan, Oyo State.

Software Engineer, Murcul

Biodun Chris

In this article, you will learn how to create well-organized APIs with Node.js, Restify, Joi, and MongoDB.

Developing Well-Organized APIs with Node.js, Joi, and Mongo

Tips for a secure and organized data migration process. 1. Workflow and project management tools 2. User identity and access management 3. Clear customer communication



Data is the foundation of a company's success. It provides the basis for customer insights, corporate strategy, and operational efficiency. As more companies embark on [digital transformation](https://auth0.com/app-modernization), migrating this critical information — particularly sensitive customer data — to a new platform(s) can be a burden. Moving data can unearth inaccuracies, unknowns, and/or duplicate entries, making it insufficient to use and requiring significant changes. 

The tips below will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users.

<include src="TweetQuote" quoteText="Data is the foundation of a company's success. This post will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users!"/>

---

## Issues That Can Arise with Data Migration
Before we dig into strategies for success, it's important to understand the issues that can arise in data migration. The process can be thorny for several reasons.

### Lack of Consideration for the Process
Teams are generally focused on selecting and configuring their new system. Testing potential tools and comparing the models are generally more exciting and inspiring than the mechanics of lifting data out of the legacy package. If data is uploaded in its current state, any errors or irrelevant aspects could become amplified and increase the information's exposure to risk. Because of this, it's important to be sure your team is on the same page about the nuances of the process and has a specific roadmap marked with individual roles and responsibilities.

### Improperly Tracking Users
It's critical to manage user identities and monitor for suspicious activity when you're migrating sensitive information. Companies that rely on consumer data, in particular, must validate all entries against new regulations — [GDPR](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data), for example, along with more specialized industry standards such as Sarbanes-Oxley (SOX) for financial institutions and the Health Insurance Portability and Accountability Act (HIPAA) for many healthcare providers.

### Poor Communication of Updates
Making sure your end users understand how you are securing their data after you've updated your apps is important for maintaining their trust. If you can't articulate what you are doing with their information, it's unlikely they will stick around. Documenting your work and developing a clear communication strategy are essential to making sure your data migration supports your company's overall goals for growth.

To address these potential issues, the following strategies focus on workflow, user access, and communications.

<include src="ebook-ads/UserMigrationYourWay" />

## 1. Organize Your Workflow and Project Management
To clearly understand and outline the steps required for a successful data migration, take time to consider the following:

- What will cause the least disruption to the daily operations of your system? That is, when are the best times to work on and/or migrate data sets of highest sensitivity or usage?
- What aspects of your strategy can you tag to teammates in-house, and where might you need to bring in outside expertise?
- How will you document your process, ensuring that all information is accounted for?
- Will you enrich your files after they have been moved with further information (e.g., customer names and/or account numbers)?

While this list is not exhaustive and each strategy will be unique, depending on an organization's current systems and future goals, it should aid in understanding the depth of thought required for an efficient data migration.

It can be helpful to use a workflow tool to organize your team and define your process. [Airtable](https://airtable.com/product) has a proven track record for improving internal organization. When mapping out your data migration strategy, Airtable can help define your project scope, set deadlines, and assign individual responsibilities.

For any task that you're organizing, Airtable will help prioritize tasks and ensure that you adhere to your overall goals:

![Airtable](https://images.ctfassets.net/23aumh6u8s0i/38brOxQrTQvBu8Pa8BBQ17/df355af7ec95291c2abff6758ccb9694/1-airtable)

> [Source.](https://airtable.com/product)

Within the grid view, you can check to see which tasks have been completed and quickly note whom to reach out to in case of a question or concern. Airtable also has a [calendar view](https://airtable.com/product) to better visualize the timeline of your data migration, which can quickly become lengthy and arduous without clear monitoring. Both views can help break down the potentially opaque data migration process into a concrete series of steps.

Additional tools to consider for managing the task of data migration include:

- [Asana](https://asana.com/guide/examples/company/project-management): Highly customizable, popular tool for engineering teams
- [Trello](https://trello.com/): Visual workflow; bulletin-board format
- [Jira](https://www.atlassian.com/software/jira): Supports distributed collaboration

Taking time to think through your steps at a granular level and selecting a tool that will hold your team accountable will help you succeed.

## 2. Clearly Track Who Accesses Customer Data
Understanding who is accessing and updating portions of sensitive customer data at any given time during the data migration process is critical to maintaining integrity. In today's environment of [increasing industry regulations](https://auth0.com/gdpr) around consumer data, this core function must be up-to-date and as tight as possible. 

Because of the complexity and urgency of this task, many teams choose to outsource their [identity management](https://auth0.com/app-modernization) when migrating data, particularly as part of a larger [digital transformation](https://auth0.com/learn/identity-management-drives-digital-transformation/).

[Auth0's user management dashboard](https://auth0.com/b2e-identity-management-for-employees) allows a systems administrator to authorize new users, track their behaviors, and evaluate their performance according to the company's policies.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/5IwuLEHPTS1w1q7UhTcUPk/277cb0224267a945a4265e0984263142/2-auth0-manage)

> [Source.](https://auth0.com/learn/cloud-identity-access-management/)

In the Auth0 dashboard, an administrator will have a clear view of users at any point. In addition, Auth0's identity platform offers enhanced options like multi-factor authentication, anomaly detection, and advanced logging. For example, if the administrator notices a certain user has a series of failed login attempts, they can [block access](https://auth0.com/docs/anomaly-detection) to investigate further. 

From a user perspective, this function is an invisible and painless part of their workflow. 

## 3. Explain Your Data Policy Changes
If you can clearly communicate your data migration and updated data usage policies to your users, you will gain their trust — and an edge over your competitors. At the moment, very few company blogs or statements spell out the details of data usage in a digestible format — as we've recently seen with Facebook's [confusing policies](https://www.wired.com/story/mark-zuckerberg-congress-day-one/). 

You have an enormous opportunity to distinguish yourself in the field if you can fill this information gap. A major data migration is a perfect opportunity for you to document previous work and latest updates. Making this information immediately visible, user-friendly, and clearly accessible is key:

![Facebook](https://images.ctfassets.net/23aumh6u8s0i/7mn6vdZtybE6e5Rlg1dSNa/10c9a53747ac05ec8598251b03153990/3-zuck)

> [Source.](https://www.recode.net/2018/3/28/17171496/facebook-settings-redesign-cambridge-analytica)

While hopefully your team will not be recovering from a data leak like [Facebook's](https://auth0.com/blog/cambridge-analytica-and-facebook/), the tech titan provides an excellent example of how to communicate a change in policy to users. Three key points to include when explaining your updates are:

1. Place a brief summary of the information on the front of the app where users will see it immediately without any digging.
2. Include a clear CTA or way in which users can click to read further details.
3. Make sure any actions your user must take to delete or update their data settings are very simple.

You must make your user feel as though they are well supported and in full control. Both sets of information — your summary and fine print — should feel friendly and encouraging. Employ your best writers and incorporate welcoming images or a set of bullet points to truly put your best foot forward.

## Don't Be Afraid to Change
[90%](https://auth0.com/learn/how-auth0-uses-identity-industry-standards/) of businesses today state that legacy software systems are keeping them from achieving their goals. Despite increasingly strict regulations, you should not be afraid to scale and innovate. Just be sure you take the process of data migration seriously as you search for your new platform. Make sure the right people access the correct pieces of data at the proper times during the migration and then seize the opportunity to demonstrate how bulletproof your new strategy is with excellent customer communications.

<include src="TweetQuote" quoteText="90% of businesses state that legacy software are keeping them from achieving their goals. Scale and innovate while paying attention to data migration to succeed!"/>


Three Strategies to Streamline Your Data Migration Process

A strong CIAM system can help you modernize in a quicker, more organized fashion.



