Linda Gong

Linda Gong is a Product Marketing Manager for Orchestration at Okta, where she leads go-to-market strategy for Okta Workflows and Auth0 Extensibility. With a background in demand generations and marketing analytics, she brings a data-driven mindset to messaging, product launches, and driving adoption. When she’s not crafting product narratives, you’ll likely find her hunting down the best local coffee shops or planning her next travel adventure.

Product Marketing Manager

Auth0 + Sift integration delivers real-time, risk-based fraud detection and prevention while enabling frictionless logins for legitimate users.

Nearly [$13 billion](https://javelinstrategy.com/research/2024-identity-fraud-study-resolving-shattered-identity-crisis) — that’s how much account takeover (ATO) fraud cost businesses in 2023 alone. This isn’t just another alarming stat — it’s a wake-up call for any organization managing user accounts. Industries like e-commerce and financial services are feeling the heat, with ATO attack rates spiking [36%](https://sift.com/index-reports-account-takeover-fraud-q3-2024) and [10%](https://sift.com/index-reports-account-takeover-fraud-q3-2024) year-over-year, respectively.

The methods behind these attacks aren’t new: stolen credentials from data breaches, phishing attacks, and malware are still the go-to tools for fraudsters. What is new? The scale, sophistication, and speed of these attacks. And traditional defenses—CAPTCHA, static rules, even MFA—aren’t enough on their own.

### What you need: Real-time, AI-driven fraud defense

That’s where Auth0 + Sift comes in. Together, they deliver real-time, risk-based fraud detection and authentication at scale. With the pre-built integration, businesses can achieve robust ATO defenses quickly and with minimal engineering lift. 

With the Auth0 extensible identity platform and Sift’s AI-powered risk engine, you can automatically score risk, trigger adaptive MFA, and block bad actors—without slowing down your trusted users.

![Auth0 + Sift integration](https://images.ctfassets.net/23aumh6u8s0i/4E3Z7xaIl3d7lFbAY1qJWH/265b3594668967191449fad982a03f06/Screenshot_2025-04-28_at_6.03.34_PM.png)

### Check out the solution brief to learn how to stay ahead of account takeover attacks

Download [Auth0 + Sift integration solution brief](https://cdn.auth0.com/blog/blog/auth0sift-solution-brief.pdf) to discover:

* Why real-time, AI-powered risk assessment is essential to stop ATO fraud
* How the Auth0 + Sift integration works
* A real-world example from a global e-commerce platform
* Key outcomes: reduced fraud losses, enhanced user experiences, and increased operational efficiency



Account Takeover Attacks Are Surging — Stop Them With AI-Powered Fraud Defense

Jax Painter

Director, Product Marketing

Empower your team with a unified digital Identity strategy that includes intelligent, integrated auth capabilities that minimize risk while improving experience.

Developers are the backbone of innovation. What they focus on can accelerate or hinder the delivery of new products. Authentication and authorization have always been a top development priority, but increases in data volumes, data usage, mobility, and other factors are creating significant complexity.

Navigating increasing auth challenges with manual, cumbersome approaches —while also trying to keep up with the latest security standards and regulations — can be overwhelming. This situation can result in frustrated developers, delayed launch dates, and an increased risk of security gaps that can cause outages, costly non-compliance fees, and damaged business reputations. AI and [GenAI](https://www.okta.com/blog/2024/10/unlocking-the-power-of-generative-ai-with-identity/) adoption only amplify developers' auth challenges because models require massive amounts of information for accuracy and all data usage must align with evolving security and compliance regulations.

How organizations manage auth also determines their effectiveness in protecting data against evolving threats, complying with regulations, and improving brand reputation. Building auth services from scratch or relying on features in legacy systems can easily lead to compliance and governance missteps caused by Identity fragmentation across applications and systems. After all, siloed Identity management is difficult to track, making it harder to safeguard customer data.

Chief technology officers, directors, and development leaders can empower their teams with a unified digital Identity strategy that includes intelligent, integrated auth capabilities that minimize complexity and risk while improving experience. By building and maintaining authentication with less effort and simplifying governance and compliance, developers can spend the bulk of their time doing what they excel at, bringing new products and services to market faster.

## Moving from Complexity to Clarity — and Ideas to Impact

Authentication and authorization are critical vehicles for creating innovative solutions and differentiating experiences for customers and employees. That’s because users expect scalable, frictionless access to apps, digital tools, and cloud services.

To make this possible while enabling teams to manage all their tasks, developers need easy-to-use auth systems that minimize the need for custom code and specialized security skills. That way, developers have what they need to build flexible solutions that can easily integrate with other technologies, support new authentication methods, and facilitate new use cases including AI and GenAI — all in a way that minimizes risk and delivers positive user experiences.

## How LaunchNotes Uses Authentication to Drive Growth

[LaunchNotes](https://www.okta.com/customers/launchnotes/) equips product and development teams with the tools they need to effectively communicate, understand, and manage the what, when, and why of product roadmaps. To drive growth, especially in the enterprise customer space, LaunchNotes replaced their authentication software with a unified solution from Auth0. It provides the enterprise-grade authentication and authorization capabilities prospective customers were looking for, like [single sign-on](https://www.okta.com/products/single-sign-on-workforce-identity/) (SSO).

Auth0 is also easy to use. With it, developers were able to set up a proof of concept in one hour and deploy their new auth solution, including SSO capabilities, within less than three weeks. Within one week of going live, LaunchNotes’ first enterprise customer signed up and more than 10 customers re-engaged.

Developers are also realizing ongoing efficiencies with their unified auth solution. Today, they spend 95% less time managing password policies for B2B customers. They implemented social logins in just minutes. And now, they onboard new customers up to 20% faster, which improves the experience of customers and employees.

## How Cribl Transforms Auth to Bring New Products to Market Faster

[Cribl](https://www.okta.com/customers/cribl/) helps organizations collect, process, route, and analyze logs, traces, and other telemetry data from their in-house and third-party systems and apps. Because this data is critical in establishing and managing seamless, protected communication between systems, Cribl provides customers with strict access controls. For years, Cribl used [role-based access controls](https://www.okta.com/identity-101/what-is-role-based-access-control-rbac/) (RBAC) to authorize users.

However, when they introduced virtual Workspaces for their customers, Cribl quickly recognized that their RBAC approach could not scale with increasing complexity and growth. Developers were spending too much time manually building and maintaining auth systems. To set up authentication for just one Workspace, they had to manually define up to 400 roles in a JSON Web Token.

After evaluating their best options, Cribl’s teams unanimously chose to adopt a unified auth solution from Auth0. It enables granular RBAC and centralized auth models that are flexible, scalable, and easy to manage. Today, developers input their new products into their authorization model and Auth0 automatically handles the mapping between data owners as directed. As a result, what used to take developers months of manual effort now takes just weeks. And because developers can set up authorization for new products 80% faster, they have more time to spend on innovation.

## How Alma Media Builds and Maintains Identity Security with Less Effort

Media and service company [Alma Media](https://www.okta.com/customers/alma-media/) was struggling with siloed auth solutions. The organization operates more than 100 websites and brands used by millions of customers, and every site had its own login method. This meant customers couldn’t navigate between corporate brand sites without having to log in again. Cumbersome user experiences cut Alma Media's conversions in half. Additionally, developers had to create, manage, and scale each site’s standalone authentication solutions, leaving them little time to work on impactful projects.

To achieve their goals, Alma Media adopted a unified auth solution from Auth0 that has dramatically simplified development. As a result, Alma Media improved their user experience, security, and innovation potential. Customers now have SSO, so they no longer have to manage multiple IDs and passwords across sites. They can also opt to log in to sites using their social media accounts.

Additionally, in-house developers and IT teams now use the same flexible solution for managing auth across sites. This straightforward approach reduces risk,  boosts efficiency, and delivers measurable savings. Alma Media has decreased their total cost of ownership by 30% and license expenses by 10%.

## Ignite Innovation at Your Organization

Maximizing the time your developers have to create differentiating solutions that improve security, experience, and innovation is easier with a unified strategy. Auth0 equips organizations with intelligent, integrated authentication and authorization tools that reduce complexity so developers can turn ideas into impactful solutions faster.

No-code, low-code, and pro-code tools accelerate the development of automated flows that teams can quickly adapt to meet current and future use cases. Built-in capabilities also simplify governance and compliance, including certification and regulatory support, data sovereignty, and centralized controls.

Free your devs and simplify auth management! Learn More about [Customer Identity and Access Management (CIAM)](https://www.okta.com/customer-identity/)

## Resources

- [Check out our Developer Center](https://developer.auth0.com/)
- [Unlock SaaS app growth: Download the Why Customer Identity White Paper](https://www.okta.com/resources/whitepaper-why-ciam/)
- [Learn about Fine-Grained Authorization (FGA)](https://auth0.com/resources/whitepapers/fine-grained-authorization-technical-primer)
- [Discover how Okta secures your Generative AI implementation](https://www.okta.com/blog/2024/10/unlocking-the-power-of-generative-ai-with-identity/) 
- [Explore the Build versus buy question for CIAM](https://www.okta.com/resources/whitepaper-build-vs-buy/)


Innovation Ignited: How Development Leaders Make Authentication an Innovation Engine

samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you.

Identity is the connective tissue between every person and technology in your ecosystem. This connective role also places Identity at the center of your risk profile. It’s no surprise that Identity remains the No. 1 attack vector in today’s threat landscape —  over 80% of data breaches involve some form of compromised Identity.

Properly addressing this fact means taking a serious and expansive look at your organization’s approach to Identity — because here’s the thing: Identity is more than just a login box. A rigorous, modern approach to Identity mitigates threats before, at, and after authentication.

Accordingly, technology leaders can’t limit themselves exclusively to Identity-related threats. They must also consider the impact their Identity solution has on core business priorities such as revenue, customer satisfaction, and growth goals.

This blog dives into how technology leaders can deliver Identity security solutions that also drive growth. If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you.

## It’s Time to Ditch Dated Identity and Excessive Friction

Protecting customers from account takeover and other malicious actions is crucial. But when that protection creates frustrating stumbling blocks for customers, like passwords, frequent CAPTCHAs, and multi-factor authentication (MFA) fatigue, your business is at risk. By introducing excessive friction into customer journeys, good-faith security efforts built on legacy Identity methods can lead to abandoned customer journeys, lower conversion rates, and lost business.

It’s a raw deal, and the worst part is that Identity security that burdens your customers doesn’t necessarily translate to better security. For example, traditional usernames and passwords with SMS as a second factor are vulnerable to social engineering and SIM-swapping attacks.

The clock has run out on legacy Identity. It’s time to embrace a modern approach that leverages Identity as more than a login box and, instead, drives better security and better business.

## Protect Every Stage of the Customer Journey

If the stats on pervasive Identity-related breaches teach us anything, it’s that legacy Identity simply isn’t enough in today’s threat landscape. Technology leaders need Identity security that can discover weaknesses, protect against vulnerabilities, and limit access if an adversary gets in.

In order to modernize security, you must modernize Identity. Auth0’s layered defense strategy improves security before, at, and after the login box alongside a SecOps dashboard, tools, and integrations. Here’s how our Auth0 Identity platform drives stronger security, privacy, and user experience (UX) across the customer journey.

### Before login

Bots make up 42% of all internet traffic today and 65% of these are bad bots.A versatile, scalable method for bad actors to carry out automated attacks, bots are also a major drain on your marketing budget. Whenever bots sign up for new accounts, they eat into your sign-up bonuses and block new connections with real customers.

Generative AI is poised to add gas to the bot fire: Between 2023 and 2030, AI adoption in cybercrime is expected to rise by 37%. Soon, businesses will be dealing with an even higher number of sophisticated bots capable of outsmarting simple bot-detection CAPTCHAs.

Modern Identity should stop bad bots in their tracks while maintaining customer-friendly experiences that protect revenue. Auth0 Bot Detection continuously monitors Identity threats across hundreds of millions of users, enabling us to detect bad bots and respond in real time with user-friendly challenges like the time-based authentication challenge. In addition, our Bot Detection solution now features a machine-learning model designed for signup attacks. Tailored models greatly improve detection and prevention of bots across the user journey, while reducing bot challenges presented to real customers.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection)

### At login

Ultimately, driving your business forward comes down to providing customers with a simple and seamless user experience without compromising on security. Customers want on-demand convenience — fast, easy access with flexible login options — which means digital teams need to design phishing-resistant authentication experiences that also deliver a quick and easy customer journey.

Modern Identity can provide that perfect balance with flexible, secure passwordless login options. Passkeys allow users to log in quickly and securely, similar to how they unlock their mobile devices. They are also a phishing-resistant alternative to less user-friendly login options like the commonly used username and password plus MFA combination. Adaptive MFA can also reduce MFA fatigue by assessing risk signals such as a new device, network, or location, impossible travel, and untrusted IP, only triggering a second challenge for higher-risk authentication attempts.

In addition to login options, Auth0 offers layered security features for login. Auth0 Breached Password Detection and Credential Guard screen for and block compromised credentials. Auth0’s Brute-Force Protection and Suspicious IP Throttling help prevent account takeover attacks that target single and multiple user accounts, respectively.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Single Sign-On](https://auth0.com/docs/authenticate/single-sign-on) 
* [Passwordless](https://auth0.com/docs/authenticate/passwordless),[ Passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) 
* [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication)
* [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa)
* [Suspicious IP Throttling](https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling)
* [Breached Password Detection and Credential Guard](https://auth0.com/docs/secure/attack-protection/breached-password-detection)
* [Brute Force Protection](https://auth0.com/docs/secure/attack-protection/brute-force-protection)

### After login

The ongoing rise in post-login threats also necessitates a defense-in-depth, layered security approach at every step of the user journey. The stakes are high, and the pain caused by breaches has the potential for extensive reach. Breaches not only incur painful financial losses but also lead to substantial brand and compliance-related effects that threaten the core business. Modern Identity can help avoid these outcomes.

Modern Identity elevates security, privacy, and experience post-login to protect sensitive customer interactions and user sessions. For example, with Auth0 Highly Regulated Identity, configure your organization to send financial-grade contextual approval requests to customers’ devices for sensitive interactions like account updates or money transfers. With Auth0 Continuous Session Protection, your organization can also continuously monitor user sessions to detect and prevent hijacking attempts, revoke suspicious sessions, and set custom timeouts.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity)
* [Continuous Session Protection](https://auth0.com/docs/secure/continuous-session-protection)

## SecOps

Security is a team sport, which is why Auth0 enables better collaboration between security, product teams, and developers with real-time insights and ready-made integrations that connect Auth0 functionality to a broader security apparatus.

For example, Auth0’s Security Center helps organizations detect and respond to attacks faster and fine-tune their security posture with intelligent insights and custom threshold alerting for Identity-related events, anomalies, and general efficacy. Security Log Streaming further supports faster event response by allowing the streaming of relevant Customer Identity Cloud activity to third-party SIEM tooling.

Auth0 SOLUTIONS TO EXPLORE FURTHER

* [Security Center](https://auth0.com/docs/secure/security-center)
* [Security Log Streaming](https://auth0.com/docs/secure/security-center/prioritized-log-streams)

## The Perfect Blend of Security and Usability

It’s tempting to think of Identity as a box to be checked. Equip your customer-facing applications with SSO and MFA–check. It's time to dust off your hands and declare victory, right? If only it was that easy.

To adapt to the ever-shifting risks of the business landscape with equal attention to security and revenue, technology leaders need an approach to Identity-based security that also functions as a business driver. That means integrating secure, seamless Identity functions into your security and revenue strategies at each customer touchpoint.