The shift to the cloud is accelerating. Teams of all sizes, including giants like Microsoft, IBM and SAP, are racing to catch up (as we just saw with [SAP's enormous recent acquisition of Qualtrics](https://techcrunch.com/2018/11/11/sap-agrees-to-buy-qualtrics-for-8b-in-cash-just-before-the-survey-software-companys-ipo/?utm_medium=TCnewsletter)).

Every company wants to become faster, smarter, more nimble, and more secure. The best place to begin improvements is with your customer relations. A strong customer identity and access management (CIAM) strategy can be the cornerstone of a team's success. It helps you organize your sensitive customer data in a single place, which ensures you're [compliant with current regulations](https://auth0.com/gdpr). It can also help you form a more creative and targeted strategy moving forward.

Moreover, if you're going through a [digital transformation](https://auth0.com/app-modernization), maintaining continuous customer engagement throughout this challenging process can help keep sales on track.

### What a CIAM solution allows you to do:

- Create a single view of your customers from disparate pieces of data.
- Reduce customer churn with frictionless registration.
- Stay safe in an environment with rising cybercrime.

We dig into these three benefits below and highlight how Auth0's customer identity and access management tools can help you achieve your goals.

## 1. Why customer identity and access management is the first step in single view.

[Single view](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) is becoming the norm for teams that wish to stay competitive. While this is especially clear among [retail and media companies](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/the-case-for-digital-reinvention), it's highly relevant for all customer-facing teams. Catering to customers requires an in-depth knowledge of their interests and behaviors.

Outsourced CIAM providers like Auth0 are able to create an extensive profile for each user in a company's system, which tracks and manages their logins and devices along with their purchase histories.

![Building rich customer profiles, a single view with a CIAM system](https://images.ctfassets.net/23aumh6u8s0i/okSReaVDL4OSDzKC20Kiv/db01bde2e4bfef2b6c5eb85f8b7000fa/logins)

Auth0 facilitates the collection of customer data from all available public sources that combine into a comprehensive picture that you can use to underpin more targeted marketing materials, communications, and product rollouts. Knowing that Maggie Smith is 23, for example, will ensure you don't try to push products for aging on her. You can focus instead on developing a relationship, based on her [millennial interests](https://adespresso.com/blog/marketing-to-millennials/).

If your company opts for [social login](https://auth0.com/learn/social-login/), this profile will also pull Maggie's specific interests from the social providers you choose for authentication.

![Auth0 Social Connections social login providers](https://images.ctfassets.net/23aumh6u8s0i/1GL2CgoClEfkZ9vAfOtAzf/e399ae270682e494910d30fe93126883/sociallogins)

If a user opts to log in from multiple sources (e.g., both Facebook and Google), your team can link these accounts back together, integrating both sets of information.

A single, detailed view of each of your customers is an excellent starting point for [integrating this rich information into your CRM](https://clearbit.com/enrichment) and making more calculated decisions — such as tailoring which pieces of content your users see. Matching articles and/or advertisements to your audience's specific likes, interests, and histories can give them a more personalized experience on your platform and ensure you stay a step ahead of the competition.

## 2. How frictionless registration keeps customers engaged.

Customer retention is an enormous concern for teams today — particularly when the cost of switching among products and services is low, and product reviews and complaints are ubiquitous, along with nearly every other piece of information about your company via social media and a constant stream of news.

Yet there's still an enormous opportunity to shine and create a better experience for your users in this environment. Many companies still struggle with [bad login UX](https://auth0.com/blog/bad-login-experiences/). Users often have to refresh tabs several times just to access a homepage. They quickly lose interest if they have to recover a password more than once. A CIAM strategy that encompasses [passwordless methods](https://auth0.com/passwordless), however, can ensure success:

![Screen showing different passwordless authentication methods with Magic Link selected](https://images.ctfassets.net/23aumh6u8s0i/4y4Kb6Sx3JEwxEGaxTR5xU/49137e92bae8c15bfe3c48b1a35eeacb/magic-link)

SMS, magic link, and Touch ID are three tools Auth0 uses to help its customers ensure a smooth set-up process.

- SMS involves users entering just their phone number to sign up.
- Magic link relies on just an email address.
- Touch ID uses your unique thumbprint.

In addition to simplifying sign-ups, these three solutions contribute to a consistent user experience after an account is created, supporting a higher level of engagement with a company's suite of products and/or services over the long term.

Finally, passwordless authentication can also help mitigate the insecure practice of users recycling the same password for several accounts when a password reset procedure is triggered. This feature is [easy to implement](https://auth0.com/docs/connections/passwordless/faq) with a robust provider like Auth0.

## 3. How an outsourced customer identity and access management provider can help you secure sensitive data.

In addition to being a cornerstone of your team's growth strategy, an impenetrable CIAM setup can help ensure the data of your users is safe from cyberthreats.

Several studies show that [data breaches are on the rise](https://auth0.com/blog/what-is-a-data-breach/). According to [Dark Reading](https://www.darkreading.com/vulnerabilities---threats/2018-on-track-to-be-one-of-the-worst-ever-for-data-breaches/d/d-id/1333252), 2018 is set to be one of the worst years in history for data breaches, with more than 3,600 reported breaches and over 3 billion records exposed. While no tool can 100% guarantee the safety of user data, CIAM mitigates the risk of your company shelling out for fines and lawsuits in the short term and potentially losing its good standing in the long term.

Users will appreciate your implementation of [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) (MFA), for example — i.e., relying on additional sets of information, such as SMS codes, fingerprints, or voice recognition to gain access.

![Multi-Factor MFA authentication on different mobile and watch devices](https://images.ctfassets.net/23aumh6u8s0i/2846ymlXupGms7lqbpSaPh/f227b6ab55a465a5b3138bff54bae3e7/mfadevices)

Auth0 Guardian can make the process of switching to MFA simple. In fact, it even makes MFA itself easier by allowing immediate approvals or denials a login attempt — from a desktop or mobile device (including Android Wear or an Apple Watch).

MFA has a strong success rate for keeping cyberthieves out—largely because it avoids reliance on passwords. A 2017 study found that breached passwords were responsible for [81%](https://www.cso.com.au/mediareleases/29642/hacked-passwords-cause-81-of-data-breaches/) of data breaches (up from 66% in 2016).

Tracking and securing your customer data is essential to maintaining integrity; however, if you're processing any data of EU citizens, it is also critical for complying with _[GDPR](https://auth0.com/gdpr)_. With fines for non-compliance being [up to €20 million or 4% of the global annual revenue](https://auth0.com/gdpr) (whichever is greater) — even if your team is an industry leader, the financial and reputational costs of thieves stealing this sensitive information could be a hard recovery.

## Go beyond customer identity and access management: think platform identity and access management

Many companies have yet to make the investment to modernize — regardless of industry. Consumer packaged goods and automotive companies, for example, lag furthest behind — only completing 31% and 32% of the digital shift they need, according to [recent research from McKinsey](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/the-case-for-digital-reinvention).

The separation between those that have made the right updates and those who haven't is stark: as digitization sweeps through all industries, McKinsey finds that companies in the top quartile of modernization will [capture disproportionate gains](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/the-case-for-digital-reinvention), while those in the bottom quartile will see increasingly depressed revenue and profit growth. The gap will continue to widen.

CIAM can help ensure your team is a leader within its peer group by improving your interactions with customers.

While customer identity and access management is a critical component of a digital shift, it cannot solve all of your organization’s needs. Companies must consider B2B, B2E and IoT use case scenarios as well. A combination of CIAM with B2B or B2E use cases, in particular, can help you achieve and maintain an industry-leading position.


Why Customer Identity and Access Management is Critical to Digital Success

Facebook’s involvement with Cambridge Analytica offers organizations a cautionary tale about the impact of data breaches.



Last week’s revelations that [Cambridge Analytica](https://www.theguardian.com/news/2018/mar/20/facebook-data-cambridge-analytica-sandy-parakilas) improperly accessed Facebook data belonging to millions and used that data to influence the 2016 U.S. presidential race and Brexit vote raised global ire and sent Facebook’s stock into a $50 billion wipeout.

Over the past several years, [governments and individuals](https://auth0.com/blog/gdpr-effect/) have signaled a growing impatience with data breaches and a desire for organizations that treat them blithely to pay for their inattention and lack of cybersecurity. Especially given that reports are suggesting that Facebook [poorly monitored third-party developers access to data](https://www.theguardian.com/news/2018/mar/20/facebook-data-cambridge-analytica-sandy-parakilas), had the Cambridge Analytica breach occurred after May 25, 2018 — when [GDPR](https://auth0.com/gdpr) comes into force — it could have cost Facebook [4% of its annual revenue](http://www.businessinsider.com/r-privacy-issues-emerge-as-major-business-risk-for-facebook-2018-3) or $1.62B based on 2017 numbers.

![Facebook poorly monitored third-party developers access to data](https://images.ctfassets.net/23aumh6u8s0i/3mJHKCCl8u3aGjWzRecUgp/7e032268d5ed19cc521292ddc07c3663/data-mining)

<include src="TweetQuote" quoteText="Facebook and Cambridge Analytica offer a cautionary for organizations leading up to GDPR."/>

Five days after the breach announcement, Facebook Founder Mark Zuckerberg finally [broke his silence](https://www.cnbc.com/2018/03/21/zuckerberg-statement-on-cambridge-analytica.html), claiming that much of the problem had already been addressed years ago, while laying out a plan to investigate data that could have been leaked via other third-party apps. Absent, however, was any response to Ex-Facebook Insider Sandy Parakilas’s [claims](https://www.theguardian.com/uk-news/live/2018/mar/21/facebook-whistleblower-gives-evidence-to-mps-on-cambridge-analytica-row-live) that Facebook could have stopped these breaches much earlier.

Facebook’s Chief Information Security Officer (CISO) [Alex Stamos](https://www.nytimes.com/2018/03/19/technology/facebook-alex-stamos.html) has announced his departure also citing leadership differences around the Cambridge Analytica breach as well how the company handled Russian interference in U.S. elections via Facebook’s platform.

![Mark Zuckerberg finally responds to Cambridge Analytica data breach](https://images.ctfassets.net/23aumh6u8s0i/66x6zibKyk3dWvPsUB2Ix2/8c7761ec64ee87f78036b98e75316170/mark-zuckerberg)

Five days after the breach announcement, Facebook Founder Mark Zuckerberg finally [broke his silence](https://www.cnbc.com/2018/03/21/zuckerberg-statement-on-cambridge-analytica.html) (shown here during his F8 developer conference keynote).

By March 20th, Zuckerberg had seen his personal net worth decline by more than $5 billion in the days since the breach announcement, but Marketwatch reports that it could have been worse. [This year, Zuckerberg has already sold nearly $1 billion of Facebook stock](https://www.marketwatch.com/story/zuckerberg-saved-tens-of-millions-by-selling-facebook-stock-ahead-of-monday-decline-2018-03-19). But while the Cambridge situation grabs headlines as well as calls for Zuckerberg to appear before the U.S. Congress and British Parliament, investigations are underway in [New York and Massachusetts](https://www.washingtonexaminer.com/news/new-york-massachusetts-investigating-facebook-over-cambridge-analytica-scandal) and a Facebook [user class action lawsuit](https://www.classaction.com/wp-content/uploads/sites/33/2018/03/Price-v-Facebook-Complaint-watermarked.pdf) has already been filed. On March 21, [India suspended Cambridge Analytica's](http://www.bbc.com/news/world-asia-india-43482391) local website and issued a public warning to Zuckerberg stating that the site remained welcome in the country, but there would be consequences if Facebook colluded in the data theft of Indians.

Despite all of this action, [analysts](http://markets.businessinsider.com/news/stocks/facebook-stock-price-next-overhang-2018-3-1018995965) are saying that regulation is an even bigger threat to Facebook, with possible ad revenue losses on the horizon due to impending data privacy restrictions. Europe has also been historically stricter with the company than other parts of the world. With breach notifications of 72 hours and harsh fines, GDPR will offer a potential revenue-blocking hurdle come May.

<include src="TweetQuote" quoteText="In a little over two months, the Cambridge Analytica breach could have cost Facebook as much as 4% of its revenue."/>


Cambridge Analytica and Facebook: A Cautionary Tale As We Near GDPR

When your data isn't organized, you lose your competitive advantage as an organization


Imagine your customer support (CS) team receives an angry complaint from a particular user, R. Michaels. R. Michaels was charged for your company’s service although he was sure he canceled it. He says he's going to file a chargeback with the credit card company, at additional cost to your firm — and complain on Twitter.

Meanwhile, your growth team is preparing an email to a segment of its most active and engaged users, of which one is “Ronald Michaels.” The email has the cheeky subject line, “How's our favorite customer doing this morning!?”

Unfortunately, the email meant for Ronald Michaels—thanks to a data integration error—goes instead to R. Michaels (angry CS case).

Since your CS team still hasn't gotten back to R. Michaels, this sets him off even more and leaves your CS team frustrated that they've been put into an even worse position with the customer. R. Michaels goes ahead and publishefs his scathing online review of your team's incompetence.

<include src="TweetQuote" quoteText="With proper data management and integration, you don't need to worry about mixed messages."/>

With proper data management and integration, you don't need to worry about such mixed messages. But the true benefits of strong data integration go far beyond avoiding embarrassing situations—used right, a strong data integration plan can be the foundation of better customer engagement and higher revenues for your business.

## What is Data Integration?

Data integration is the process of combining information from separate databases into a usable form for sharper analysis. When you have a strong data integration plan, you can get a [true 360 view](https://auth0.com/blog/360-view-of-customer-by-managing-identity/) on your customers without having to pay an expensive outside agency or rebuild all of your infrastructure from scratch. That's not all, however—a strong data integration plan can also help you get users engaged with your product faster.

Imagine you're a young fintech company rolling out a big new feature update on your advisory platform. You're particularly interested in how your female millennial customers use it, so you email every user enrolled on your platform as a woman, A/B testing your emails to see which combination of value proposition and headline get the most click-throughs. Once that test is done, you analyze the user response, segmenting by social channel and user activity types:

* Did your Facebook fans or Twitter followers use your new features more often?
* Were users who are more active on your help forum more likely to share the news of the new features with their friends, or less?
* What about users who submit more or less help tickets?

Every team at your company uses this data to understand something about your user base:

* Finance: which user cohorts are the most valuable to pursue in the future?
* Growth: which kinds of future experiments could be most powerful?
* Marketing: which future promotional campaigns could be most effective?
* Customer Service: how to create better documentation for new users.

A full picture of a single user includes data from her Facebook likes, Twitter mentions, Instagram posts, along with other pieces of her life the Web has captured, including college or university major, graduation date, shopping history, and more.

It also includes every action they take on your app, and when; how long
they've been using it; and/or how long they've been churned for. It includes every email they've received, and whether they've opened them or clicked through or not.

Each of these pieces of data lives in a different format—once you can bring them all together, however, you unlock a world of huge possibilities.

## Why Data Integration Is Critical

As both examples illustrate, a data integration strategy is key to deeply understanding your user base, along with avoiding miscommunication and other costly errors. With the right tools in place, a myriad of new opportunities will open for your organization.

<include src="TweetQuote" quoteText="A data integration strategy is key to deeply understanding your user base, along with avoiding miscommunication and other costly errors."/>

You can:

### Personalize your experience

A data integration plan, working alongside a tool, such as social login, can have enormous benefits. While many see social login as just a simpler method for logging in, the real power of this approach lies in the data, which social login pulls at each step of the process to tailor the experience to the individual user.

<p>
<img alt="Personalize your experience" src="https://images.ctfassets.net/23aumh6u8s0i/5Acu0OjZF9a18zijtnbRyP/1fe70cf82e9dc972b351fd9c7b37dcfb/messenger-and-chat-bot" style="width: 500px; display:block; margin: auto;" />
</p>  

A well-functioning social login process can help improve customer conversion rates, rapidly move users to activation, and drive down any churn to help re-engage and retain existing users. The ability to expand and enhance the quality of your user base is critical to sustainable growth and building your brand.