Legacy approaches to Identity fall far short of this goal. But, by entrusting your organization’s Identity with a leader in modern Identity, you can position your business to lead the pack in customer Identity security and core business KPIs.

## It All Starts with Auth0

[Thousands of customers](https://www.okta.com/customers/) worldwide trust Auth0 to strike the perfect balance of robust security and seamless customer experience across more than 10 billion monthly authentications.

We’ve invested in a layered defense strategy to improve security before, during, and after the login box — plus a dashboard and tools for SecOps that improve visibility and enable faster responses to potential and emerging threats.

Curious about how the Auth0 can help you build trust with your customers, secure your applications, and protect revenue?[ Reach out to our team](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) to schedule a demo.


Identity Security 101: How to Drive Trust and Loyalty across the User Journey

Nesh Popovic

As a Developer and Solutions Engineer for the past 20+ years, I've been involved in developing and selling secure and robust software solutions. When not helping my sales team deal with the complexities of software platforms, you can usually find me playing pickleball, basketball or backgammon.

Principal Solutions Engineer - CIAM

Learn how to set up an Amazon API Gateway and secure the REST API with Okta Customer Identity Cloud (CIC) Adaptive MFA Risk Score

Protecting REST APIs Behind Amazon API Gateway Using Okta

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Passkeys let developers authenticate users more securely and without phishing risks. However, several subtle nuances may lead them to some misconceptions.

Passkeys replace passwords for user authentication, provide a better user experience, offer more security and phishing resistance. However, there are some subtle nuances that can confuse developers. Let’s dig into some of them.


<AmpContent>
<amp-youtube
    data-videoid="Az3YR0mR6co"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/Az3YR0mR6co' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>


> This article is not an introduction to passkeys. It assumes that you, as a developer, have some general knowledge about them and are looking for clarification about some confusing concepts.
>
> If you are new to passkeys, you can learn more by visiting [learnpasskeys.io](https://learnpasskeys.io).

## Where Are the Specs for Passkeys?

The term *passkey* is [a common noun](https://passkeys.dev/docs/reference/terms/#passkey) in the same way that password is. It's not a product name, and it's not a formal technical name such as [ID token](https://auth0.com/blog/id-token-access-token-what-is-the-difference/) or [JWT](https://jwt.io/introduction). However, a widely accepted definition from the FIDO Alliance [defines passkeys](https://fidoalliance.org/passkeys/) as "*a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices*".

The FIDO Alliance also provides a technical definition of passkeys: "*passkeys are FIDO credentials that are discoverable by browsers or housed within native applications or security keys for passwordless authentication*".

In other words, while **the term passkeys is common** in everyday conversation, it identifies something that is formally defined by a set of technical specifications: [FIDO2/WebAuthn](https://fidoalliance.org/fido2/). Keep reading to learn a bit more about these specifications.

By the way, you should not capitalize the term passkey as if it were a product name. It should follow the capitalization rules of any common noun, as with the term password.

## Passkeys, FIDO, and FIDO2

Some recurring terms around the passkey definition may confuse many developers: FIDO, FIDO Alliance, FIDO2. What are they? What is the relationship between them?

[FIDO](https://fidoalliance.org/what-is-fido/) stands for *Fast IDentity Online* and refers to an initiative to solve the password problem in user authentication. The same name is used to identify the set of standards that allow user authentication through cryptographic keys, although the correct name should be *FIDO Authentication*.

[FIDO Alliance](https://fidoalliance.org/overview/) is the name of the open industry association that carries on the Fast IDentity Online (FIDO) initiative. Among its members, you can find Apple, Microsoft, Google, and Amazon.

[FIDO2](https://fidoalliance.org/fido2/), or rather FIDO2 Authentication, is one of the FIDO Alliance's technical specifications for enabling passwordless strong authentication. Specifically, FIDO2 Authentication is the set of standards that passkeys rely on. FIDO2 Authentication includes the [W3C WebAuthn](https://www.w3.org/TR/webauthn-2/) specifications and the [FIDO Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html) specifications. These are commonly referred to together as “FIDO2/WebAuthn”.

The WebAuthn specification defines how web-based relying parties can interact with passkeys in a browser, while CTAP allows the implementation of Cross-Device Authentication (CDA), i.e., it enables communication between a client/platform and an external authenticator.

## Passkeys and FIDO Credentials

The technical definition of passkeys refers to FIDO credentials. What are they?

**FIDO credentials,  also known as WebAuthn credentials, are cryptographic key pairs** based on [public-key cryptography](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/) and used for authentication. With FIDO credentials, the authentication process is not based on a shared secret, as it happens with passwords. On the contrary, the user shares the public key with the authentication server at the time of registration. Sharing the public key does not compromise the security of the user identity: it's public information that can be shared without any risk. To authenticate, the user must demonstrate that they are in possession of the corresponding private key. This is accomplished by signing a challenge (a randomly generated value) with the private key.

So, the core building block of the passkeys infrastructure is a public-private key pair called FIDO credentials. From a technical perspective, we can identify passkeys with special FIDO credentials. What is so special about these FIDO2/WebAuthn credentials compared to traditional ones? They are **discoverable**, which means that an authenticator is able to detect the private key associated with an authentication server (relying party) given its domain. This makes the user experience smooth and convenient since they don't even need to send their username to the authentication server.

## Passkeys and WebAuthn

You may have heard of passkeys in conjunction with WebAuthn and are wondering what their relationship is. As mentioned earlier, passkeys rely on FIDO2 Authentication, which is based on two specifications: [W3C Web Authentication (WebAuthn)](https://www.w3.org/TR/webauthn-2/) and [FIDO Client to Authenticator Protocol version 2 (CTAP2)](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html).  While CTAP2 defines how devices can communicate with external authenticators, WebAuthn defines how browsers can manage FIDO credentials for user registration and authentication.

WebAuthn defines a JavaScript API to allow a website to request the creation of a new passkey and get proof of possession of the private key. By using this API, a website can't access the private key of the cryptographic key pair, but it can request the authenticator to sign a challenge with that private key. This proves that the user controls the private key, which is what proves the user's identity.

To summarize, a passkey is a credential that allows a user to prove their identity, while WebAuthn is a standard API that allows an application to create and use passkeys for sign-in.

## Passkeys and Biometrics

A common misconception is that passkeys let users authenticate via their biometrics, such as their fingerprint or their face. While using biometrics is one of the ways to complete the authentication process with the relying party, saying that passkeys let you authenticate through biometrics is not accurate.

The relying party has no access to your biometrics. Your fingerprint and your face data are stored locally in your authenticator device, so the relying party cannot authenticate you based on your biometrics. It authenticates you as the holder of the private key part of your passkey. Biometrics are used locally to let you access your authenticator and prevent a malicious person from using your authenticator. To be precise, [a biometrics-based authentication exists](https://auth0.com/blog/a-tale-of-two-biometrics-styles/#On-Device-Biometric-Authentication), but it is local and does not involve the relying party. 

In addition, you are not required to use biometrics to access your authenticator unless the relying party forces this requirement. In some contexts, you can just use a PIN or draw a pattern to access your authenticator. The use of biometrics, PIN, or other interactions with the authenticator is known as an [authorization gesture](https://www.w3.org/TR/webauthn-2/#authorization-gesture).

## Passkeys Are Not Accounts

Another common misconception about passkeys is that they are the same as user accounts. You can find some [threads](https://developer.apple.com/forums/thread/711023) [about this](https://www.reddit.com/r/Passkeys/comments/14sj4yd/multiple_accounts_on_a_single_device/) [confusion](https://developer.apple.com/forums/thread/732735) all around.

A user account can be defined as the representation of the identity of a user in a given context. For example, your Google account identifies you in the Google ecosystem, i.e., in the set of applications and services that Google provides you. Your Apple account identifies you in the Apple ecosystem, and so on.

To prove your identity to Google when you access one of its applications, you need to provide your credentials, such as a password or a signed challenge, in case you are using a passkey.

Your credential is not your identity/account. It allows you to prove your identity, but it's not *the account*. You can change your credentials, but your account remains the same.

In the context of passkeys, you can add a passkey to your account. You could even add multiple passkeys to your account. If you remove your passkey (or one of your passkeys) from your account, you are not deleting your account. You are just removing a way to prove your identity.

Think of your passkeys as you think of your passwords.

## Passkeys Are Not (Necessarily) Hardware-based

While many FIDO authenticators are based on hardware devices, [FIDO2/WebAuthn does not require this](https://www.w3.org/TR/webauthn-2/#authenticator). The specifications explicitly say that an authenticator can be implemented via software. This means that the public and private key pair is created by the software and is stored on the file system after encryption.

A software authenticator can be part of the operating system or an independent application. While a hardware authenticator does not allow you to export the private key stored on it, a software authenticator is more flexible. In fact, synced passkeys rely on a software application or operating system subsystem to export their private key to the cloud and then share it with other devices.

## Passkeys Are Not Only for the Web

A common misconception about passkeys is that they are meant only for web applications. Perhaps this is due to the fact that WebAuthn is a W3C standard, which essentially involves browsers. In fact, you can use passkeys for desktop and mobile applications, too.

You can use two approaches to get passkey support into your native applications:

- **Use the browser to authenticate the user**. You can delegate user authentication to an external browser or system webviews. In this case, user authentication relies directly on WebAuthn, as it happens with web applications. After authentication, the user is redirected back to the native application with a token proving it succeeded.
- **Use your platform-specific abstraction of the WebAuthn API**. Platforms provide you with native implementations to manage passkeys in your applications. For example, you can use [Credential Manager](https://developer.android.com/training/sign-in/passkeys) to support passkeys in Android and [specific APIs for macOS and iOS](https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys). 

## The Role of Authenticators

Authentication using passkeys relies on authenticators, which are hardware or software components capable of managing cryptographic key pairs. You can have two types of authenticators:

- **Platform authenticators**. These authenticators are integrated into your device or are modular software components running on your device. Usually, they are not removable from your device. Examples of platform authenticators include Google Password Manager, Apple iCloud Keychain, Windows Hello, 1Password, Bitwarden, and Dashlane.
- **Roaming authenticators**. These are authenticators that can be used on a device other than the one on which the user is authenticating. Examples of roaming authenticators are security keys or smartphones.

While this classification may seem simple to understand at first look, keep in mind that **the authenticator type is more a matter of role than inherent characteristics**. In other words, a specific authenticator can act as a platform authenticator in one context and as a roaming authenticator in another.

Consider the case of the authenticator embedded in a smartphone. When the user authenticates to an application running on the smartphone, the smartphone's authenticator is a platform authenticator. When the user uses the same smartphone to authenticate to an application running on a laptop via Cross-Device Authentication, the smartphone is a roaming authenticator.

The rule of thumb to determine what is the current role of an authenticator is:

- Has your device a built-in authenticator, and you are using it to access an app or website on the same device? If so, it’s a platform authenticator.
- Has your device a built-in authenticator, but you are using it to let another device access an app or website? Then it’s a roaming authenticator.

As a final note, while as per [definition](https://www.w3.org/TR/webauthn-2/#authenticator), the authenticator is just the subsystem able to manage cryptographic key pairs, it's common to call the entire device the authenticator. So, don't be surprised if you hear someone say they use their smartphone as an authenticator.

## Not All Passkeys Are the Same

You might have heard that there are different types of passkeys, and you may have heard different confusing names for them: single-device, multi-devices, synced, device-bound. Let's try to put order in this naming.

The currently accepted naming for passkey categorization is as follows:

- **Device-bound passkeys**. These types of passkeys are bound to a single authenticator, i.e., the authenticator that created them. Once a passkey has been created, it cannot leave the device where it was created. As an example, consider a security key: you can't move the passkey created with this authenticator to another device.
  For a very short period of time, this was referred to as a *single-device passkey*, but that name is no longer used.
- **Synced passkeys**. These are passkeys that can leave the authenticator in which they were created and move across devices via the cloud. The passkeys are end-to-end encrypted and synced to all of a user’s devices using the same provider. This enables sharing them with all the devices of a user associated with the same passkeys provider account, such as Apple ID, Google account, 1Password account, Bitwarden account, and so on.
  For a very short period of time, these were referred to as *multi-device passkeys*, but that name is no longer used.

## Passkeys, Single Sign-On, & C.

You learned that passkeys are a new way to authenticate the user in a much more secure and convenient way than other traditional forms of authentication, first and foremost, username and password. But how does [Single-Sign On (SSO)](https://auth0.com/docs/authenticate/single-sign-on) work with passkeys? Can we continue to use one account to access multiple applications, or do we have to create a new passkey for each application while using the same account?

Actually nothing changes when you use and implement SSO in your applications. Passkeys introduce a new way to authenticate a user but do not change how to manage the resulting authenticated session. In other words, once the authentication server has authenticated the user, it can generate the authentication cookie just as it did with password-based authentication. Passkey and SSO can coexist seamlessly.

Similarly, passkeys and OpenID Connect or OAuth 2.0 coexist. There is no overlap. After a passkey-based authentication, the identity provider or authorization server may issue the required tokens as usual.

<include src="LearnPasskeysCTA" />

## Summary

Passkey technology is proven and solid, but some internal complexity may lead to some misconceptions. This article went through a few of them, trying to explain how things are. If you have any other doubts about passkeys and the technologies behind them, please leave a comment below.


Common Developer Misconceptions About Passkeys

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Compromised credentials are a threat to your business and customers. Here’s how to reduce the risk.

Credential stuffing is a type of cyberattack in which a cybercriminal uses stolen usernames and passwords from one organization (obtained in a breach or purchased off of the dark web) to access user accounts at another organization.

Credential stuffing attacks are one of the most common causes of data breaches because[ 64% of all people](https://f.hubspotusercontent20.net/hubfs/3791228/2022%20SpyCloud%20Annual%20Identity%20Exposure%20Report.pdf) reuse the same password on multiple (and sometimes all) accounts. In fact, on Auth0's platform alone,[ nearly half of all login requests](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) we receive each day are attempts at credential stuffing.

The opportunity for cybercriminals to use credential stuffing is only growing as more credentials are exposed through breaches; at present, literally billions of compromised credentials are circulating on the dark web. 

However, credential stuffing attacks are preventable if you implement the right cybersecurity measures. Below is what executives need to know about credential stuffing attacks and what can be done to reduce or prevent the likelihood that their organizations will be a victim of one.

> More in the following:
>
> - **[Credential stuffing whitepaper](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)**
> - **[What is broken authentication](https://auth0.com/blog/what-is-broken-authentication/)**

## How Credential Stuffing Works

To execute a credential stuffing attack, cybercriminals add a list of stolen username and password pairs to a botnet that automates the process of trying those credentials on multiple sites at once. Large-scale botnet attacks can overwhelm a business' IT infrastructure, with websites experiencing as much as[ 180 times](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) their typical traffic during an attack.

![Anatomy Credential Stuffing](https://images.ctfassets.net/23aumh6u8s0i/ohyMA4nbwQgkGF77RnSOs/b8997e017022790f156a985fb97c375d/anatomy-credential-stuffing.jpg)

Once cybercriminals find a site where a set of credentials works, they’ll have access to a user's account and personal data to do with as they please, which most commonly includes:

* **Selling access to compromised accounts:** This is particularly common for media streaming services. [Disney+](https://www.cpomagazine.com/cyber-security/new-disney-plus-streaming-service-hit-by-credential-stuffing-cyber-attack/),[ Netflix, and Spotify](https://www.engadget.com/2019/03/13/wickedgen-admin-arrested-stolen-passwords-netflix-spotif/) have all been victims of attacks in which hackers sold access to user accounts for less than the cost of a subscription.
* **E-commerce fraud:** Hackers can impersonate legitimate users at retailers' websites and order a high-value product, either for their own use or for reselling. This is a common (and for criminals, potentially lucrative) form of identity theft, which makes retail the most vulnerable vertical for credential stuffing, according to[ research from Akamai](https://www.akamai.com/newsroom/press-release/akamai-research-commerce-remains-top-target-with-over-14-billion-web-application-and-api-attacks).
* **Corporate/institutional espionage and theft:** While the above crimes have serious consequences for companies and their customers, this third form of attack has the potential to be most devastating for businesses. If an attacker successfully hijacks the account of an employee or admin, they could gain access to all sorts of sensitive personal information, like credit card numbers, social security numbers, addresses, and login credentials as well, all of which they can sell to the highest bidder.