### Smooth any onboarding friction

Users don't feel like making yet another account with yet another password. You need sign-up that reduces friction and helps people get directly to your product.

<p>
<img alt="Smooth any onboarding friction" src="https://images.ctfassets.net/23aumh6u8s0i/6RHgVvj7xNihIN2yzgyNyj/4034e9407c8a9e65647554530ba47eba/what-is-social-login" style="width: 200px; display:block; margin: auto;" />
</p>  

Social login has the ability to boost your conversion by up to [20%](https://www.quora.com/What-impact-does-social-login-have-on-conversion-rates). With [Auth0](https://auth0.com/docs/identityproviders), you can pull data from someone's social profile directly into their user profile. This bypasses people filling in arduous questions about their location and birthday, for example. A strong set of data integration tools is essential to create this transition.

### Increase internal data security

Data integration ensures that the information your organization collects is accessible in digestible forms to the right people. Yet do thousands of company employees need access to a select batch of sensitive files? If your identity and access management (IAM) processes are poorly controlled, can you prove that your company data is not at risk?

<p>
<img alt="Increase internal data security" src="https://images.ctfassets.net/23aumh6u8s0i/4fDg1ZbuaJA2akaGBwOhYL/4cb0af9e46c3a489a1365aaf7302e0d9/data-security-in-the-information-age" style="width: 700px; display:block; margin: auto;" />
</p>  

The right data integration strategy will be built on IAM tools, such as those belonging to [Auth0](https://auth0.com/learn/cloud-identity-access-management/). With these, you can authenticate, authorize, and track users of your data at all times, and set [rules](https://auth0.com/docs/rules/current) to comply with your usage policies. For example, you can create rules that define specific times, locations, and devices your users may log in.

## Tools For Data Integration

The data integration process requires standardizing multiple forms of information. This often breaks down into:

* Extracting the data: pulling it from its source system and converting it into a single, consolidated data warehouse format.
* Transforming it. This can involve cleaning (e.g., mapping NULL to 0), filtering, splitting columns, and/or applying business rules to calculate new dimensions.
* Loading transformed data into a  repository for analysis.

The below are a sample of popular tools for integration (although by no means an exhaustive list).

### Segment

[Segment](https://segment.com/) is a single platform, which quickly collects, stores, and routes user data to hundreds of tools with a simple click. It can be critical for all segments, which rely on this data, including analytics, marketing automation, email, user testing, error reporting, and support.

![Segment Flow](https://images.ctfassets.net/23aumh6u8s0i/2AtqnBruaeY7xroq5ykjYS/360ed268431bff8649e305d6b79079c8/segment-auth0-flow)

With Segment, engineers can eliminate time spent installing and maintaining analytics tools, marketers are able to quickly test campaigns, and BI teams have the capacity to export raw data into their internal systems and databases.

### mParticle

As with Segment, [mParticle](https://www.mparticle.com/) collects data from a range of inputs, such as the Web, mobile apps, and feeds from external SaaS providers, and forwards it to output services for audience targeting and push notifications, attributions, storage, and further analytics.

![mParticle](https://images.ctfassets.net/23aumh6u8s0i/2lchvs0bqj1qGtBeR3ZolS/b9c7ca905271e35eeb708f1e6045c28d/mparticle)

mParticle focuses on two types of inputs: events (how users interact with an app) and audiences (a focus on a specific segment of app users, such as women who have invested more than $10,000 on your app). mParticle’s creation of Connections between these inputs and outputs facilitates the enrichment and transformation of data prior to being put to use.

### Clearbit

[Clearbit](https://clearbit.com/) has provided its services to a range of tech companies, such as Asana, Braintree, Slack, Stripe, Zendesk, and more. It offers its customers nearly a dozen APIs to mine publicly available data sources  for information on individuals and companies.

![Clearbit](https://images.ctfassets.net/23aumh6u8s0i/1dSy9DGvaBJRy8D1nKjQ4b/c48562ed0d1768d221a412e73da33da9/clearbit)

Clearbit allows developers to incorporate this data from a variety of sources into their organization’s apps and build customized tools. In addition, marketing teams are able to easily integrate these points into a fuller picture of their target audiences.

## To Secure and Hone Your Analysis, Employ An Excellent Data Integration Plan

Data management and integration can both help ensure regulatory compliance if you hold sensitive user data and support your teams in developing sharper insights. In turn, this can allow more targeted marketing and other forms of direct engagement with your community, leading to stronger sales and better overall growth.


3 Reasons Your Data Integration Plan is Important

Here are 5 trends that will help you keep your organization secure in 2018.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

**TL;DR:**  It's easy to predict the security threat for 2018 (Hint: It will be bigger and more sophisticated than 2017). It's another thing to prepare for what lies ahead. Here are 5 trends that will help you keep your organization secure in 2018.

<include src="TweetQuote" quoteText="Here are 5 trends that will help you keep your organization secure in 2018"/>

[GDPR compliance](https://auth0.com/gdpr) is dominating the 2018 security discussion. With the May 25th deadline quickly approaching, the first half of 2018 will likely be consumed with making the necessary changes for compliance, which is an enormous task for any size company.

While GDPR is extremely important and failure to comply comes with [stiff penalties](https://resources.auth0.com/whitepaper/gdpr-fine-determination/), don't let it distract you from anticipating the security threats that await your organization. If you thought 2017 was a massive year of cyber attacks, there are unfortunately no signs of slowing down in 2018.

Here are our 5 security predictions to help you prepare for 2018.

### 1. Customers Are Fed Up With Passwords

The weaknesses of traditional credentials are well documented, yet most organizations continue to use them as the primary security method. Customers have had enough.

The Equifax breach was the straw that broke the camel's back. While security experts have known of the vulnerabilities of password reliance, the high-profile breaches of 2017 have brought a higher level of awareness to the general public.

People want security alternatives. A recent [survey](https://www.csoonline.com/article/3242866/security/our-top-7-cyber-security-predictions-for-2018.html) showed that people are now more concerned with someone stealing their personal data than they are with a home break-in. A company's reluctance to add stronger authentication will have to deal with fierce customer demand for additional security beyond the password.

The first logical step to strengthening traditional credentials is to implement [multifactor authentication](https://auth0.com/docs/multifactor-authentication) (MFA).

![Multi-factor Auth](https://images.ctfassets.net/23aumh6u8s0i/4n9ZcXraMMRDtcmRwG04bn/5aee12138b7dee3679d1ec18cdb246e4/Multifactor-Authentication)

MFA is a method used to verify a user's identity when they are trying to access an application. In addition to a password, MFA requires you to provide additional information such as an SMS code or a fingerprint to confirm your identity.

Consumer-oriented companies like Google, Apple, and PayPal have made MFA a standard feature and the trend will continue in 2018 with both consumer and enterprise accounts.

### 2. Preventing Aftershock Breaches

Companies that are breathing a sigh of relief that they weren't hit by a cyber attack in 2017 need to worry about a different type of threat — the aftershock breach.

The millions of compromised credentials taken from previous breaches now pose a liability for every company that uses passwords for security (which is everyone). Most people use the same credentials for all of their accounts, which heightens this risk of an aftershock breach, where hackers use the stolen credentials to access other accounts.

Experian's recent Data Breach [Report](https://www.experian.com/assets/data-breach/white-papers/2017-experian-data-breach-industry-forecast.pdf) notes:

> Given the continued success of aftershock breaches involving username and passwords, we predict that attackers are going to take the same approach with other types of attacks involving even more personal information, such as social security numbers or medical information.

Aftershock breaches can be minimized by using risk-based authentication, such as[ anomaly detection](https://auth0.com/docs/anomaly-detection) which monitors user behavior data to determine suspicious activity. By[ collecting signals](https://auth0.com/university/1/4/how-to-use-auth0-s-rules-feature) such as an IP address or the location of a user, anomaly detection can compare previously established behavior in order to spot inconsistencies.

![Password Breach Block](https://images.ctfassets.net/23aumh6u8s0i/3UQfTsXEnWW38EvMxQ7VvM/881ab7f175259a79750d7aafd6837fd3/breached-pass-lock)

Auth0's anomaly detection also tracks [password breaches](https://auth0.com/breached-passwords) of major third-party sites to help keep your users and systems secure. When a company like Equifax is breached, you can block your users from logging into your accounts until they go through a new authentication protocol.

When combined with MFA, anomaly detection makes it really hard for hackers to leverage their stolen credentials and initiate an aftershock breach.

### 3. Weaponizing Data Rather Than Stealing It

A few years ago, someone hacked into the Associated Press' Twitter account and tweeted a false report that President Obama had been injured in an explosion. The news caused a 150-point drop in the stock market.

![Source](https://images.ctfassets.net/23aumh6u8s0i/4Z7i4HQDeGCtb9UE1oVoKg/edc28deb72bca4907cd0af23e55c8b53/67201644_ap)

This type of data manipulation, known as a data integrity attack, will become more prevalent in 2018. While stealing millions of credit card numbers might seem like a huge score, it only works if you have a buyer on the other end. Hackers are realizing that it is much easier to capitalize on the data itself.

For example, an attacker could doctor a bank's routing numbers for a large financial gain. Or, one could erode public confidence by shutting down electrical grids. Regardless of the intention, the new target is in using the data, not stealing it.

Integrity attacks are hard to detect, which could leave companies defenseless with their current monitoring systems. The immediate solution to this threat is [data encryption](https://digitalguardian.com/blog/what-data-encryption). Most companies have an encryption policy that protects their most sensitive data, but the definition of sensitive data must be expanded to protect all potential attacks.

![Source](https://images.ctfassets.net/23aumh6u8s0i/1L5kShBmyTcdpOSeANibPA/161401f1ab2aa62f9563ce6668e6cabd/data-encryption)

The idea behind data encryption is to make your data incoherent to outsiders without the decryption key. **Why does this matter?**

The breaches in the past five years have shown that hackers can infiltrate the most sophisticated cyber security systems in the world. Traditional security like firewalls, intrusion monitoring and antivirus software are not very effective once hackers get inside. The last line of defense is to encrypt your data.

### 4. Rise of the Bots Against IoT

Bots are supposed to be our friends. They take care of the tedious, repetitive tasks so we can focus on the more important work. **But what happens when bots turn to the dark side?**

In 2016, a [botnet](https://www.csoonline.com/article/3240364/hacking/what-is-a-botnet-and-why-they-arent-going-away-anytime-soon.html) of more than 500,000 devices [attacked ](https://en.wikipedia.org/wiki/2016_Dyn_cyberattack) Dyn, a domain name service providers, crippling the internet and impacting huge websites like Amazon, Spotify, and Netflix. These types of attacks are often executed through internet-connected devices, and the threat for 2018 has never been greater.

![Source](https://images.ctfassets.net/23aumh6u8s0i/2XSmrlVo479am1wBxhs8PQ/b6429c8a47e75c0c1c6dc646fde06a9c/botnet2_1238990)

IoT is expected to surpass 10 billion devices in 2018 and over [22 billion by 2021](http://uk.businessinsider.com/the-internet-of-things-2017-report-2017-1?r=DE&IR=T). Every one of these devices poses a security risk as the surface area for an attack expands well beyond what current security measures can handle. In fact, [HP](http://www8.hp.com/de/de/hp-news/press-release.html?id=1744676#.WMFmT1XyiUk) found that at least 70 percent of IoT devices are vulnerable to an attack.

Hackers can simply buy a botnet kit, which gives them everything they need to launch an attack. The three most popular kits—Andromeda, Gamarue, and Wauchos—have already helped attackers infiltrate millions of devices. Once inside, the bots are capable of a myriad of debilitating tasks from taking down networks to compromising data or even controlling a device. **It will make you think twice about who is driving your self-driving car.**

### 5. Phishing is Still King

Major data breaches, ransomware attacks, and identity theft often start the same way—with a simple phishing scheme.

Phishing is still the most effective method for attackers to infiltrate a system, mainly because it relies on human error, which renders technical security useless. The only real defense is to train people to identify schemes and remain aware at all times.

While awareness will help prevent traditional phishing, attackers are creating more sophisticated techniques to outsmart the uneducated. They've also found success with other channels beyond email like phishing with SMS, also known as smishing.

![https://images.ctfassets.net/23aumh6u8s0i/6CsaSx8Zo8BWwel3zXoo5V/e4e81b69fc9360fd19c5471d3d439482/phishing-bank](https://images.ctfassets.net/23aumh6u8s0i/6CsaSx8Zo8BWwel3zXoo5V/e4e81b69fc9360fd19c5471d3d439482/phishing-bank)

Smishing scams are harder to detect because they take advantage of people's sense of urgency. Let's say you receive a text that appears to be an important message from your credit card company. An urgent message can catch you off guard and before you know it, you've compromised your information.

Awareness training becomes more difficult with smishing because of its heightened nature. You can't always prevent someone from being tricked by phishing, but you can anticipate it and secure your accounts beyond credentials. Password managers like [1Password](https://1password.com/) can be useful, but adding more layers of defense with MFA will help keep your accounts safe.

## Security in 2018 is About Proactive Prevention

Sadly, many of the breaches in 2017 could have been prevented with stronger security measures, especially around identity access management. Archaic methods like passwords and unprotected data made it easy for hackers to pull off some of the biggest heists of 2017 including corporate giants like Equifax and Deloitte.

The attack tactics might evolve, but at the end of the day, taking proactive measures will help deter the majority of attempts. By understanding the different threats, you can get ahead of them before they occur.

**_READ MORE:_**  [How Poor Identity Access Management Equals Security Breaches](https://auth0.com/blog/how-poor-identity-access-management-equals-security-breaches/)


Security Predictions for 2018 That Go Beyond GDPR Compliance

Learn how DMI practices will help you organize and make sense of all your valuable data.



Chocolate soufflés are just like data-driven insights — they are rich, transformative and really hard to create.


Anyone who has attempted to make a soufflé knows that in order to make it right, you must follow the recipe exactly, prepare the ingredients properly and be methodical with every step of the process. When prepared correctly, a soufflé is magical, but if there is one small error, the whole thing ends in disaster.

![Chocolate Souffle](https://images.ctfassets.net/23aumh6u8s0i/4368Gm8NvfAkcMW0WxYuA6/9ec2c491c9e8b3d6b2576fa145caca69/Chocolate-Souffle)

Generating insights from your data works the same way. If you don't have a standard process in place to ensure your data is accurate, usable and secure, your insights will be worthless and even misleading. But unlike the ingredients of a soufflé, managing data is extremely complex and the likelihood of making an error is high.

Leveraging the full value of your data and avoiding costly mistakes starts with a data management and integration (DMI) strategy. Simply put, DMI is a set of policies and procedures meant to provide the right people with timely access to accurate data.

With different types of data now coming from hundreds of internal and external sources, the potential for game-changing insights within your company is only matched by the nerve-racking potential for data chaos.

DMI is more important than ever, so we've broken down the four pillars of data management and integration to get you started.

## Data Governance is the Recipe for DMI

You can't make a great soufflé without a clear and detailed recipe that describes exactly how to prepare the ingredients, put them together and bake the final product.

Successfully managing your data starts with a “recipe” called data governance. The role of data governance is to establish **standard policies and procedures** across the organization that set the parameters for managing all of your data.

A comprehensive data governance plan defines user rights, security policies, and monitors the technologies used to implement the various data procedures.

Data governance is the blueprint on how your company manages its data, focusing on three areas: people, policy, and technology.