## The Costs of Credential Stuffing Attacks

Although credential stuffing attacks often have a low success rate ([usually one to three percent](https://www.recordedfuture.com/credential-stuffing-attacks/)), their impact on organizations is often anything but small.

For example, the Ponemon Institute's ["Cost of Credential Stuffing" report](https://library.idgcommunications.net/idgcampaigns/documents/uploaded_data/d40/97b/1c-/original/the-cost-of-credential-stuffing_EN.pdf) found that businesses lose an average of $6 million per year to credential stuffing in the form of application downtime, lost customers, and increased IT costs.

Increasingly, regulators, as well as the public, are also holding companies accountable for credential stuffing attacks with stiff fines. Companies may be subject to legal action under data privacy laws such as [GDPR](https://auth0.com/docs/compliance/gdpr) if they fail to implement adequate security measures to prevent such attacks, fail to inform the public of a breach, or don't do enough to protect passwords.

For example, in 2018, the UK's [Information Commissioner's Office (ICO) fined Uber](https://www.computerweekly.com/news/252453244/ICO-fines-Uber-385000-for-data-protection-failings) £385,000 for "a series of avoidable data security flaws" that exposed the data of approximately 2.7 million UK customers. And in 2021, the French Data Protection Authority (CNIL) fined a data controller and its data processor €225,000 “for failure to implement adequate security measures to protect customers’ personal data against credential stuffing attacks on the website of the data controller.”

## Credential Stuffing Attacks vs. Brute Force Attacks

Credential stuffing is considered a type of brute force cyberattack. But in practice, the two are very different, as are the best ways to secure your systems against them.

Brute force attacks attempt to guess passwords by changing the characters and numbers (often in prescribed patterns or with commonly used base password phrases). To protect against them, you can limit the number of failed login attempts with[ brute force protection](https://auth0.com/docs/attack-protection/brute-force-protection), use a CAPTCHA, or require your users to use a stronger password.

However, a strong password won’t stop a cybercriminal from gaining access to an account via credential stuffing because the password is already known. Even CAPTCHA's or brute force protection’s ability to protect users is limited since users often[ change their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die) and cybercriminals have a breached password to iterate from.

## How to Prevent Credential Stuffing Attacks

Most people know password reuse is unsafe but choose to use the same password on multiple sites anyway because they have roughly[ 100 passwords to remember](https://tech.co/news/average-person-100-passwords). Password managers are an option, but [adoption rates are low](https://www.security.org/digital-safety/password-manager-annual-report/). So to prevent credential stuffing attacks, it’s up to organizations to take measures — such as removing passwords altogether — to ensure cybercriminals can’t use stolen credentials to access their users’ accounts. Based on [OWASP's Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), below are several methods for doing so.

### Credential hashing

Credential hashing is the first step to protecting your user's credentials from theft. [Hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) scrambles a user's password before you store it in your database so that in the event that it is stolen, a hacker won’t be able to use them (in theory, at least).

In practice, not all password hashing is uncrackable. As Rick Redman, a penetration tester at KoreLogic, [explains](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/), “The strength of the hash is the insurance policy. It tells you how much time users have to change their passwords after a data breach before they come to harm... If it’s just SHA1, there is no window... If it’s bcrypt, you have time to run away and change all your passwords.”

So although hashing user passwords won’t prevent a credential stuffing attack, it will limit what a cybercriminal can do with those passwords once they’ve stolen them.

### Breached password protection

Breached password protection compares the password a person uses to log in against databases of compromised credentials (like[ haveibeenpwned](https://haveibeenpwned.com/)) to prevent credential stuffing in real-time. 

For example,[ Auth0's breached password detection](https://auth0.com/docs/attack-protection/breached-password-detection) can be configured to notify a user, block them from logging in, or request an additional authentication factor (MFA) if it suspects their credentials were part of a published security breach or if a login attempt came from a suspicious IP address.

### Bot detection

As mentioned earlier, attackers use bots to execute a credential stuffing attack. [Auth0's bot detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature is able to identify a bot attempting to authenticate with [a high percentage of success](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/). It provides protection against credential stuffing attacks with very little friction to legitimate users. When a bot attack is detected, it displays a CAPTCHA step in the login experience to eliminate bot and scripted traffic.

### Anomaly detection

Monitoring what is happening is always a good approach to intervene earliest and stop an attack. If you have visibility of your traffic, you can understand when you are under attack, and you can take action to mitigate attacks. In Auth0, you can use [Log Streams](https://auth0.com/docs/customize/log-streams) to monitor your traffic in near real-time. After creating and configuring a Log Stream, you will start seeing Auth0 events being ingested into your chosen monitoring service. Based on your monitoring service, you can build your anomaly detection dashboard by anayzing the [Attack Protection Log Events](https://auth0.com/docs/secure/attack-protection/view-attack-protection-events).

### Multi-Factor Authentication (MFA)

[Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is a highly effective way to prevent credential stuffing because it requires users to log in with another form of authentication in addition to a username-password combination. For example, this could mean biometric authentication such as a fingerprint, a one-time code sent to a device associated with the user, or an email sent to a secured account — none of which a cybercriminal will have access to.

Although the adoption of MFA has been slow due to concerns about its impact on customer experience, the increase in sophistication and customizability of MFA are helping it catch on. For instance, in February 2020,[ Google announced](https://siliconangle.com/2020/02/12/google-require-nest-users-use-two-factor-authentication-enhanced-security/) it would require Nest smart home users to use two-factor authentication.

### Continuous authentication

Continuous authentication systems use factors like biometrics or behavioral patterns to verify a user’s identity in real-time (while they use an application) instead of a password. As a result, credential stuffing attacks (as well as a number of other cyberattacks) are no longer a viable method for cybercriminals to gain unauthorized access to a user’s account.

### Passwordless authentication

[Passwordless authentication](https://auth0.com/passwordless/) can prevent credential stuffing altogether because it verifies a user with something they have (a device or another account) or something they are (biometrics) instead of a password (something they know).[ Passwordless](https://auth0.com/passwordless/) also creates a better login experience for users and saves organizations time and money from dealing with password resets.

## Passwordless Authentication Is Better for Businesses and Users

Not only does passwordless authentication eliminate credential stuffing attacks, but numerous studies and reports show that it is a[ more secure](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/),[ more user-friendly](https://www.lastpass.com/solutions/passwordless-access/from-passwords-to-passwordless), and[ more cost-effective](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) solution overall than traditional username-password authentication for both businesses and their users.

“Relying on passwords as the primary means for authentication no longer provides the security or user experience that consumers demand,” Andrew Shikiar, Executive Director of the FIDO Alliance, [explains](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) in a joint report with the World Economic Forum. Adrien Ogee, Project Lead from the World Economic Forum, adds, “Better authentication practices are not just possible; they are a necessity.”

Auth0’s platform makes it easy to implement secure, user-friendly passwordless authentication using biometrics, social logins, and more. Learn how to eliminate the risks associated with traditional username and password authentication with Auth0’s Passwordless authentication platform[ here](https://auth0.com/passwordless/).

What Is Credential Stuffing? How To Prevent Credential Stuffing Attacks

Broken Object Level Authorization is the most critical API security vulnerability. Learn how Fine Grained Authorization (FGA) can help fix it.

According to [OWASP](https://owasp.org/), the worldwide web security community, Broken Object Level Authorization (BOLA) is the most critical vulnerability affecting APIs. What is this vulnerability? How can it be exploited? How can you prevent it in your API? Keep reading to find the answers to these questions.

## What Is OWASP API Security Top Ten?

One of the main goals of the OWASP community is to make developers and technologists aware of the risks their applications and systems are exposed to. With this in mind, the community publishes some documents that highlight what are the most common security risks.

The [OWASP Top Ten](https://owasp.org/www-project-top-ten/) document is the most popular one. It focuses on web development in general. But there is also a more specific document for APIs: the [API Security Top Ten](https://owasp.org/www-project-api-security/).

Both the 2019 and the [2023](https://owasp.org/www-project-api-security/announcements/2023/02/api-top10-2023rc.html) versions of the document report that [Broken Object Level Authorization](https://github.com/OWASP/API-Security/blob/master/2023/en/src/0xa1-broken-object-level-authorization.md) is the most critical security risk. It's incredible that after four years this security risk is still affecting APIs around the world! Is there a way to mitigate if not eliminate this vulnerability?

The answer to this question is positive: you can prevent  this vulnerability from affecting your API by designing a proper authorization system. But before you get to the solution, let's learn what Broken Object Level Authorization is.

## What Is Broken Object Level Authorization?

Authorization is the process of determining what a user has access to. This access control can be done in many different ways based on the business rules of the specific application.

In the API context, each request to a protected endpoint should be analyzed to determine if the client is authorized to access and perform the requested action. Typically, this check is done at the code level and is based on verifying that the client has the right permissions to access the resource (the object) exposed by the API endpoint.

The main problem in this case is to define what is the actual resource to protect.

In some scenarios, it's the API endpoint itself. Consider the `/profile` endpoint: it implicitly returns the profile data of the current user. The API may know who the current user is from the session storage or from the access token sent along with the request.

In other scenarios, the object to protect is the requested resource. Consider the endpoint `profile/42`, which returns the profile data of the user with ID 42. In this case, comparing the current user ID to the requested user ID may not be correct. Think of an administrator who should have access to the profile data of all the users. The authorization check should verify that the current user has permission to access the requested object.

Inaccurate permission checking in endpoints that use object IDs exposes the API to BOLA attacks. In fact, an attacker could manipulate the object ID to gain access to an object for which they have no permissions.

> In the past, the Broken Object Level Authorization (BOLA) vulnerability was called Insecure Direct Object Reference (IDOR). The name was changed because it suggested that the problem was with the ID, while in fact it's with the authorization check.

## An Example of BOLA Vulnerability

To understand how a Broken Object Level Authorization vulnerability can be exploited by an attacker, let's use a practical example.

Suppose your bank provides you with an app to manage your account. Being a curious developer, you take a look at how your app interacts with the server. You notice that it calls the endpoint `https://thebankwebsite.com/accounts/9876543` to get data about your own account whose number is 9876543.

You remember that one of your friends has the same bank as you. You also remember that you made a money transfer to him in the past, so you look for his account number in the messages he has sent you. You find out that his account number is 1029387. So, you take curl or another HTTP client and replay your HTTP request to the bank's server by changing the endpoint's URL: `https://thebankwebsite.com/accounts/1029387`.

Surprisingly, you get the data about your friend's account from the server! This means that the bank's API has a BOLA vulnerability. Their authorization check fails at the object access level.

You can imagine, for example, that the API implementation for that particular endpoint is as follows:

```javascript
const express = require('express');
const app = express();
const { auth, requiredScopes } = require('express-oauth2-jwt-bearer');

//This checks that the provided access token is valid
const validateAccessToken = auth({
  audience: '...yourApiIdentifier...',
  issuerBaseURL: `https://...yourDomain.../`,
});

//This checks that the provided access token grants reading permissions
const checkReadPermissions = requiredScopes('read:account');

app.get('/accounts/:accountNumber', 
        validateAccessToken, 
        checkReadPermissions,
        function(req, res) {
          res.json(getAccountData(req.params.accountNumber));
        }
);
```

This Node.js Express code snippet shows how a GET request on the `/accounts/:accountNumber` endpoint is handled. Note that the endpoint is protected by two middleware:

- `validateAccessToken`, which ensures that the client provides a valid access token.
- `checkReadPermissions`, which ensures that the access token contains the required `read:account` scope in order to allow the client to access the requested account.

Unfortunately, these checks are not sufficient to implement an accurate access to the account object. In fact, they will not prevent you from accessing your friend's account.

<include src="ebook-ads/WebSecurity" />

## How to Prevent BOLA Vulnerabilities

What measures can you take to prevent BOLA vulnerabilities?

A common suggestion is to avoid using easily recognizable object identifiers in your endpoint URL, such as the bank account number in the example above. This measure prevents the knowledge of the object ID from allowing an attacker to compose a specific HTTP request. For example, you could use a GUID in the URL to identify the bank account instead of the bank account number itself. GUIDs are randomly generated values and make them very difficult to guess.

This approach can mitigate the risk of BOLA attacks, but it doesn't solve the problem. If the attacker finds a way to determine the GUID associated with a bank account, this protection will be bypassed.

The real problem is not in the object ID but in the authorization mechanism. The access control of your API should not be limited to controlling access to the endpoint. It should verify that only authorized users can access **the object exposed by the endpoint**.

In the bank account example, this means that additional checks should be performed. For example, you can check that the current user is the owner of the account, as outlined below:

```javascript
// ...existing code...

app.get('/accounts/:accountNumber', 
        validateAccessToken, 
        checkReadPermissions,
        function(req, res) {
          const userId = req.auth.payload.sub;
          const account = getAccountData(req.params.accountNumber);
  
          if (account.userId == userId) {
            res.json(account);  
          } else {
            res.status(403).json("Permission denied."); 
          }
        }
);
```

This would solve the unauthorized access to the bank account described earlier. However, it might not cover other scenarios. For example, consider a bank account with multiple owners. Each owner could have different permissions on the account. Also consider a bank employee: they should be able to access the accounts of their branch customers. And perhaps a regional manager should be able to access the accounts of multiple branches.

As you can see, the authorization policy that your API should implement strictly depends on the specific business logic. This logic is mainly determined by the relationship between users and resources. When this relationship becomes complex, your API code run the risk of getting messed up.

## What Is Fine-Grained Authorization?

To handle complex authorization policies, you should use Fine Grained Authorization (FGA). FGA allows you to control access to resources by analyzing a context described by various attributes and relationships. By having access to a detailed context, you can more effectively control who can access what in your system.

You can design and implement FGA in a variety of ways, but the most common models are as follows:

- **Attribute-Based Access Control (ABAC)**. This authorization model allows you to make authorization decisions by evaluating attributes such as the user's role or age, the resource type or size or status, the action requested, the current date and time, and so on.
- **Policy-Based Access Control (PBAC)**. This authorization model allows you to make authorization decisions based on policies. It is very similar to ABAC. The main difference is that PBAC focuses more on logic while ABAC relies more on data.
- **Relationship-Based Access Control (ReBAC)**. This authorization model focuses on the relationship between users and resources. This also includes relationships between resources. ReBAC provides a more expressive and powerful authorization model that can describe very complex contexts.

Okta offers [Fine Grained Authorization](https://fga.dev) through two solutions based on the ReBAC model:

- [Auth0 FGA](https://dashboard.fga.dev/). This is an *authorization service* that centralizes your authorization logic and data. It allows you to define your authorization model, store your authorization data, and make your authorization decisions across all your applications. Read the [Auth0 FGA documentation](https://docs.fga.dev/intro/authorization-and-auth0-fga) to learn more.
- [OpenFGA](https://github.com/openfga). This is the Open Source project powering the Auth0 FGA service. You can install the [OpenFGA Server](https://github.com/openfga/openfga) and use its SDKs to integrate authorization into your applications.