![Governance](https://images.ctfassets.net/23aumh6u8s0i/4gLSGnF0mR454K2s8QKImk/54823fd9be8fc9b7a79daebb2dc43e58/governance)

Data analysts currently waste most of their time, up to [80%](https://www.forbes.com/sites/gilpress/2016/03/23/data-preparation-most-time-consuming-least-enjoyable-data-science-task-survey-says/#10a8aa6a6f63), identifying and processing data to use before doing any analysis. Good data governance should alleviate this by providing the plan and structure for data to be secure, easily found, and shared among people with the appropriate permissions.

## Quality Ingredients Always Make the End Product Better

A soufflé is actually not that hard to make, *if* you know how to prepare the right ingredients. For example, the most important ingredient is egg whites, but if the egg whites have any traces of egg yolk, your soufflé will fail.

Most people don't think about the quality of their data, but, like the tainted egg whites, if your [data is dirty] (https://en.wikipedia.org/wiki/Dirty_data) your insights will not be trustworthy.

![Data Management](https://images.ctfassets.net/23aumh6u8s0i/4z1yTiOftIgvmejYH3EyDk/9ba06ca96b9da640b8da5b495b2c5e55/005b)


Dirty data, such as data with spelling errors or data placed in the wrong field, is a big problem that often goes unnoticed. The power of your analysis is only as good as the [quality of your data](https://www.interana.com/blog/understanding-value-data/). If your data is 99% accurate, your insight might be dead wrong.

Without data management and integration policies in place to ensure data quality, you will almost certainly have costly data inconsistencies. Let's say your customer service team receives a complaint from D. Smith, while your marketing team is sending a promotion to a David Smith at the same time. You'll look incompetent sending conflicting messages to the same person.

Beyond setting policies, a DMI program should include a [data cleansing](https://en.wikipedia.org/wiki/Data_cleansing) process to remedy some of these issues. Data cleansing [tools](https://www.quora.com/What-are-the-best-data-cleansing-tools), such as OpenRefine, reconcile and remove duplicate or incomplete data points.

Your data is generated across dozens of touchpoints, which increases this risk of duplication and redundancy. With a DMI approach that ensures your data is clean and ready for use, you will have the confidence to make decisions based on your analyses.

## Integration Tools Prepare the Data for Analysis

When you are following a recipe, it is sometimes tempting to skip the instructions and mix all the ingredients together at the same time. If you've done this then you know it never ends well.

Integrating your data is exactly the same. Your data that is coming in across all your applications and legacy systems are not compatible. While you need to combine some of it to run your analysis, you can't just throw it all together willy-nilly and expect accurate results.

Data integration is a complicated endeavor when you consider all the structured and unstructured data available to analyze.  There are no one-size-fits-all approaches to data integration, but there are several tools to help automate the integration process of matching, cleaning, and preparing data for analysis.

![Data Integratoon Process hEE](https://images.ctfassets.net/23aumh6u8s0i/fTjgUPukSCgiDrmvN9Qll/59345cef4e80374d78dfe04fe7199fb7/Data-Integration-Process)

Data integrations are complex and technical, but at the core are three steps are known as ETL: extraction, transformation, and loading.

* **Data extraction** is when data is collected from all of the various data sources.
* **Data transformation** is the process of transforming all of your data into a compatible format, often with the help of a universal [data model](https://en.wikipedia.org/wiki/Data_model) that defines the datasets with common properties.
* **Data loading** is when the right data is loaded into the appropriate database, ready for analysis.

You have so many sources of valuable data, but you can't just throw them in an analytics tool and hope to make sense of it all. Your data management and integration strategy should identify the approach and tools necessary to implement a successful integration.

When the ingredients are prepared and combined properly, your chances of accurate insights and a successful soufflé go from good to great.

## Protect Your Soufflé at all Costs

After painstakingly preparing your soufflé, you don't want any unauthorized people in the kitchen to mess with it. If you turn your back for one second and someone opens the oven door, both your soufflé and your mood will be deflated.

A core pillar of DMI is data security. Not a week goes by without news of a massive data breach that compromises the personal information of millions of people. Traditionally, companies kept their data safe by securing their perimeter, but data now comes from the outside and employees access sensitive data with devices beyond the firewall.

One of the biggest data risks within your company has to do with [access management.](https://auth0.com/user-management) A recent survey found that [47%](https://blog.varonis.com/2017-varonis-data-risk-report-47-had-at-least-1000-sensitive-files-exposed/) of companies had at least 1,000 sensitive files open to every employee. Unintentionally giving too much access to employees is a very common problem with dire repercussions.

![Data Management - Safe](https://images.ctfassets.net/23aumh6u8s0i/43xjpaSKCyPI3mffYE2w0X/2e922d7cd0ef8168059f7495a44592f4/CKGRI2qLmwKrQDrWsCXeXA_s_UHW7A8Vnf25t)
_[Source](https://www.observeit.com)_

U.S. retailer, Target, had a data breach where over 40 million credit cards including pin numbers were stolen. While there were many reasons for the breach, a [_report_](https://krebsonsecurity.com/2015/09/inside-target-corp-days-after-2013-breach/) identified that too many people had access to sensitive data, including remote contractors.

Your DMI policy should determine user access across the enterprise, but when you have hundreds or even thousands of potential users, how can you keep track of everyone?

Identity and access management (IAM) tools, like [_Auth0_](https://auth0.com/learn/cloud-identity-access-management/), are designed to help you manage access to your data. You can authenticate, authorize, and track users that interact with your data at all times and set [rules](https://auth0.com/docs/rules/current) to comply with your data management policies.

For example, your IAM tool enables your team and contractors to access data remotely on any device by adding extra security measures such as [automated logouts](https://auth0.com/docs/logout) and [multifactor authentification.](https://auth0.com/docs/multifactor-authentication) Even if a device is lost or stolen, the data will be secure.

## To Generate Data-Driven Insights, Follow the Recipe

In the same way that a perfectly prepared soufflé can transform a dinner, [data-driven insights](https://datahero.com/blog/2017/07/31/data-driven-decision-making-skills/) can give your business a competitive advantage that takes your business to a new level.

When you have DMI policies and procedures in place to make sure your data is accurate, accessible and secure, you will realize the power of your data and make decisions with confidence.


All you need to know about Data Management and Integration (DMI)

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

A global cyber-attack using leaked NSA tools is targeting organizations worldwide including UK's National Health Service, Spain's Telefonica telecom, and many more.



A ransomware, called [**WannaCry**](http://money.cnn.com/2017/05/12/technology/ransomware-attack-nsa-microsoft/), is making rounds across the globe and infecting vulnerable systems worldwide. Amongst the affected include FedEx, UK's National Health Service, Spain's Telefonica telecom, Russia's Interior Ministry, and many more. Hackers exploiting leaked NSA secrets and tools are said to be behind the massive attack, although no specific group has been identified as of yet.

The **WannaCry** ransomware encrypts a computer's file system and demands payment to restore access to the files. If a payment is not made in 7 days, the ransomware will delete all of the files on the machine. The attack, circulated initially through email, targets Windows machines that have not received the March 2017 security update where Microsoft fixed the vulnerability that makes this particular attack possible.

![WannaCry Ransomware](https://images.ctfassets.net/23aumh6u8s0i/5uOAgDiG784chdydy4fMHI/e1f7f71a48912fd9ba6396731004ec71/wannacry)

Ransomware attacks are nothing new. In 2016, a [Los Angeles hospital paid $17,000](https://www.nytimes.com/2016/02/19/business/los-angeles-hospital-pays-hackers-17000-after-attack.html) to regain access when hackers seized control. In fact, in our [Security Trends for 2016](https://auth0.com/blog/security-trends-for-2016/), we mentioned that **cyber extorsion** is likely to evolve and keep security specialists up at night, and we hate that we were right. The **WannaCry** cyber-attack is looking to be one of the biggest attacks recorded!

The **WannaCry** cyber-attack has been reported in 99 countries and over 75,000 attacks have been carried out so far, but perhaps the most concerning is the attack on UK's National Health Service (NHS), as it has life-or-death implications. An important thing to note is that these numbers are only from victims that have self-reported the attack, which means that the scope of this cyber-attack is most likely larger than reported.