## How FGA Solves BOLA Vulnerabilities

Auth0 FGA and OpenFGA allow you to fix Broken Object Level Authorization vulnerabilities in your APIs without messing up your code. Whether you use the hosted product or install the Open Source engine on your servers, FGA allows you to centralize the access control to the resources protected by your API.

You can do this in three steps:

1. **Define your authorization model**. In this step, you define the types of objects in your system and their possible relationships with each other. The authorization model is usually fairly static once written. Check out [this document to learn more about defining your authorization model](https://docs.fga.dev/modeling).
2. **Store your authorization data**. This step allows you to define the actual data and its relationships according to the authorization model you defined in the previous step. This represents the state of the system and will be changing as users interact with your application.
3. **Add authorization check to your API**. In the third step, you integrate authorization checks into your API and start leveraging the power of FGA.

### Define your authorization model

Going back to the bank account example, you can define your authorization model in Auth0 FGA by using its [configuration language](https://docs.fga.dev/modeling/configuration-language). The following code shows a minimal example of how your model could be written:

```yaml
model
  schema 1.1
type user
type branch
  relations
    define employee: [user]
type account
  relations
    define branch: [branch]
    define owner: [user]
    define can_create: employee from branch
    define can_view: owner or employee from branch
```

Notice that the last line in the model above defines the account owner and the employees of the branch where the account was opened as the legitimate viewers. This is the basis for avoiding the Broken Object Level Authorization problem.

Using the [Auth0 FGA Playground](https://play.fga.dev/), you can also get a visual representation of this model:

![The bank authorization model in the Auth0 FGA Playground](https://images.ctfassets.net/23aumh6u8s0i/3cklRF8G4IPBGWb07P4JsI/a75e9daf57459430a9c40f620aad7792/auth0-fga-bank-authorization-model.png)

> You can play with the model used in this article by [making your own copy](https://play.fga.dev/stores/create/?id=01GVMW810J23DEBPGT22MFE4M7).

### Store your authorization data

As the next step, you fill this model with actual data. You define your users and add a direct relationship to the objects in your model. You also define relationships between objects and other aspects that depend on your specific model. You provide data to the system using tuples. For example, the following tuples define some relationships related to the bank model presented earlier:

```json
[
  // User Mary is the owner of the account 12345
  {
    "user": "user:mary",
    "relation": "owner",
    "object": "account:12345"
  },
  // User John is an employee of the branch b1
  {
    "user": "user:john",
    "relation": "employee",
    "object": "branch:b1"
  },
  // Account 12345 was created in the branch b1
  {
    "user": "branch:b1",
    "relation": "branch",
    "object": "account:12345"
  }
]
```

To learn how [to populate your authorization model with data, read this document](https://docs.fga.dev/writing-data).

### Add authorization check to your API

Finally, you can add the authorization checks to your API using one of the [available SDKs](https://docs.fga.dev/integration/install-sdk). Referring back to the bank example, the Node.js Express code will perform its authorization checks as follows:

```javascript
const { OpenFgaApi } = require('@openfga/sdk');
const fgaClient = new OpenFgaApi({
  //...configuration...
});

// ...existing code...

app.get('/accounts/:accountNumber', 
        validateAccessToken, 
        checkReadPermissions,
        function(req, res) {
          const userId = req.auth.payload.sub;
          const account = getAccountData(req.params.accountNumber);
  
          const { allowed } = await fgaClient.check({
            tuple_key: {
              user: `user:${userId}`,
              relation: 'can_view',
              object: `account:${req.params.accountNumber}`,
            },
          });
  
          if (allowed) {
            res.json(account);  
          } else {
            res.status(403).json("Permission denied."); 
          }
        }
);
```

The authorization check is performed by `fgaClient.check()`, which passes the tuple to be verified to the FGA engine. The FGA engine uses the authorization model and the data you provided to determine if the current user is authorized to view the requested account. Since you have defined there who the legitimate viewers of this account are, your API is not BOLA vulnerable. In addition, your code is kept clean.

Read more about [integrating FGA into your API](https://docs.fga.dev/integration).

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Summary

By the end of this article, you should have a clearer idea of what Broken Access Level Authorization is and how Fine Grained Authorization can help prevent it.

You have begun to explore what BOLA is and how it can be exploited with a practical example. You have seen that the root cause of this vulnerability is an inadequate authorization system. You learned about FGA and saw what Auth0 offers in this area.

Using the API example analyzed earlier, you learned how to integrate it with Auth0 FGA to overcome the BOLA vulnerability in three steps: define an authorization model, populate the model with data, and invoke the authorization check from the API.

In addition to avoiding BOLA vulnerabilities, Auth0 FGA provides a powerful authorization system to solve very complex scenarios effectively and efficiently. [Give it a try](https://fga.dev/).


How Fine Grained Authorization Solves the Most Critical API Security Risk

Eli Rabek

I joined Okta in 2021 to manage the Auth0 for Startups program. I love supporting early-stage companies and have spent the past decade building and running startup programs for corporations (e.g., Intel Corp), government agencies (e.g., the Spanish Institute for Foreign Trade), and universities (e.g., Stanford University). Outside of work, you can usually find me running around San Francisco's dog parks with my dog, hosting friends for dinner with my husband, or traveling with friends/family.

Director, Auth0 for Startups

Learn how both companies provide products and support for innovative founders.

### Overview

We are excited to announce that [MongoDB for Startups](https://www.mongodb.com/startups?utm_campaign=startups-partners&utm_source=auth0_for_startups&utm_medium=community&utm_content=startups) is collaborating with [Auth0 for Startups](https://auth0.com/startups/mongo-db) to provide top security for applications by the most innovative startups! 

### Why should a startup be a part of the MongoDB and Auth0 startup programs?

Customers, investors, and stakeholders expect many different things from you, but one thing in common is responsibly managing their data. 

Companies choose MongoDB because it accelerates application development and makes it easier for developers to work with data. 

Developers mindful of security, compliance, and privacy when it comes to data use the robust Auth0 platform to create great customer experiences with features like single sign-on and multi-factor authentication. 

<include src="QuoteCard" body="Auth0 and MongoDB are very complimentary in nature. While MongoDB provides a strong, secure data platform to store sensitive workloads, Auth0 provides secure access for anyone with the proper authorization. We are safely using Auth0 as one of the data stores for the encryption piece, as well as using those keys to encrypt all of our users’ confidential information inside MongoDB." name="Soumyarka Mondal" title="Co-Founder" team="" company="Sybill.ai" />

### What is the Auth0 for Startups Program?

Auth0, powered by Okta, takes a modern approach to identity and enables startups to provide secure access to any application for any user. Through Auth0 for Startups, we are bringing the convenience, privacy, and security of Auth0 to early-stage ventures, allowing them to focus on growing their business quickly. 

The Auth0 for Startups program is free for one year and supports the following:

* 100,000 monthly active users
* Five Enterprise Connections
* Passwordless authentication
* Breached Password Detection
* 50+ Integrations, 60+ SDKs, and 50+ Social & IdP connections

### What is the MongoDB for Startups Program?

MongoDB for Startups is focused on enabling the success of high-growth startups from ideation to IPO. The program is designed to give startups access to the best technical database for their rapidly scaling ventures.

Apply to our program, and you will receive the following:

* $500 in credits for all MongoDB cloud products (valid for 12 months)
* A dedicated technical advisor for a two-hour, one-to-one consultation to help you with your data migration and optimization
* Co-marketing opportunities
* Access to the MongoDB developer ecosystem and access to our VC partners.

> Apply to [Auth0 For Startups](https://auth0.com/startups/mongo-db) and the [MongoDB for Startups Program](https://www.mongodb.com/startups?utm_campaign=startups-partners&utm_source=auth0_for_startups&utm_medium=community&utm_content=startups) today.

MongoDB Joins Auth0 to Help Startups Combat Security Risks

Anne Ellegood

Anne is our Social Impact Product Marketer with extensive experience developing & delivering marketing programs for products, services, and partners that enable sales and build brands. In addition to being an amateur archaeologist, Anne is a self-professed data-hoarder fueled by curiosity & the quest for inbox zero zen.

Product Marketing Director

Nonprofit staff are the first line of defense you have, so here's what they need to know

As a leader of a mission-driven organization, you know that all nonprofit, non-governmental, and charitable organizations count on every stakeholder to help bring their mission and programming to life. The one tool they all have in common?

**Data.**

It doesn't matter if this data is being actively used or waiting for its turn to influence a crucial decision; it's always of measurable value.

It powers nearly all of a nonprofit's business functions; and contains critical information from organization programs and finances to the financials, identities, and personal information of every person in the organization's ecosystem. In ill-equipped, improper, untrained, or ill-intended hands, mishandling of this data can cause unpredictable damage to an organization and its stakeholders. 

## Data Protection – the Fundamentals

Although the responsibility of a nonprofit's data protection and security may fall to a designated individual person or team, even they can't monitor the thousands of actions stakeholders take with their data every day across the organization.

When it comes to keeping data safe, the best defensive measure is an educated and security-aware workforce. However, this is not always the case with nonprofit employees, who can often lack the general awareness and ongoing involvement necessary to play a more active role in safeguarding data. It is essential to include everyone in building an environment where personal responsibility contributes to the organization's cyber well-being.

So what are three fundamentals that can empower your people?

## Fundamental 1: Communicate Policies & Procedures Regularly

As part of staff onboarding, review any data protection and security policies and procedures in place across your organization. All contributors should know what is expected of them. Leaders should make sure this information is kept current and that all staff, and any non-internal parties, are informed and provide an acknowledgment that they've reviewed your policies and procedures as they're made available and updated.

> ⇒ Unsure of where to start with creating policies and procedures for data protection and security, or looking to review what your org has in place?

   

> Check out [Cyber Essentials from CISA](https://www.cisa.gov/cyber-essentials), which is an excellent resource for building a culture of cyber readiness within your organization and CISA's [Cybersecurity Framework](https://www.nist.gov/cyberframework); a gold-standard in helping org's understand and improve their management of cybersecurity risk.

Individual contributors should expect to review this information upon onboarding and throughout their tenure with your organization. If this hasn't been the case, then just ask. Everyone plays a part in keeping data protected and secured. If you're an individual contributor on some (or every) level of the organization, YOU are the best line of defense. Review security policies and procedures and frequently refresh, at a minimum, twice annually.

## Fundamental 2: Ensure Compliance

PII (Personal Identifiable Information), GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Accountability Act), CCPA (California Consumer Privacy Act), and PCI DSS (Payment Card Industry Data Security Standards) — are just a few of the many regulations and standards regarding data usage, protection, and security compliance a nonprofit may encounter and be responsible for adhering to. And what's more, these rules and regulations vary greatly. 

To give you an idea of just how vast protection and privacy laws are around the world, check out this [interactive map](https://www.dlapiperdataprotection.com/) from the global law firm, DLA Piper.

All staff and vendors supporting your organization's mission should understand the compliance regulations and standards regarding the data they have access to and work with. Staying up-to-date on changes in regulations is paramount. Failure to remain current and comply with these regulations and laws may result in heavy fines and/or legal action being taken against a nonprofit.

If your organization relies on vendors who have access to your organization's data, request their most current privacy and security policies and audit reports. Review them and ask for clarifications on anything that may be unclear. It's important to understand the measures they're taking to protect and secure _your_ potentially sensitive data. 

For example, visitors to Auth0, a product unit within Okta's online properties, can learn more about our trust and compliance policies through the information we've provided here:[ https://www.okta.com/trustandcompliance](https://www.okta.com/trustandcompliance)

## Fundamental 3:  Access Accountability

Working remote, working from work, or some variation of the two? In order to access data needed for work, connectivity to a network and login credentials are needed. No matter what your role is at a nonprofit organization, there are some basic measures you can take to safeguard access to the nonprofit's data:

* When connecting, ensure the network is PRIVATE and SECURED. (Public wifi isn't recommended)
* Using unique, random passwords preferably created by a password manager with the longest character count possible (ideally at least 16 characters at the minimum) will help ensure your login credentials are not easily guessed
* Enable [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication) on all your important work and personal accounts. Multi-Factor Authentication, MFA for short, can reduce the likelihood of cyberattacks from stolen credentials. MFA works by requiring additional verification information (known as factors) when they log in using a username and password, providing further proof of identity
* Avoid sharing your account credentials information with anyone in any format (written, electronic, verbal, etc.) 
* Leaders should enforce the _principle of least privilege_ when it comes to who has access to the organization's data at all levels based on their individual role and need. This should be reviewed often and updated whenever there are changes in people or technology 

> **_⇒  The principle of least privilege is a concept in security limiting a user's access rights to only that which is required to do their job_**

These are just the three basic fundamentals for mitigating data risk in a nonprofit at the staff level across the organization. **All staff could benefit from the helpful information we've compiled to create Auth0's resource, [Your Personal Cybersecurity Checklist: Workplace Edition](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist-workplace-auth0dotorg).** The checklist covers basic workplace cyber hygiene, personal cybersecurity, and advanced workplace cybersecurity actions every staff member can follow. It's a great place to start your organization's journey to being more secure and assured in 2022 and beyond. 

<include src="asides/AboutAuth0" />

3 Fundamentals in Data Risk Mitigation for Nonprofit Staff

jameeka_aron

Jameeka has over 20 years of Information Technology and Cyber Security experience. She is a versatile leader, successfully leading teams as both a CISO and CIO across various industries including; Aerospace & Defense, Apparel, Retail, and Manufacturing at both Fortune 100 and privately held companies and many spaces in between. <br>
She is highly skilled in Business Engagement (International and U.S. based) Audit, Compliance, Vulnerability, Risk and Identity Management, Digital Transformation, Mergers, Acquisitions, Divestitures, and leading Cross-Functional and Matrixed teams.

CISO

Jameeka Aaron

Rapid change introduces workforce and app risks. Auth0 Security team’s advice on what to fix now.

Fast response allowed many organizations to survive and thrive in 2020. Orgs went remote overnight; businesses launched consumer-facing apps, and [consumers shifted buying patterns online](https://auth0.com/blog/how-brick-and-mortar-approaches-improve-digital-experiences/).

Going fast gets products to market, it gives consumers choices, and it helps companies scale. But when you jump ahead seven to 10 years in your digital road map, you risk leaving a few security and data privacy concerns behind. I reached out to key members of my security team, as well as our data privacy team, to put together this three-part series based on our industry experience and observations.

Each post will focus on protecting and securing two critical areas: your workforce and your consumer-facing apps. The first post will focus on security details to check and mitigate now. The second will focus on immediate data privacy concerns with the help of Auth0 Vice President, Privacy Lucy McGrath. And the third post will help you put together a plan for the future that will make it easier the next time you want to turn on the speed — and to remain current in an ever-changing security landscape.

The thing is that security is a global team sport.  As more of us shift to working and living online, everything is more connected — and that can be a good thing. Securing your personal identity, your business identity, and helping increase security at your business can actually make an impact. Here’s what you can do to help make the internet safer for everyone.

## Why Remote Work Forced a Change in Security Thinking

Before the world started working remotely, a lot of companies used a castle-and-moat approach to security. They relied on a combination of physical security and internal networks to ensure that employees and outsiders only accessed necessary information. They might even have relied on SaaS companies to provide some of their protections, but the thinking was still pretty much “protect the castle.”

Suddenly workers were working anywhere in the world, maybe on their own devices. Without remote experience, your security team might not have had time to think through all of the security issues inherent with having remote endpoints. For example, to ensure that they properly protect these assets against current threats like ransomware and malware, it would be appropriate to install leading next-gen antivirus on these machines.

Role-based privileges and policies also abruptly needed to follow the user. I know I work for an identity company, but it was identity and policy [federation](https://auth0.com/blog/why-identity-federation-matters/) that anticipated this need and allowed for a rapid response.

[Now some companies are making work from home a permanent](https://www.businessinsider.com/companies-asking-employees-to-work-from-home-due-to-coronavirus-2020) part of their employee offering. Since Auth0 was built as a remote-friendly, globally dispersed company, we’ve had some time to think through the security concerns. Here’s what you need to consider to protect your customers, your business, and your employees:

1. **Secure the endpoints.** Services like CarbonBlack or CrowdStrike can help prevent malware or breaches occurring from endpoints.
2. **Update bring your own device policies.** Rethink how and where employees are accessing business and customer data. Do you need to restrict access in public spaces? Adjust policies?
3. **Update action policies**. What do your employees do if a work computer is stolen? What steps do they need to take if the information is exposed at home? A [1Password survey](https://www.darkreading.com/51--of-wfh-parents-say-children-have-accessed-work-accounts/d/d-id/1339754) found that 51% of work from home (WFH) parents surveyed said their children had accessed their work accounts, sometimes accidentally deleting necessary files.  How can you support your employees??
4. **Human risk is increased.** Have a look at the next section.

## The Human Element

This is the critical part of this series — **the human element is the most important aspect of security and data privacy.**

> Security awareness training needs to happen at every single level of your organization.

A malicious actor is going to use everything you need to do business — email address patterns, information on your website, social media posts, and items gleaned from news articles all to try to gain entry to your system. While the attacks will vary, they usually follow this pattern: **human factor** + inject something into the code + lack of input validation + insufficient logging and monitoring.

If something looks like it’s coming from your CEO or payroll, an employee might fall for it and supply a way into your system. And once a bad actor is in, there’s lots they can do.

But if you train your entire team to watch out for phishing attacks, you can stop them at the first step. [This post is a good place to start.](https://auth0.com/blog/protecting-against-phishing-attacks/)

Attacks evolve, so even though security awareness is something you should pause and do now, it’s something you’re going to need to do regularly. Developing a security culture throughout your org provides great protection. To do business with some industries like finance or healthcare, the training will be required to cover specific areas and will need to be documented. The training you provide can also help protect your employees in their personal lives.

## Top 7 Things to Do Now to Check Your App’s Security

This can seem like a lot if you don’t have an in-house security team (and maybe if you do). One principle of security is encouraging diversity of thought not only because it’s the right thing to do but because studies show it makes teams more productive. In security, [diversity of thought](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/innovation-in-a-crisis-why-it-is-more-critical-than-ever) makes it easier to spot potential threats. This is part of why even large teams rely on external testing vendors and may even need to provide proof of outside testing for certifications like [CSA Star](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/) and [PCI](https://auth0.com/blog/what-is-pci-a-business-guide-to-compliance/).

1. **Get an external third-party pen test — and implement the recommendations**. A penetration test is where you hire a verified third party to attempt to find your app’s vulnerabilities. They will sign a non-disclosure agreement (NDA) and provide a detailed report outlining their findings and usually with recommended fixes cataloged by severity. Discovering vulnerabilities can be scary, and there is the temptation to use fear to drive organizational change, but we’ve found that partnering and collaborating with other teams and leadership can often get changes implemented faster. 
2. **Review best practices for your cloud-based services.** When people go really fast, they may not take the time to fully understand the technology and security controls. This is a great time to go back and pay really close attention to the docs provided by your third-party vendors.

> “Many common AWS security issues, for example, happen as a result of not following AWS security best practice guidelines when setting up the infrastructure. This can lead to open and accessible EC2 security groups, public S3 buckets, unprotected EMR clusters, and more,” says Auth0 Detection and Response Security Engineer Troy Wegner (formerly of AWS and Amazon.com).

3. **[Perform static](https://www.overops.com/blog/static-vs-dynamic-code-analysis-how-to-choose-between-them/) and [dynamic code analysis](https://www.overops.com/blog/static-vs-dynamic-code-analysis-how-to-choose-between-them/)**. Static analysis reviews the code as it exists. Dynamic analysis looks for vulnerabilities while the code is being executed and for unexpected outcomes. Ideally, you want to move towards baking both into your Software Development Lifecycle (SDLC). Devs may not always enjoy adding this to part of their process—more on how to add this analysis to your long-term software development plans in the final post.
4. **Think through vulnerability management and updates**. Since humans are fallible and it’s humans who make code, it’s inevitable that you’re going to run into vulnerabilities. If you don’t have a plan for pushing updates, now’s the time to make one so you don’t hear about something BIG like the [Heartbleed Bug](https://www.vox.com/2014/6/19/18076318/heartbleed) and find yourself painfully updating ad-hoc.

> In general, you’re going to need to test every time your devs update something and whenever your tech stack libraries or any of the main operating systems updates. Services like Chef, Puppet and Terraform can make this easier by pushing updates from a central server to connected servers. In the final post, we’ll get into longer-term strategies for updates, like maintaining a Golden Amazon Machine Image (AMI) if you’re on AWS. For now, just document how and when you’re going to update and test.

5. **Threat model**. A lot of security is determining risks. Ideally, you’ve threat modeled before building your app, but in some ways, it’s easier to model after it’s live. Yes, you can hire a trusted third party to do this for you. To give you a sense of the thought process, I asked Troy to threat model this restaurant scenario. Security engineers often diagram vulnerabilities, so we also include Troy’s whiteboard as a reference.

Let’s say you’re a local restaurant who responded to COVID by offering the ingredients to make your tastiest dishes and recipes to your customers via curbside pickup. You hired someone to put the app together quickly, but now your region is opening up, and you’ve decided this channel of operations should continue contributing to your bottom line. 

![Whiteboard](https://images.ctfassets.net/23aumh6u8s0i/3qWEruezG4YZw2AwS2w4Nf/ccb3121e94d794c8baa0ec470e4b084d/diagram.jpg)
**Figure 1:** _Auth0 Senior Security Engineer - Detection and Response Troy Wegner’s whiteboard of our restaurant scenario._

* Start with authentication because you know customers need to authenticate in order to interact with your app. How are they authenticating? Are they only using a username and password? If they are only using a username and password for authentication, then you have just hit on your first major risk (user compromise/phishing/user impersonation). 
* As a way to address the first risk identified, you have chosen to go with two-factor authentication for your users. But here is where things get interesting; which 2-factor options do you want to support? There are authenticator apps, FIDO U2F, Push-based 2FA, and SMS (the weakest available option). Each option has its own pros and cons to consider.
* Since this is a restaurant, you’re also somehow connecting the app to the food supply. How are you measuring and validating your existing ingredients inventory to ensure you do not oversell based on your total ingredients available? Are you using a database to store this information? If so, where does this database live, is it protected or hardened information security wise, and if so, how is it hardened? How do you authenticate to the database, is it updated regularly, do you perform backups, etc. 
* If your service has gotten really popular, too many people might try to order at once, and that could overwhelm the app’s limits. The app could go down due to resource constraints based on how it is architected. This is basically the risk a DOS/DDOS would present in bringing your app down and making it no longer available to your customers. In order to mitigate a DDOS risk, you might have a plan to make your app more fault tolerant and highly available by using load balancing, increasing back-end servers to handle the load, or using a front-end CDN to help distribute load across various edge locations.
* Most likely, your app is taking payment and processing it in order to fulfill orders; how are customer payment and other sensitive information being handled/stored? If you accept credit cards or debit cards, PCI compliance is a concern you should address.
* Here is where you would now want to think through and fully diagram out the rest of how the app works and uncover any other risks or bottlenecks that currently exist with your app, place a severity on those risks, and determine by severity which risks you want to fix, and which ones you are ok accepting.


6. **Turn on your logs — and make sure they’re monitored**. Turning on logs can seem like common sense, but because there’s often an expense attached to logging and getting the data analyzed, the logs might not always be turned on. It’s really hard to know what to fix after a malware outbreak or other issues occur, especially if your logs aren’t turned on and are being actively analyzed. 

So this is where we tell you to turn on the logs for all the services you’re using. You should also make sure that a trusted third-party vendor or trained security engineer is watching your logs and building actionable detections based on those log sources to look for suspicious or anomalous activity.

7. **Take action**. Logs, vulnerability assessments, pen tests — these things can help you identify what needs to be fixed, but you still need to fix it. Breaches and ransomware are the obvious security problems you want to avoid. How your security challenges impact consumer behavior might not be as clear. Lost conversions, abandoned shopping carts, and low time on site are all indications that your target audience may not feel comfortable sharing their data with you. Our customers tell us that an app or site that feels secure (think smooth login, logical and smooth payment process) supports their business goals.

## If You Need More Help

Authentication is often a critical part of securing an app or workplace. If you’d like to understand how Auth0’s solutions might help make your app more secure, please reach out to the [team at Auth0](https://auth0.com/contact-us).

My next post will focus on immediate data privacy concerns with the help of Auth0 Vice President of Privacy Lucy McGrath.

<include src="asides/AboutAuth0" />

Accelerated Your Road Map? Go Fix Workforce and App Security

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Learn how to address the risks that today’s top mobile security threats pose to your organization.

Mobile initiatives are a top priority for many organizations these days because research shows that increases in mobility help enterprises [improve operations](https://cdn2.hubspot.net/hubfs/1789978/Content%20Offers/enterprise-mobility-trends-report-2020.pdf) and [productivity](https://insights.samsung.com/2016/08/03/employees-say-smartphones-boost-productivity-by-34-percent-frost-sullivan-research/).

However, increases in organizational mobility typically result in an increase in the number of mobile devices that are accessing your systems from a remote location. And for your security teams, this means a growing variety of endpoints and threats they need to secure in order to protect your organization from a data breach.

As in the past, the most common threats to mobile security include mobile malware. However, as Verizon’s [2020 Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf) shows, there are new threats organizations need to consider as well in order to ensure they’re protected.

Below are the most common and critical mobile security threats that organizations face in 2021.

## 4 Different Types of Mobile Security Threats

Mobile security threats are commonly thought of as a single, all-encompassing threat. But the truth is, there are four different types of mobile security threats that organizations need to take steps to protect themselves from:

* **Mobile Application Security Threats.** Application-based threats happen when people download apps that look legitimate but actually skim data from their device. Examples are spyware and malware that steal personal and business information without people realizing it’s happening.
* **Web-Based Mobile Security Threats.** Web-based threats are subtle and tend to go unnoticed. They happen when people visit affected sites that seem fine on the front-end but, in reality, automatically download malicious content onto devices.
* **Mobile Network Security Threats.** Network-based threats are especially common and risky because cybercriminals can steal unencrypted data while people use public WiFi networks.
* **Mobile Device Security Threats.** Physical threats to mobile devices most commonly refer to the loss or theft of a device. Because hackers have direct access to the hardware where private data is stored, this threat is especially dangerous to enterprises.

Below are the most common examples of these threats, as well as steps organizations can take to protect themselves from them.

## 1. Social Engineering

Social engineering attacks are when bad actors send fake emails (phishing attacks) or text messages (smishing attacks) to your employees in an effort to trick them into handing over private information like their passwords or downloading malware onto their devices.

Reports by cybersecurity firm [Lookout](https://www.lookout.com/phishing-spotlight-report-lp) and [Verizon](https://enterprise.verizon.com/resources/reports/dbir/2020/results-and-analysis/) show a 37% increase in enterprise mobile phishing attacks and that phishing attacks were the top cause of data breaches globally in 2020.

![Social Engineering](https://images.ctfassets.net/23aumh6u8s0i/1wPMqUJN6nHgmQTVo4poQz/8b4fea1cb9600bcb1bc5b93f8881d49b/image1.jpg)
<p align="center"><i><a href="https://www.cybersecurityintelligence.com/blog/it-governance-cyber-security-phishing-awareness-course-180.html">Source</a></i></p>

<p align="left"></p>
### Phishing Attack Countermeasures
The best defense for phishing and other social engineering attacks is to teach employees how to spot phishing emails and SMS messages that look suspicious and avoid falling prey to them altogether. Reducing the number of people who have access to sensitive data or systems can also help protect your organization against social engineering attacks because it reduces the number of access points attackers have to gain access to critical systems or information.

## 2. Data Leakage via Malicious Apps

As Dave Jevans, CEO and CTO of Marble Security, [explains](https://www.esecurityplanet.com/mobile-security/10-trickiest-mobile-security-threats.html), “Enterprises face a far greater threat from the millions of generally available apps on their employees’ devices than from mobile malware.”

That’s because 85% of mobile apps today are largely unsecured. Tom Tovar, CEO of Appdome, [says](https://technologyadvice.com/blog/information-technology/cybersecurity-trends-2020-byod-mobile/), “Today, hackers can easily find an unprotected mobile app and use that unprotected app to design larger attacks or steal data, digital wallets, backend details, and other juicy bits directly from the app.”

For example, when your employees visit Google Play or the App Store to download apps that look innocent enough, the apps ask for a list of permissions before people are allowed to download them. These permissions generally require some kind of access to files or folders on the mobile device, and most people just glance at the list of permissions and agree without reviewing them in great detail.

However, this lack of scrutiny can leave devices and enterprises vulnerable. Even if the app works the way it’s supposed to, it still has the potential to mine corporate data and send it to a third party, like a competitor, and expose sensitive product or business information.

### How to Protect Against Data Leakage

The best way to protect your organization against data leakage through malicious or unsecured applications is by using mobile application management (MAM) tools. These tools allow IT admins to manage corporate apps (wipe or control access permissions) on their employees’ devices without disrupting employees’ personal apps or data.

## 3. Unsecured Public WiFi

Public WiFi networks are generally [less secure](https://www.wired.com/story/public-wifi-safety-tips/) than private networks because there’s no way to know who set the network up, how (or if) it’s secured with encryption, or who is currently accessing it or monitoring it. And as more companies offer remote work options, the public WiFi networks your employees use to access your servers (e.g., from coffee shops or cafes) could present a risk to your organization.

For example, cybercriminals often set up WiFi networks that look authentic but are actually a front to capture data that passes through their system (a “man in the middle” attack). Here's what that looks like:

![Unsecured Public WiFi](https://images.ctfassets.net/23aumh6u8s0i/3Zdz3P9nnZTNTMNPi2UMPZ/af3eb9262d8440b0fc875da00b0e1eaf/image2.png)
<p align="center"><i><a href="https://www.consumer.ftc.gov/blog/2014/03/how-secure-mobile-app"> Source </a></i></p>

If this seems far-fetched, it isn’t. Creating fake WiFi hotspots in public spaces with network names that look completely legit is incredibly simple, and people are very willing to connect, as shown by [experiments](https://hbr.org/2017/05/why-you-really-need-to-stop-using-public-wi-fi) run at the Democratic and Republican conventions in 2016 and by [an experiment](https://hackernoon.com/a-hacker-intercepted-your-wifi-traffic-stole-your-contacts-passwords-financial-data-heres-how-4fc0df9ff152) run by a researcher in 2019 from [Magic](https://magic.co/).

### How to Reduce Risks Posed By Unsecured Public WiFi

The best way for you to protect your organization against threats over public WiFi networks is by requiring employees to use a VPN to access company systems or files. This will ensure that their session stays private and secure, even if they use a public network to access your systems.

## 4. End-to-End Encryption Gaps
<p align="left"></p>
An encryption gap is like a water pipe with a hole in it. While the point where the water enters (your users’ mobile devices) and the point where the water exits the pipe (your systems) might be secure, the hole in the middle lets bad actors access the water flow in between.