Companies can protect themselves and their users agains cyber-attacks by developing strong incident response capabilities to complement their traditional security measures. As prevention can not be successful everytime, being capable of detecting and responding to incidents quickly is crucial. For individuals, the best way to prevent becoming a victim of ransomware and other cyber-attacks is to always keep your operating system up-to-date by enabling automatic updates. It may be annoying to see the *"You need to restart your computer to apply updates"* message, but a 5-10 minute downtime beats losing years worth of data.

## Personal Information Security Guide

Although you may not be affected by the **WannaCry** ransomware, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, detecting phising scams, backing up data, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

Be sure to check out the [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) to learn how to secure your wireless network, backup your data so that it is not lost if you become a victim of ransomware such as **WannaCry**, detect phishing scams, and more.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


A Massive Ransomware Attack Targets Organizations Around the Globe

Bluetooth, a standards based organization, chooses Auth0 to implement standards based authentication via OpenID Connect and OAuth for improved security, access, and interoperability.



**BELLEVUE, WA** - [Bluetooth Special Interest Group](https://www.bluetooth.com/) (SIG), a standards based organization that oversees the development and licensing of Bluetooth technologies, has chosen Auth0 to implement standards based authentication throughout their organization. Thanks to Auth0, Bluetooth was able to implement OpenID Connect and OAuth throughout their organization in record time, meeting the needs of today and also laying the foundation for future expansion.

![Bluetooth Website](https://images.ctfassets.net/23aumh6u8s0i/5WAxWlxKMK57zildCrXUv/34eba0420e66aa592dcd657e76c42f2e/site)

Auth0 was chosen not solely for technological capability, but also for state-of-the-art security, top-notch documentation, excellent customer support, and a superior licensing model that was a right fit for Bluetooth. Auth0 allowed Bluetooth to keep their existing infrastructure in place, while adding the standards based authentication layer on top. This allowed the Bluetooth engineering team to quickly implement the solution across multiple disparate apps.

> “Being a standards based organization, it was important for Bluetooth SIG to implement a standards based identity solution for our platform.”
– Jeremy Syme, Director of Systems Engineering

Read the [case study](https://auth0.com/learn/bluetooth-case-study/) to learn more about why Auth0 was the right fit for Bluetooth.

<include src="asides/AboutAuth0" />


Bluetooth Chooses Auth0 to Implement Standards Based Authentication

ryan-chenkie

Ryan is a full-stack JavaScript developer and trainer who mainly works with React, Angular, Node, and GraphQL. He runs a consultancy where he builds apps for companies and also helps established dev teams with their modern JavaScript challenges.<br /><br />Ryan is a Google Developer Expert, the host of the Entrepreneurial Coder Podcast, the author of Securing Angular Applications, and an all-around fanatic about application security.

Developer

Ryan Chenkie

Learn about Angular 2's new Dependency Injection system and how to use models to organize your app.

---

**TL;DR:** Domain models are important for defining and enforcing business logic in applications and are especially relevant as apps become larger and more people work on them. In this article, we show how this can be done in an Angular 2 app by moving logic out of the component and into a model. We also cover how to inject model classes using Angular 2's new Dependency Injection system. Check out the [repo](https://github.com/auth0/angular2-models-di) for the article to see the code.

This is the second part of our Angular 2 series. You can also check out the first part about [Angular 2 pipes](https://auth0.com/blog/2015/09/03/angular2-series-working-with-pipes/).

---

> Auth0's Angular 2 series brings you tutorials on how to implement the latest features from the framework using the most recent Alpha release at the time of writing.

As applications grow in size, it becomes increasingly important that they be well organized with a solid structure in place. This is especially critical as increasing numbers of developers are added to the team. Application architecture should also strongly focus on the business rules that govern the application and protect sensitive methods from being exposed where they shouldn't be.

<include src="TweetQuote" quoteText="As applications grow in size, it becomes important that they be well organized with a solid structure in place"/>

At the same time, it is important that we keep our applications DRY and maintainable by moving logic out of components themselves and into separate classes that can be called upon. A modular approach such as this makes our app's business logic reusable.  

One way we can achieve this type of structure in Angular 2 applications is by using models to organize our business logic. Whereas the term "model" in Angular has typically been used to refer to the View-Model, what we're discussing here is the domain model-or the set of rules and business logic that an application implements for it to adhere to the organization's needs.

The term "domain model" is, of course, a generic one. Domain models are relevant in any kind of application. In this tutorial, we will see how we can abstract business logic to a model in an Angular 2 app and use the new **Dependency Injection (DI)** system to call upon these models. We will also explore the DI system's features and various ways it can be used.

## Getting Started with an Angular 2 app

We'll be writing our app in TypeScript, but everything will work just fine in ES6. If you'd like an Angular 2 starter app in ES6, checkout [Pawel Kozlowski's](https://twitter.com/pkozlowski_os) [ng2-play](https://github.com/pkozlowski-opensource/ng2-play/) repo.

Our sample app will take a user's details as input and use a model to handle those values. Let's start with a simple component called `UsersAppComponent`.

```js
// app.ts

/// <reference path="typings/_custom.d.ts" />

import {Component, View, bootstrap, bind, FORM_DIRECTIVES} from 'angular2/angular2';
import {Inject} from 'angular2/di';

@Component({
  selector: 'users'
})
@View({
  // Form directives to be used in the template
  directives: [FORM_DIRECTIVES],
  templateUrl: 'userTemplate.html'
})

class UsersAppComponent {

  constructor() {}

}

bootstrap(UsersAppComponent);
```
Our template has some simple inputs for the user to provide their information, including checkboxes for them to select which programming languages they know.

```html
  

  <form role="form" #form="form" (ng-submit)="submit(form.value)">
    
    <input type="text" placeholder="Enter your name" [(ng-model)]="user.name">
    <input type="text" placeholder="Enter your email" [(ng-model)]="user.email">
    <h3>Languages</h3>
    <input type="checkbox" [(ng-model)]="user.javascript">JavaScript
    <input type="checkbox" [(ng-model)]="user.ruby">Ruby
    <input type="checkbox" [(ng-model)]="user.php">PHP
    <button>Submit</button>
  </form>
```

## Handling User Data

For our app, we'll want to take the user's input to see how it can be handled with a model. For simplicity, we'll just log the info to the console in these examples, but you would typically be doing HTTP requests to send the user data off to a server to be persisted.

We could set up a simple `User` class that acts as a model for our data and have some additional methods in our `UsersAppComponent` that act upon the form data. We can do this right within our component, but as will become evident later, there are some drawbacks to this. Let's see what it would look like for now. The class arrangement will be:

![angular2 models dependency injection](https://images.ctfassets.net/23aumh6u8s0i/6o3tJOtNbC96nlsVPqjeLs/a54fc2b4d2955d66f1b84410801b03d6/classes-at-start)

```js
// app.ts

...

class User {
  name: string;
  email: string;
  rating: number;
}

@Component({
  selector: 'users'
})
@View({
  directives: [FORM_DIRECTIVES],
  templateUrl: 'userTemplate.html'
})

class UsersAppComponent {

  // We instantiate the user class.
  user = new User();

  submit(userInfo) {
    // HTTP request would go here
    console.log(
      this.user.name,
      this.user.email,
      this.calculateRating(this.user)
    );
  }

  // Method to calculate the user's points
  calculateRating(userInfo) {
    var rating = 0;
    if(userInfo.javascript) {
      rating += 30;
    }
    if(userInfo.ruby) {
      rating += 20;
    }
    if(userInfo.php) {
      rating += 50;
    }
    return rating;
  }
}

...
```
We have two-way data binding set up on our form inputs, and they are bound to the instance of our `User` model. The `submit` method in our component's constructor logs the all the data to the console, including a calculation for the user's rating that it runs with the `calculateRating` method. How the heck did PHP get to be worth 50 points? I guess we'll never know.