![End-to-End Encryption Gaps](https://images.ctfassets.net/23aumh6u8s0i/75ICJ2SUKqSGKvX7OQoXxF/423b5c480a4c09939e62d411ba716b1b/image3.png)
<p align="center"><i><a href="https://heimdalsecurity.com/blog/the-best-encrypted-messaging-apps/"> Source </a></i></p>

Unencrypted public WiFi networks are one of the most common examples of an encryption gap (and it’s why they’re a huge risk to organizations). Since the network isn’t secured, it leaves an opening in the connection for cybercriminals to access the information your employees are sharing between their devices and your systems.

However, WiFi networks aren’t the only thing that poses a threat—any application or service that’s unencrypted could potentially provide cybercriminals with access to sensitive company information. For example, any unencrypted mobile messaging apps your employees use to discuss work information could present an access point for a bad actor.

### Solution: Ensure Everything is Encrypted

For any sensitive work information, end-to-end encryption is a must. This includes ensuring any service providers you work with encrypt their services to prevent unauthorized access, as well as ensuring your users’ devices and your systems are encrypted as well.

## 5. Internet of Things (IoT) Devices

The types of mobile devices that access your organization’s systems are branching out from mobile phones and tablets to include wearable tech (like the Apple Watch) and physical devices (like Google Home or Alexa). And since many of the latest IoT mobile devices have IP addresses, it means bad actors can use them to gain access to your organizations’ network over the internet if those devices are connected to your systems.

> Statistically, there are probably more IoT devices connected to your networks than you realize. For example, 78% of IT leaders from four different countries reported in [a study by Infoblox](https://www.infoblox.com/company/news-events/press-releases/shadow-iot-devices-a-major-concern-for-corporate-networks-infoblox-research-finds/) that over 1,000 shadow IoT devices accessed their networks each day.

### How to Combat Shadow IoT Threats
<p align="left"></p>
Mobile device management (MDM) tools can help you combat shadow IoT threats, as well as identity and access management (IAM) tools like Auth0. However, IoT/Machine-to-Machine (M2M) security [is still in a bit of a “wild west” phase](https://www.crn.com/news/internet-of-things/as-5g-nears-iot-connectivity-remains-a-wild-west-) at the moment. So it’s up to each organization to put the appropriate technical and policy regulations in place to ensure their systems are secure.

## 6. Spyware

Spyware is used to survey or collect data and is most commonly installed on a mobile device when users click on a malicious advertisement (“malvertisement”) or through scams that trick users into downloading it unintentionally.

Whether your employees have an iOS or Android device, their devices are targets ripe for data mining with spyware—which could include your private corporate data if that device is connected to your systems.

### How to Protect Against Spyware

Dedicated mobile security apps (like Google’s [Play Protect](https://developers.google.com/android/play-protect)) can help your employees detect and eliminate spyware that might be installed on their devices and be used to access company data. Ensuring your employees keep their device operating systems (and applications) up to date also helps ensure that their devices and your data are protected against the latest spyware threats.

## 7. Poor Password Habits

A [2020 study](https://www.balbix.com/resources/state-of-password-use-report-2020/) by Balbix found that 99% of the people surveyed reused their passwords between work accounts or between work and personal accounts. Unfortunately, the passwords that employees are reusing are often weak as well.

For example, a 2019 study by Google found that 59% of the people they surveyed used a name or a birthday in their password, and 24% admitted to using a password like one of these below:

![Poor Password Habits](https://images.ctfassets.net/23aumh6u8s0i/3f3dzG9WlC6gNqYnCyB9V3/00d5e8990be0124d4b140764ff769ec1/image4.jpg)
<p align="center"><i><a href="http://www.netimperative.com/2016/01/worst-25-passwords-prove-were-all-idiots/"> Source </a></i></p>

These bad password habits present a threat to organizations whose employees use their personal devices to access company systems. Since both personal and work accounts are accessible from the same device with the same password, it simplifies the work a bad actor has to do in order to breach your systems.

However, these behaviors also provide opportunities for credential-based brute force cyberattacks like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) or password spraying because cybercriminals can use weak or stolen credentials to access sensitive data through company mobile apps.

### How to Reduce or Eliminate Mobile Password Threats

The [NIST Password Guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) are widely regarded as the international standard for password best practices. Following these guidelines—and insisting your employees do the same—will help protect you against threats from weak or stolen passwords. Password managers can simplify the work required for your employees to follow these guidelines.

Requiring your employees to use more than one authentication factor (multi-factor authentication or MFA) to access mobile company applications will also help reduce the risk that a bad actor could gain access to your systems since they’d need to verify their identity with additional authentication factors in order to log in.

Finally, implementing [passwordless authentication](https://auth0.com/passwordless/) will help you eliminate password risks altogether. For example, in the event that a mobile device is stolen or accessed illegally, requiring a facial scan as a primary (or secondary) authentication factor could still prevent unauthorized access.

## 8. Lost or Stolen Mobile Devices

Lost and stolen devices aren’t a new threat for organizations. But with more people [working remotely](https://www.businesswire.com/news/home/20201215005287/en/Upwork-Study-Finds-22-of-American-Workforce-Will-Be-Remote-by-2025) in public places like cafes or coffee shops and accessing your systems with a wider range of devices, lost and stolen devices pose a growing risk to your organization.

### How to Protect Against Lost or Stolen Device Threats

First and foremost, you’ll want to ensure employees know what steps to take if they lose their device. Since most devices come with remote access to delete or transfer information, that should include asking employees to make sure those services are activated.

![How to Protect Against Lost or Stolen Device Threats](https://images.ctfassets.net/23aumh6u8s0i/44UaWTSZk2OlrI587JXGw1/1276e73d18bae71b074472dfb1ebd2db/image5.jpg)
<p align="center"><i><a href="http://www.idownloadblog.com/2014/08/08/how-to-activate-lost-mode-iphone-ipad/"> Source </a></i></p>

[Mobile device management](https://auth0.com/blog/what-is-enterprise-mobile-management/) (MDM) tools can also help you secure, encrypt, or wipe sensitive company information from a device that’s lost or stolen, so long as those tools were installed before the device went missing.

## 9. Out of Date Operating Systems

Like other [data security](https://auth0.com/blog/what-is-data-security/) initiatives, mobile security requires continuous work to find and patch vulnerabilities that bad actors use to gain unauthorized access to your systems and data.

> Companies like Apple and Google address a lot of these vulnerabilities with operating system updates. For example, in 2016, Apple realized it had three [zero-day vulnerabilities](https://us.norton.com/internetsecurity-emerging-threats-how-do-zero-day-vulnerabilities-work-30sectech.html) that left its devices open for spyware attacks and released a patch to protect users against these vulnerabilities.

<p align="left"></p>
However, these patches only protect your organization if your employees keep their devices up to date at all times. And according to Verizon’s [Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf), operating system updates on 79% of the mobile devices used by enterprises are left in the hands of employees.

### How To Keep Mobile Operating Systems Up To Date

Google and Apple both allow organizations to push updates to managed Android and iOS devices. Third-party MDM tools (for example,[ Jamf](https://www.jamf.com/)) often provide this functionality as well.

## IAM Tools Can Help Secure Company Mobile Applications

Identity and Access Management (IAM) tools can help organizations secure the apps and data that users access from their mobile devices, including:

* **Restricting which devices and users can access enterprise applications and data,** as well as which parts of those applications they’re allowed to access.
* **Tracking user behavior** and securing access in the event that something looks suspicious with security features like [multi-factor authentication](https://auth0.com/blog/multifactor-authentication-mfa/) (MFA),[brute force attack protection](https://auth0.com/docs/attack-protection), and more.

Auth0 simplifies the work required to implement secure authentication for mobile enterprise applications—learn more about Auth0’s IDaaS platform [here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The 9 Most Common Security Threats to Mobile Devices in 2021

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Learn how passwordless authentication can help enterprises reduce security risks and costs

Passwordless authentication is the process of verifying a software user’s identity with something other than a password. The most common passwordless authentication methods include verifying the possession of a secondary device or account a user has or a biometric trait that is unique to them, like their face or fingerprint.

[Passwordless authentication](https://auth0.com/passwordless) can reduce costs and security risks for any organization. And as Google Cloud’s director of product management Sam Srinivas explains, [passwordless authentication usage will likely grow rapidly in the near future](https://cloud.google.com/blog/products/identity-security/security-trends-to-pay-attention-to-in-2019-and-beyond). 

Here is why more enterprises are turning to passwordless authentication and how you can implement it in your organization.

![Why Passwordless Authentication Is Better than a Password](https://images.ctfassets.net/23aumh6u8s0i/24uCeR7yhZbNmMpbFE7v3v/c2245aa707cc9d83b5242357ed06ac39/Passwordless-Authentication-sep1.jpg)

## Why Passwordless Authentication Is Better than a Password

Passwordless authentication creates a smoother experience than traditional username and password (U/P) authentication for both you and your users (that can be more secure if it relies on WebAuthn). Not only does this save you money, but it can even lead to an increase in sales in some cases.

### Reduced security risks

According to Verizon’s 2021 Data Breach Investigations Report (DBIR), credential vulnerabilities account for [over 84% of all data breaches](https://www.verizon.com/business/solutions/secure-your-business/business-security-tips/). Eliminating passwords altogether reduces your risk for a data breach because it reduces a bad actor’s ability to use them (and the unsafe behaviors that often expose them) against you and your users.

For example, cybercriminals [often](https://auth0.com/blog/what-is-data-security/) use [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) (using compromised user credentials from one breach to gain access to another organization) to breach an organization because [more than two-thirds of all people reuse passwords](https://securityboulevard.com/2020/04/8-scary-statistics-about-the-password-reuse-problem/). Eliminating passwords removes the ability for cybercriminals to use credentials they’ve obtained elsewhere to access accounts on your system.

Passwordless authentication that uses modern authentication methods like FIDO-compliant devices reduces your organization’s vulnerability via [phishing attacks](https://auth0.com/blog/protecting-against-phishing-attacks/) (tricking users into downloading malware or providing sensitive information with a malicious email). 

Since phishing accounts for [36% of all data breaches](https://www.verizon.com/business/solutions/secure-your-business/business-security-tips/) and [many](https://www.csoonline.com/article/2117843/what-is-phishing-how-this-cyber-attack-works-and-how-to-prevent-it.html) are performed with the goal of acquiring a username and password, eliminating passwords means your users or employees won’t accidentally provide bad actors anything they can use to gain access to their accounts and personal data if they receive a phishing email.

### Reduced costs (and increased sales) through better user experience

The average person has [100 passwords](https://tech.co/news/average-person-100-passwords) to remember and spends [12.6 minutes of every week](https://www.yubico.com/wp-content/uploads/2019/01/Ponemon-Authentication-Report.pdf) resetting them (often through a call to a help desk). This ends up costing your organization more money in password resets and customer service time than you think. For example, although the industry standard is $70 per reset, Auth0 customers report up to $120 per reset, even before they’ve called the helpdesk. 

Implementing passwordless authentication, however, can help reduce or eliminate those costs since your users will be able to log in without a password. This also eliminates the need to store and maintain those password databases.

[Research](https://www.yubico.com/wp-content/uploads/2019/01/Ponemon-Authentication-Report.pdf) by The Ponemon Institute and Yubico also shows that eliminating passwords may increase sales for some businesses since almost half of the 1,700+ IT professionals they surveyed reported that they could not complete a personal transaction as a result of a forgotten password.

Finally, user experience [can be a competitive advantage](https://www.researchgate.net/publication/220891164_User_Experience_Design_A_Strategy_for_Competitive_Advantage) for software businesses ([even at the enterprise level](https://www.uxmatters.com/mt/archives/2018/12/enterprise-user-experience-as-a-competitive-advantage.php)). So reducing login friction could also encourage users to choose you over your competitors.

![Types of Passwordless Authentication](https://images.ctfassets.net/23aumh6u8s0i/3DuYOoznWG10geDOeYwBVm/02b5dbc23075eebf4d984f22dbaaec76/Passwordless-Authentication-sep2.jpg)

## Types of Passwordless Authentication

Traditional username and password authentication require a user to input something they know (a password) in order to verify who they are. But passwordless authentication methods require a user to demonstrate that they have something (a possession factor) or that they are something (an inherence factor), both of which are harder to circumvent.

Below are the most common methods used for verifying both inheritance and possession factors:

1. **Biometrics:** Many physical traits are more or less completely unique to each individual. [Biometric authentication](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/) uses these unique physical traits to verify if a person is who they say they are, without requesting a password. For example, the likelihood that two faces are the same is less than [one in a trillion](https://www.sciencedirect.com/science/article/abs/pii/S0379073815003758), so facial recognition is an effective way to verify an individual.
2. **Magic Links:** Instead of asking a user for a password, this form of passwordless authentication asks a user to enter their email address into the login box. An email is then sent to them, with a link they can click to log in. This process is repeated each time the user logs in.
3. **One-Time Passwords/Codes:** One-time passwords (OTP) or one-time codes (OTC) are similar to magic links but require users to input a code that you send them (via email or to their mobile device via SMS) instead of simply clicking a link. This process is repeated each time a user logs in.
4. **Push Notifications:** Users receive a push notification on their mobile devices through a dedicated authenticator app (for example, [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en_US&gl=US)) and open the app through a push notification to verify their identity. 

<br \>
<iframe width="100%" height="315" src="https://www.youtube.com/embed/0OYA1c3bjgM" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>


## How to Implement Passwordless Authentication

Coding passwordless authentication is a lot more complex than simply telling your dev team to change the login box. In fact, if your login box was a light switch, implementing passwordless authentication, for many organizations, would be more akin to rewiring the whole house. However, third-party providers offer a rapid and more secure implementation that is more secure and up-to-date than anything that can be built in-house.

The extent to which that analogy holds true for you will depend on the design of your existing identity and access management ([IAM](https://auth0.com/blog/what-is-iam/)) systems. But the point is that it’s far more[ complex and costly](https://www.forrester.com/report/Making+The+Business+Case+For+Identity+And+Access+Management/-/E-RES80481) to implement securely than most realize, often requiring dedicated development resources over a long period (and then scaling and maintaining those systems after implementation).

As a result, many organizations choose to work with an identity provider (like Auth0) that can reduce the time to implement passwordless authentication for millions of users to months in some cases, as well as offload many of the maintenance costs they’d face in the future. Learn more about implementing passwordless authentication with Auth0 [here](https://auth0.com/passwordless).

<include src="asides/AboutAuth0" />

What Is Passwordless Authentication?

navrup

I am a product marketing manager leading the Digital Experience domains, working to maximize the user experience in everything we do. I bring years of experience taking products to market in the retail, cloud infrastructure, developer language, and SaaS spaces.

Navrup Tom

Biometrics can reduce security risks, but they're not impenetrable. Here's what you need to know.

Biometrics are measurable human traits, characteristics, or behaviors that can be used to verify a person's identity. For example, a person's face or fingerprints are unique to them and can be measured. So they're often used to identify a person in law enforcement applications.

Biometrics have been used for identity verification[ since 1883](https://www.nlm.nih.gov/exhibition/visibleproofs/galleries/biographies/bertillon.html) when French criminologist Alphonse Bertillon first used body measurements to identify repeat offenders. Today,[ biometric authentication](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/) is[ growing in popularity](https://community.spiceworks.com/security/articles/2952-data-snapshot-biometrics-in-the-workplace-commonplace-but-are-they-secure) for enterprises because biometrics are an[ effective](https://www.researchandmarkets.com/reports/5021766/biometrics-driven-by-standardized) way to control access to sensitive information, devices, or physical locations.

However, biometrics aren't impenetrable and come with increased privacy risks. So any organization seeking to utilize biometrics to verify employees or end users should pay close attention to how they implement biometric identification systems.

Below is what executives need to know about using biometrics for their organization.