## Improving the Model

While this approach works sufficiently well when an application is small, the way we have set things up does have a few drawbacks:

1. The `User` class isn't enforcing which values should be present or not. This can have implications if some operation downstream expects certain values to always be present.
2. The model doesn't have methods of its own to handle the calculation of the user's rating or the submission of the data. What if we wanted to have this same functionality in another of our app's components? We would need to duplicate the code in those other components.
3. While `calculateRating` is trivial in this example, what if we had some important and sensitive method with business logic that is meant only for specific circumstances? We need a way to be certain that such methods can't be used in places they're not supposed to be.
4. We currently have no ability to potentially share models with a JavaScript backend.

Let's see how we can tackle some of these issues. We'll start by moving the model to its own file. We'll eventually want to end up with classes that look more like this:

![angular2 models dependency injection](https://images.ctfassets.net/23aumh6u8s0i/2AZ4VJnqch6kcfIL6DlYlv/6fc64e402d51f1a5e9c12975324c0ac3/classes-at-end)


```js
// models/user.ts

export class User {
  name: string;
  email: string;
  rating: number;

  constructor(userInfo:any) {
    this.name = userInfo.name;
    this.email = userInfo.email;
    this.rating = this.calculateRating(userInfo);
  }

  private calculateRating(userInfo) {
    var rating = 0;
    if(userInfo.javascript) {
      rating += 30;
    }
    if(userInfo.ruby) {
      rating += 20;
    }
    if(userInfo.php) {
      rating += 50;
    }
    return rating;
  }

  save() {
    // HTTP request would go here
    console.log(this.name, this.email, this.rating);
  }
}
```

We're now using a constructor in our `User` method, which will set the values for `name`, `email`, and `rating` when the class is instantiated. We've got our `calculateRating` method in our class now, along with a `save` method to take care of making an HTTP request to save the data.

In our template, let's switch from using `ng-model` for two-way data binding to `ng-control` to get the form values when the form is submitted.

```html
  
  <form role="form" #form="form" (ng-submit)="submit(form.value)">
    <input type="text" placeholder="Enter your name" ng-control="name">
    <input type="text" placeholder="Enter your email" ng-control="email">
    <input type="checkbox" ng-control="javascript">JavaScript
    <input type="checkbox" ng-control="ruby">Ruby
    <input type="checkbox" ng-control="php">PHP
    <button>Submit</button>
  </form>
```

We can now modify the `UsersAppComponent` to instantiate and save a new instance of the model when the form is submitted.

```js
// app.ts

...

import {User} from 'models/user';

...

class UsersAppComponent {

  submit(userInfo) {

    // Instantiate and save when the form is submitted
    this.user = new User(userInfo);
    this.user.save();

  }
}

...

```

The model and the methods that it relies on are now in the same spot and can be used in other parts of the application as well. In the model, we specified that we want `calculateRating` to be `private`, but as it stands, we would still be able to gain access to it from outside the `User` model. This is part of [TypeScript's design](http://typescript.codeplex.com/discussions/451129), but we can put a workaround in if we really wanted to protect `calculateRating`. Although it might not work as an architectural approach in every situation, we could define `calculateRating` as a function within the class constructor, which would prevent it from being accessed elsewhere. The downside here is that the function is not available to other methods within the class.

```js
// models/user.ts

...

constructor(userInfo:any) {

  this.name = userInfo.name;
  this.email = userInfo.email;
  this.rating = calculateRating(userInfo);

  // Function is only available inside the constructor
  // when the logic really needs to be protected.
  function calculateRating(userInfo) {...}
}

...
```

## Moving to Factories

We've seen how we can instantiate a new model and access methods on it, but what if we wanted to take the factory approach? In this approach, instead of instantiating the model directly in our components, we would call a method like `create` on the factory. As applications grow and classes become increasingly complex, this can have certain advantages, especially for maintainability. For example, if we wanted to change the name of a class that gets instantiated, the factory approach allows us to make a change solely to the factory itself and not all the instantiation points around the app.

This is also where Angular 2's Dependency Injection comes in, as we'll need to inject the factory to make use of it.

```js
// models/userFactory.ts

import {User} from './user';

export class UserFactory {

  // Uses the User model to create a new User
  create(userInfo:any) {
    return new User(userInfo);
  }

}
```

We'll need to inject the `UserFactory` into our component's constructor. Angular 2 comes with an `@Inject` decorator, which is used to attach metadata to the component. We also need to include `UserFactory` in an array when the app is bootstrapped so that it is included as a binding.

```js
// app.ts

...

import {UserFactory} from 'models/userFactory';

...

class UsersAppComponent {
  userName: string;
  userRating: number;
  rating: number;

  // We inject the UserFactory
  constructor(@Inject(UserFactory) UserFactory) {  
    this.UserFactory = UserFactory;
  }

  ...
}

// We bind the UserFactory when the component is bootstrapped
bootstrap(UsersAppComponent, [UserFactory]);

```

With `this.UserFactory` pointing to the `UserFactory`, we can now make use of its methods. Let's adjust the `submit` method to use the factory.

```js
// app.ts

...

submit(userInfo) {
  this.user = this.UserFactory.create(userInfo);
  this.user.save();
}

...


```

Now when the user submits the form, `create` and `save` are called with the form data.

We can also use the model approach to get the data for the user that just submitted the form. For example, we could add a `get` method to the `User` class that returns (or in this case logs to the console) the user's data.

```js
// models/user.ts

...

get() {
  console.log(this.name, this.email, this.rating);
}

...
```

Then within the component we can create a `getUser` method to retrieve it.

```js
// app.ts
...

getUser() {
  this.user.get();
}

...
```

## More on Dependency Injection

We used the `@Inject` decorator to bring in `UserFactory` above; however, TypeScript also allows us to use type annotations, which means the constructor can be written as:

```js
// app.ts

...

constructor(UserFactory: UserFactory) {...}

...
```

The array syntax we used to bind `UserFactory` to our component is the shorthand way of doing it. We can also explicitly state what we want to bind to, which gives us the option of binding to other classes. For example, we could bind `User` to `UserFactory` directly.

```js
// app.ts

...

// The UserFactory can be bound to another name, in this case, User
bootstrap(UsersAppComponent, [bind(User).toClass(UserFactory)]);

...
```

With this, `UserFactory` becomes `User` when used in our component.

## Aside: Using Angular with Auth0

Auth0 issues [JSON Web Tokens](http://jwt.io) on every login for your users. This means that you can have a solid [identity infrastructure](https://auth0.com/docs/identityproviders), including [Single Sign On](https://auth0.com/docs/sso/single-sign-on), User Management, support for Social (Facebook, Github, Twitter, etc.), Enterprise (Active Directory, LDAP, SAML, etc.) and your own database of users with just a few lines of code. We implemented a tight integration with Angular 1. Angular 2 integration is coming as soon as it's on Beta! You can read the [documentation here](https://auth0.com/docs/client-platforms/angularjs) or you can checkout the [SDK on Github](https://github.com/auth0/auth0-angular).

<img src="https://images.ctfassets.net/23aumh6u8s0i/4PnRDegulvaccUIfNyaAtn/8342312355dc6af44a69c07c66f58be7/pub_w_1219_amp_h_559" style="border: 1px solid #ccc;padding: 10px;"/>

## Wrapping Up

It's important that thought be given to how applications are architected so that they are easier to maintain and can be collaborated on by more developers as team sizes grow. It's also important to protect business logic and keep sensitive methods from being accessed outside the class to which they belong. These effects can be achieved by moving logic into models.

Angular 2 gives us a new Dependency Injection system that allows us to inject classes into our components easily. We had a brief look at how the new DI system works, but for a more thorough overview, we recommend you check out [Pascal Precht](https://twitter.com/PascalPrecht)'s post on [Dependency Injection in Angular 2](http://blog.thoughtram.io/angular/2015/05/18/dependency-injection-in-angular-2.html).

"org"