![How Biometrics Work](https://images.ctfassets.net/23aumh6u8s0i/1PBtpzTeahMOcqlpm1MoL3/09f0029a9c41c405493f0549b51a7397/Biometric_2.jpg)

## How Biometrics Work

At the most basic level, you need two things to verify an individual's identity with a biometric identifier: a way to collect or measure the desired characteristic and a record of that characteristic to compare your measurement to.

However, to automate the biometric authentication process, modern biometric systems typically require three steps:

1. **A physical measurement device that reads or scans the biometric characteristic** you're using to authenticate a person
2. **Software that translates a biometric scan into a digital format** and compares it to the record of that biometric characteristic
3. **A stored record of that biometric characteristic** that the software can compare the new scan to in order to verify a person

### Centralized vs. Decentralized Biometric Data Storage (and Why It Matters)

Biometric data is typically stored either on a central server or the authentication device itself — with the former being a controversial method for doing so.

Storing biometric data on a server like you would a password means that if the database is breached, your users' biometric data is breached. And since you can't reset biometric data like you would a password, it means your users' biometric data is compromised for the rest of their life.

Device-level storage keeps biometric data distributed, which eliminates the risk of large quantities of biometric data being exposed all at once (better protection for users and organizations).

## Types of Biometrics

While just about any part of a person's body can be measured, not every biometric characteristic [can or should be](https://ieeexplore.ieee.org/document/6641037) used to verify an individual's identity. Some traits inherently carry a greater degree of uniqueness than others, and some traits are hard to measure due to technical constraints (the technology doesn't exist yet, or the trait is hard to measure).

Below are the most common types of biometric characteristics in use today:

* **Fingerprint Biometrics.** The patterns found on a person's fingers are unique to them and are [already used to verify smartphone users](https://www.google.com/search?q=TouchID&oq=TouchID&aqs=chrome..69i57j0i10l8j0.1021j0j1&sourceid=chrome&ie=UTF-8).
* **Behavioral Biometrics.** Behavioral biometrics use patterns in an individual's behavior, such as keystroke patterns and computer mouse movements or other behavioral characteristics like a user's physical location, to identify them.
* **Ear Biometrics. **A person's ear has a unique shape, and[ research](https://www.wired.com/2010/11/ears-biometric-identification/) shows ear recognition could be more accurate than fingerprint recognition.
* **Voice Biometrics.** A person’s voice is [unique to them](https://www.scientificamerican.com/article/human-voices-are-unique-but-were-not-that-good-at-recognizing-them/). Voice recognition systems are [90% accurate on average](https://www.nojitter.com/ai-speech-technologies/understand-value-voice-biometrics-basics).
* **Facial Recognition Biometrics.** [Research](https://pubmed.ncbi.nlm.nih.gov/26441304/) shows that an individual's face is unique when measured in sufficient detail and therefore is effective for accurately identifying them. Face recognition algorithms are far from perfect ([studies show](https://sitn.hms.harvard.edu/flash/2020/racial-discrimination-in-face-recognition-technology/) the technology is less effective in identifying darker-skinned individuals). However, companies are taking steps to [improve their accuracy](https://www.csis.org/blogs/technology-policy-blog/how-accurate-are-facial-recognition-systems-%E2%80%93-and-why-does-it-matter) with artificial intelligence (AI).
* **Hand Geometry Biometrics.** Hand geometry is unique from person to person and has been used to identify a person since the 1960s. Although hand geometry is unique, using it to identify an individual does carry some important limitations, according to the [Infosec Institute](https://resources.infosecinstitute.com/topic/oldest-biometric-hand-geometry-recognition/).
* **Gait Biometrics.** Gait analysis measures the way a person walks to identify them. Gait recognition is still a new technology, but researchers have[ already developed systems for smartphones](https://techxplore.com/news/2019-01-smartphone-user-authentication-based-gait.html) that could be used to implement it.
* **Retina Biometrics.** Retina biometrics use the unique pattern on a person's retina to identify them. Research shows that retinal scans are [very accurate](https://core.ac.uk/download/pdf/81276656.pdf).
* **Iris Biometrics.** Iris biometrics are similar to retina biometrics, except they use the unique pattern of a person's iris instead of the retina. [Research](https://www.nist.gov/itl/iad/image-group/irex-iii-homepage) by the National Institute of Standards and Technology (NIST) shows that iris scans are 90-99% accurate.
* **Vein Recognition Biometrics.** Vein recognition is also known as vascular biometrics and uses subdermal vein patterns to identify a person. Vein recognition is the [most accurate biometric technology](https://www.researchgate.net/publication/331682141_A_STUDY_OF_VEIN_RECOGNITION_SYSTEM) in use today. However, researchers have cracked vein recognition in the past using a [wax hand](https://eric-diehl.com/biometric-vein-recognition-hacked/). So although it's effective at distinguishing between individuals, it's susceptible to attack. 
* **DNA Biometrics.** 99.9% of the average person's DNA is [identical to every other person](https://www.genome.gov/about-genomics/fact-sheets/Genetics-vs-Genomics) on Earth. However, the 0.1% that's different is enough to identify a person with a [high degree of accuracy](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1483893/).

## The Pros and Cons of Biometrics for Cybersecurity

Biometrics promise organizations improved security and better experiences for users. But they also create new risks that organizations need to account for if they choose to use them to verify employees or end users.

### Pros

Biometrics are an effective way to verify users because biometric traits are harder to fake, replicate or transfer than traditional username/password (U/P) authentication.

Research also shows that consumers [prefer biometric authentication](https://usa.visa.com/visa-everywhere/security/how-fingerprint-authentication-works.html) to U/P authentication because it's easier for them to authenticate themselves — they just scan their finger, and they're in. This benefits organizations because a positive user experience can also [reduce security risks](https://www.darkreading.com/edge/theedge/user-friendly-cybersecurity-is-a-better-ux-the-key-to-a-better-defense-/b/d-id/1337699) and offer [a competitive advantage](https://www.uxmatters.com/mt/archives/2018/12/enterprise-user-experience-as-a-competitive-advantage.php).

Finally, biometric data often saves companies money because it [uses less server space](https://www.rand.org/content/dam/rand/pubs/monograph_reports/MR1237/MR1237.ch2.pdf) than traditional authentication measures and eliminates the need to reset a password.Auth0 customers report costs of up to $120 per password reset.

### Cons

Biometric identification systems can be costly to implement if a company is installing everything from scratch. For example, although some biometric technologies like fingerprint scanners are now fairly cheap to purchase, the more accurate and reliable technologies are often [quite expensive](https://www.bayometric.com/biometric-devices-cost/). One way to substantially bring down these costs is to use scanners within existing devices, such as mobile phones, as the authentication mechanism.

And although biometrics do reduce many security risks, cybercriminals have still found ways to [crack biometric authentication systems](https://www.fastcompany.com/3018830/meet-the-hackers-who-cracked-apples-touch-id), as well as [breach the databases](https://www.theguardian.com/technology/2019/aug/14/major-breach-found-in-biometrics-system-used-by-banks-uk-police-and-defence-firms) biometric data is stored on. 

Biometrics are also a challenge to store securely because the hashing process used to protect passwords doesn't work with biometric data. So any organization that utilizes biometrics to verify their users has to ensure that any biometric data they store centrally is adequately [encrypted](https://auth0.com/blog/how-secure-are-encryption-hashing-encoding-and-obfuscation/) or they'll put their users at risk.

## Common Examples of Biometrics in Use Today

Biometrics are most commonly used in smartphones, tablets, and laptops. For example, both [Apple](https://www.cnet.com/how-to/the-iphone-and-ipads-face-id-tech-is-pretty-darn-cool-heres-how-it-works-and-how-to-use-it/) and [Samsung](https://www.samsung.com/global/galaxy/what-is/biometric-authentication/) use fingerprint and facial recognition to unlock their devices.

However, enterprises, government agencies, and even law enforcement are also using a variety of biometric identifiers for access control or to verify an individual's identity.

* **Financial Services.** Behavioral biometrics are [used in financial and banking industries](https://www.thalesgroup.com/en/markets/digital-identity-and-security/banking-payment/inspired/behavioral-biometrics) to prevent fraud and identity theft.
* **Law Enforcement.** [Law enforcement agencies](https://www.nist.gov/) use fingerprints, palm prints, and DNA to verify the identity of criminals.
* **Immigration and Customs.** Many countries use biometrics to document foreign residents and issue visas. For example, the [United States Department of Homeland Security](https://www.dhs.gov/biometrics) uses fingerprints and facial recognition to verify an individual when they enter the country, as well as issue a green card to foreign residents.
* **Healthcare and Medicine.** Biometrics are [currently used](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7442501/) to identify patients in hospitals and retrieve medical records.
* **Customer Service.** Voice biometrics are used to authenticate users when they call a customer service center.

![The Future of Biometrics](https://images.ctfassets.net/23aumh6u8s0i/72e8GkU7K8cuSoxC8JrleF/c3d57801015e621f725020f2db951b8e/Biometric_3.jpg)

## The Future of Biometrics

The total market value of the biometrics industry is expected to [grow 87%](https://www.reportlinker.com/p04397168/Biometric-System-Market-by-Authentication-Type-Component-Function-Application-and-Region-Global-Forecast-to.html?utm_source=GNW) in the next five years as more organizations adopt biometric authentication to secure data, devices, and applications. As that occurs, there are several trends emerging that organizations should pay attention to:

* **Continuous improvement of biometric security is a must.** Bad actors are finding new ways to circumvent biometric authentication systems. So reducing security risks to biometric data is a continuous effort, not a one-and-done event.
* **Using biometrics in continuous authentication applications will gain more traction.** Continuous authentication happens on a rolling basis while a person uses your systems, rather than once at the beginning. Many experts expect biometrics to be widely incorporated into continuous authentication systems as they become available in the near future.
* **Regulations around biometric data are tightening.** Biometrics are still a relatively new technology. But given the privacy concerns associated with biometric data, regulators are beginning to tighten restrictions around how biometric data is collected, used, and stored.

For more information on each of these trends, see our article on[ biometric authentication](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/). Learn more about implementing biometric authentication with Auth0 [here](https://auth0.com/multifactor-authentication).

<include src="asides/AboutAuth0" />

What Are Biometrics? The Pros/Cons of Biometric Security

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Learn how ISO 27018 controls help cloud service providers reduce security risks for personal data.



ISO 27018 is the first international standard created specifically for [data privacy](https://auth0.com/blog/data-privacy-101/) in cloud computing. Its main objective, according to the [International Organization for Standardization (ISO)](https://www.iso.org/standard/76559.html), is to establish “commonly accepted control objectives, controls, and guidelines for implementing measures to protect Personally Identifiable Information (PII).”

ISO 27018 is part of the ISO 27000 family of standards, which define best practices for information security management. ISO 27018 adds new guidelines, enhancements, and security controls to the ISO/IEC 27001 and ISO/IEC 27002 standards, which help cloud service providers better manage the data security risks unique to PII in cloud computing.

Although ISO 27018 is not a law, there are a number of benefits to following its guidelines and earning certification (more on this below). And since [the standard isn’t free](https://www.iso.org/standard/76559.html) to the public, we’ve combed through it to help you make intelligent decisions on compliance and certification.

Below are the most important things you need to know about ISO 27018 and why it’s a good idea to follow.

## Version “2019” vs. “2014” - What’s New?

ISO 27018 was first created in 2014 (ISO/IEC 27018:2014) and was last revised in 2019 (ISO/IEC 27018:2019). The differences between the two versions are minor and do not change the best practices for protecting PII in cloud computing and public cloud applications in any major way.

As ISO states in Section 2 of the 2019 version, “This second edition cancels and replaces the first edition (ISO/IEC 27018:2014).” It goes on to explain that the revisions are primarily to correct an editorial mistake in Annex A.

However, **one noteworthy revision to point out**, from a certification standpoint, is that ISO 27018 is no longer referred to as a “standard” within the document itself. Instead, the latest revision replaces all mentions of “standard” with the word “document.”

In plain English, that means **ISO 27018 is now considered a set of guidelines and controls that enhance ISO 27001** (the standard for building an information security management system or ISMS), rather than a standard for organizations to certify against.

Cloud service providers should instead certify against ISO 27001 using 27018 guidelines in the event that they process PII.

## Why ISO 27018 Compliance Is Beneficial

[A study by PWC](https://www.pwc.com/us/en/services/consulting/library/consumer-intelligence-series/cybersecurity-protect-me.html) found that “85% of consumers will not do business with a company if they have concerns about its security practices.” Simply put, ISO 27018 compliance is a competitive advantage for both cloud service providers and their customers:

* **For cloud service customers**: If you can show consumers that their data is protected by comprehensive PII protection standards (by working with cloud service providers that follow ISO 27018), they’ll be more likely to do business with you.
* **For cloud service providers**: If you’re ISO 27018-compliant, it makes it easier to close deals with prospective customers because you can say, “We follow the most comprehensive data controls.”

Here are four additional ways ISO 27018 compliance benefits businesses.

### 1. Improved Global Operations

Since ISO 27018 is an extension of ISO 27001, it’s part of an internationally recognized standard. That means it’s easier for cloud service providers to provide assurances on their security practices if they’re doing business globally, as the standard is recognized in most countries.

_**Note**: Following ISO 27018 will streamline cloud privacy in many instances, given its global acceptance. However, it’s always important to consult a data privacy attorney skilled in the laws of the specific country you’re trying to do business in to ensure that you’re compliant._

### 2. Improved Security And Legal Protection

Earning the ISO 27001/27018 certification is an important part of establishing a baseline of security for any business that processes data in the cloud. Simply put, following these standards helps you reduce security risk since they are recognized as some of the comprehensive in cloud computing applications.

Implementing ISO 27018 controls and earning a certification also helps protect your business against charges of negligence or recklessness in the event that a breach was to occur.

Negligence charges can often incur more severe penalties ([as Equifax found out in 2019](https://www.theverge.com/2019/7/22/20703497/equifax-ftc-fine-settlement-2017-data-breach-compensation-fund)). But if a business is using a well-defined, risk-based approach to protect users’ personal data, it not only decreases the likelihood of a breach, but that also evidences a company’s focus on security.

The same goes for customers of cloud service providers. Working with ISO 27001/27018-certified cloud providers shows regulators you’re taking important steps to protect your users’ personal data.

### 3. Streamlined Sales Processes

Corporate security is a major friction point for a lot of IT sales deals. ISO 27018 helps reduce that friction because it simplifies the amount of information required for corporate security to sign off.

Instead of a long drawn out inquisition or questionnaire from prospective customers, an ISO 27001/27018 certified cloud service provider can simply have their customers review their Statement of Applicability (a list of in-scope security controls and implementation) to provide them the assurances they need to close the deal.

### 4. Better Security For A Postpandemic World

Cloud computing usage is rising at a significant rate ([spending is up 37% in 2020](https://www.pwc.com/us/en/industries/tmt/library/covid19-cloud-infrastructure.html), according to PwC) due to an [increase in remote work](https://news.gallup.com/poll/321800/covid-remote-work-update.aspx) as a result of COVID-19. This increase has also led to an increase in cyberattacks across the globe, according to [Interpol](https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-report-shows-alarming-rate-of-cyberattacks-during-COVID-19) and the [U.S. Chamber of Commerce](https://www.uschamber.com/series/above-the-fold/the-evolution-of-cybersecurity-threats-during-covid-19-and-what-you-can-do).

However, while many workers have already returned to the office, as of the end of 2020, [a survey by PwC](https://www.pwc.com/us/en/library/covid-19/us-remote-work-survey.html) shows that remote work will likely stay commonplace even after the pandemic is over. As a result, cloud usage will likely remain high to accommodate remote workers, and ISO 27018 compliance will continue to remain beneficial after COVID-19 is long gone.

## ISO 27018 Controls and Compliance

If you’re serious about following the controls laid out in ISO 27018 or earning an ISO 27001 certification, we highly recommend you read both standards to familiarize yourself with all that is required of you. 

To get a better feel for what you need to prepare for, here is an overview of the controls laid out in ISO 27018 and the process for certification through ISO 27001.

### ISO 27018 Controls Overview

The requirements below are a guideline for cloud service providers on how to update their procedures, technology, infrastructure, etc., in order to follow the controls laid out in ISO 27018.

Some of these recommendations will likely feel familiar, as they show up in regulations like the [GDPR](https://auth0.com/blog/your-quick-gdpr-compliance-checklist/) (just one example of how the ISO 27018 guidelines can help you meet regulatory requirements in different countries):

1. **Always process customer data according to a customer’s wishes**. Basically, you’ll need to show that you’re only using PII the way(s) its owners have explicitly said you can. Meaning, if a user says you’re not allowed to use their information for marketing and advertising, you should have processes for ensuring that never happens.
2. **Help cloud customers provide their users access to their data when they request it**. Or, in plain English, if your customers’ customers want to access their data, you need to have the processes and technology set up to help them do that.
3. **Enable cloud customers to comply with their notification obligations in the event of a data breach**. If breached, cloud service providers should help provide their customers’ visibility into their own data.
4. **Share information with the minimum required parties**. Basically, keep data private unless you’re required to turn it over. This helps keep personal information safe.
5. **Tell your customers about any subprocessors in your contract with them**. This includes notifying your customers about any location(s) where that data is being processed.
6. **Ensure you have a policy for disposing of (or returning) data that is no longer in use**. For example, if a customer ends their service agreement with you, you must have a plan for what to do with their data.
7. **Have your operations regularly reviewed and audited by a third party**. Certification is required annually by a third party. But if you make significant changes to your processing procedures, you’ll also need a third party to review them.
8. **Ensure that every employee with access to your customers’ data is under NDA**. This adds accountability and legal protection in the event that one of your employees is responsible for sharing data when they’re not supposed to.
9. **Ensure that your staff has adequate training**. All of your employees who have access to your customers’ data should be trained to handle it in accordance with ISO 27018 guidelines.

### ISO 27001 Certification Process Overview

As mentioned above, ISO 27018 certification is part of the certification process for ISO 27001 for cloud service providers. Certification for ISO 27001 is required every three years and is determined by an ISO-accredited third party. It typically happens in two stages:

1. **Stage 1: An informal review of your information security management system (ISMS)**. The purpose of Stage 1 is to familiarize auditors with your organization. During this stage, auditors will check up on key documentation and procedures (to ensure they exist).
2. **Stage 2: A formal compliance audit**. In Stage 2, auditors will perform detailed tests of your ISMS against the requirements in ISO 27001 and 27018, looking for evidence that it meets the requirements laid out in the standard. If your ISMS passes this stage, you’ll achieve certification for the year.

After certification, you’ll be required to participate in annual surveillance audits to ensure ongoing compliance. If your ISMS is on the newer side, they could occur several times a year to ensure that everything is in order.

## Are ISO 27018 Controls Worth Implementing?

While the controls laid out in ISO 27018 are not legally required, it’s a really good idea to follow them if you’re a cloud service provider who processes PII&mdash; especially if you’re doing business internationally.

It’s true that the costs of certification through ISO 27001 can be prohibitive for some (certification costs vary from business, depending on the size of your business, the scope of your cloud utilization, etc.). But a data breach isn’t cheap either ([$3.86M](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/), on average).

And although certification won’t prevent a breach altogether, the controls ISO 27018 recommends certainly can improve your chances of avoiding one (you’ll also have better coverage in the event a breach does occur), even if you don’t pursue a certification.

Especially when you consider the impact a breach can have on your brand ([65%](https://www.centrify.com/media/4772757/ponemon_data_breach_impact_study_uk.pdf) to [80%](https://www.forbes.com/sites/forbestechcouncil/2017/12/08/mind-the-trust-gap-how-companies-can-retain-customers-after-a-security-breach/#40b4b2806c95) of consumers lose trust in a company that’s been breached)!

<include src="asides/AboutAuth0" />


What Is ISO 27018:2019? Everything Executives Need to Know

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Advanced contextual-based feature only triggered by risky logins, mitigating hacking attacks, and reducing threat of data breaches while preserving user experience.



**BELLEVUE, Wash. – Dec. 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Adaptive Multi-factor Authentication (MFA)](https://auth0.com/blog/auth0-introduces-adaptive-mfa), a sophisticated security feature that helps reduce the threat of hacks and data breaches. Adaptive MFA is an important addition to Auth0's expanding security portfolio&mdash;which also includes Bot Detection, Breached Password Detection, Brute Force Protection, and Suspicious IP Throttling&mdash;and is one of the platform's most advanced context-based security features.

Adaptive MFA is designed to help companies address the inherent challenges of enabling security while preserving user experience. Unlike traditional MFA, which is triggered upon every login attempt and creates an additional step for the end user, Adaptive MFA only appears when a login is deemed risky. This is calculated by an overall risk score that measures abnormal behavior from known devices, impossible travel, and/or IP reputation. Customers can have the confidence that with Adaptive MFA, their end users are asked for secondary authentication only when behavioral signals don't conform to usual patterns for a particular user. 

For example, for a user who normally signs into their account at the same time every morning in San Francisco from a personal laptop, Adaptive MFA would only present a second-factor authenticator if login was attempted outside of the region, usual timeframe, or from a different computer or IP address. Developers can determine how much weight each signal is given to define the risk score that sets off the trigger. 

Many companies are reluctant to implement MFA&mdash;proven to be an effective defense against account hacking attacks&mdash;out of fear of negatively impacting user experience and thus their conversion and retention performance. However, additional friction during the signup, login, or checkout experiences can affect user conversion/retention, resulting in lost sales, and can potentially increase support incidents. Forrester predicts that the MFA market will grow to $2 billion by 2023[1], and this anticipated growth signals the need for a more intelligent and contextually-based MFA solution.   

"Auth0's mission is to provide secure access for everyone. Securing identities is core to that mission, and this new capability adds to the already powerful features in our security profile, designed to counter a variety of sophisticated threats, such as automated attacks, account takeovers, and phishing attacks," said Shiven Ramji, Chief Product Officer at Auth0. "Adaptive MFA should be a key consideration for any enterprise that has previously had to make a tradeoff between security and user experience. The ability to reduce friction while increasing security is a competitive differentiator for our customers."

More detailed information on Adaptive MFA can be found here: [When is MFA the Right Choice?](https://auth0.com/resources/whitepapers/is-mfa-the-right-choice) (whitepaper) and on Auth0's [Multi-factor Authentication](https://auth0.com/multifactor-authentication) page.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />

(1): Forrester Analytics: IAM Software Forecast, 2018 to 2023 (Global)


Auth0 Launches Adaptive MFA to Increase Security and Reduce Friction for End Users

How to manage third-party assets in order to mitigate security risks while developing and maintaining your web application.

Security risks may arise in your applications not just from your own code but also from third-party dependencies. Learn how you can protect your web applications from vulnerabilities that come from third-party assets.

## Third-Party Assets Risks

Building web applications requires special attention to security issues since they are publicly accessible. As a developer, you should make sure that your applications are reasonably protected from [the most common security concerns](https://auth0.com/blog/developers-guide-to-common-vulnerabilities-and-how-to-prevent-them).

However, your effort to build secure web applications may be nullified by vulnerabilities that may exist in third-party assets such as library packages, JavaScript scripts, or CSS files. Those external resources may contain vulnerabilities that affect your application. In other words, a vulnerability in a third-party asset becomes a vulnerability in your application.

What are the risks you may face with third-party vulnerabilities? They are basically the same risks you can have with vulnerabilities in your own code:

- exposure to [Cross-Site Scripting (XSS)](https://auth0.com/blog/cross-site-scripting-xss/)
- being subject to [Cross-Site Request Forgery (CSRF) attacks](https://auth0.com/blog/cross-site-request-forgery-csrf/)
- predisposition to [clickjacking tricks](https://auth0.com/blog/preventing-clickjacking-attacks/)
- injection flaws and other common attacks

However, you may have additional risks due to potential deliberate malicious code in any of your project's dependencies. For example, this malicious code may expose you to:

- loss of confidential and personal data
- unauthorized access to systems and other applications
- downtime of system infrastructure

A few notorious cases, like [the `event-stream` package threat](https://medium.com/intrinsic/compromised-npm-package-event-stream-d47d08605502) or [the Equifax incident](https://www.cnet.com/news/equifax-ceo-data-breach-heres-what-went-wrong/), are emblematic examples of what can happen if you neglect third-party packages security.

Let's discover what you can do to mitigate such risks.

<include src="TweetQuote" quoteText="A vulnerability in a third-party asset becomes a vulnerability in your application."/>

## Best Practices to Mitigate Risks

To mitigate the risk of introducing vulnerabilities in your web application due to third-party assets, you should set up a structured process in your development flow. This process is basically composed by four steps:

- Assets inventory
- Dependencies analysis
- Risk assessment
- Risk mitigation

Let's take a look at each of these steps.

### Assets inventory

The first step in this process is to know what dependencies your web application is using. This may seem a naive assertion, but, honestly, do you actually know how many dependencies your application uses?

Think of the `node_modules` folder of your Node.js project or the [global packages folder](https://docs.microsoft.com/en-us/nuget/consume-packages/managing-the-global-packages-and-cache-folders) for .NET Core solutions or the equivalent for other programming languages and development environments. They usually contain a lot of packages. Maybe you installed a few of them, but most likely, they depend on other packages. So, you end up having a significant amount of code you have not written in your project. And the more uncontrolled code you have in your codebase, the more likely you introduce vulnerabilities into your application.

Also, don't forget to consider even scripts or stylesheets you include in your client applications, regardless of whether you include a bundled copy of them or link to a *Content Delivery Network* (CDN). Think of [jQuery](https://jquery.com/download/) and [Bootstrap](https://getbootstrap.com/docs/4.5/getting-started/download/) assets or the [Google Analytics tag](https://developers.google.com/analytics/devguides/collection/analyticsjs), for example.

Knowing exactly which dependencies your project uses is fundamental to know the associated risks and to mitigate them. This step may also give you the opportunity to think about the real need for each third-party dependency.

### Dependencies analysis

Once you list the dependencies used in your project, you should inspect them to search for vulnerabilities.

If the dependency comes from an open-source project, you can check its code. Otherwise, you can consult the vendor's security bulletins or check out specialized databases such as the [National Vulnerability Database](https://nvd.nist.gov/).

Of course, manually checking all your dependencies is not feasible. You should use tools that automate this task for you. For example, if you use GitHub as your code repository service provider, you should regularly receive [security vulnerabilities alerts](https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies) that may affect your projects' dependencies. They also provide automated pull requests via [Dependabot](https://github.com/dependabot).

Even *npm* provides you with the ability [to check for security vulnerabilities in your Node.js projects](https://docs.npmjs.com/auditing-package-dependencies-for-security-vulnerabilities). You can launch this inspection by typing `npm audit` in a terminal window. You can also automatically update your npm dependency by running `npm audit fix`.

Alternatively, you can use [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/), a tool from OWASP that integrates with other code management systems such as Maven, Gradle, Jenkins, and others. Or you can use the [OWASP Dependency-Track](https://owasp.org/www-project-dependency-track/) platform to identify security risks with a structured and advanced approach.

Whatever tool you use, the result of this analysis step is a list of the vulnerabilities that affect your dependencies and their severity.

### Risk assessment

Of course, your hope is to get an empty vulnerability list for your dependencies. However, the chances are that you detect a few security risks affecting your application. In this case, you have to make some decisions.

Usually, your decisions depend on your answers to the following questions:

- How severe is that vulnerability?
- Is there any available fix?
- What is the effort to fix the vulnerability?
- Is this vulnerability relevant to your application?

You may think that if a new version of your dependency fixes that vulnerability, you have to install that update. However, updating a dependency is not always a smooth task. You need to be sure that that new version doesn't break your application or other dependencies. Also, you need to make sure that the new version is not introducing new security issues. You need to balance the effort of upgrading and the benefits it brings.

Maybe you can find vulnerabilities that actually don't affect your application, so you can postpone the dependency upgrade to a later time. In other words, in some circumstances, you can decide to accept the risk represented by the security issue you discovered in a dependency.

So, this step of the mitigation process is basically a thoughtful reasoning about the risks and benefits of taking an action over the issues. To learn more about this decisional process, take a look at [the OWASP Vulnerable Dependency Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerable_Dependency_Management_Cheat_Sheet.html).

### Risk mitigation

Now you have a clear picture of the situation. You may have vulnerabilities that can be temporarily ignored, but you may have issues that need to be fixed.

If a fix for a vulnerability exists and the upgrade is straightforward for your application, you should apply it. In case there's no fix for a vulnerability affecting one of your dependencies, you have two choices:

- Collaborating with the author/vendor of the dependency to solve the vulnerability.
- Find a workaround to prevent the vulnerability exploitation.

At the end of this process, you should have addressed the most dangerous vulnerabilities that could affect your application.

<include src="TweetQuote" quoteText=" By using third-party dependencies, you are taking responsibility for code you did not write."/>

## Keeping Risk Mitigation Under Control

Even if you have been able to ensure an acceptable level of risk with your dependencies, you can't relax yet. Your codebase is a live environment. Even if you don't change your code, your third-party assets may change without you realizing it. Just a simple rebuild can add uncontrolled code to your project. The same situation may happen without any build process when you use a third-party script or CDN.

You may have different scenarios depending on the type of project and its configuration. Let's see how to deal with those issues.

### Locking Server-Side Assets

Most modern development environments rely on centralized remote registries for dependency management, such as, for example, [npm](https://www.npmjs.com/), [NuGet](https://www.nuget.org/), [Maven](https://search.maven.org/), [Packagist](https://packagist.org/), and others. Even a simple rebuild of your project may trigger the download and installation of dependency updates without you realizing it.

Of course, it depends on your package manager configuration. Let's take *npm* as an example. It is the standard Node.js package manager, and it relies on the `package.json` configuration file to track a Node.js project's dependencies. This is an example of `package.json` file:

``` json  
{
  "name": "my-app",
  "version": "1.0.0",
  "description": "This is my application",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "axios": "^0.19.2",
    "express": "^4.17.1"
  }
}
```

It declares that the current project depends on [axios](https://github.com/axios/axios) version 0.19.2 and [Express](https://expressjs.com/) version 4.17.1. However, the caret (`^`) before the version number tells the package manager that any compatible version with the current one can be installed. Following the [semantic versioning convention](https://docs.npmjs.com/cli/v6/using-npm/semver), this means that the package manager is allowed to install any patch below version 0.20.0 for axios and any patch and minor fixes below version 5.0.0 for Express.

Say you found no security issues in the current versions of those packages. With this configuration, you may add an uncontrolled version of those dependencies in your project with the risk of introducing new vulnerabilities.

You have two ways to fix the dependency versions of your Node.js project:

- Specify the exact version of your dependencies in `package.json` by removing any [range indicator](https://docs.npmjs.com/cli/v6/using-npm/semver#advanced-range-syntax).
- Consider the `package-lock.json` file as an integral part of your project and commit it into your source code repository (see [the `package-lock.json` documentation for more information](https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json)).

You may have the same problem with other package managers. For example, in .NET you can specify a reference in your project as in the following example:

``` xml  
<Project Sdk="Microsoft.NET.Sdk.Web">



  <PackageReference
    Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication"
    Version="3.2.*" />



</Project>
```

In this case, NuGet will install the highest stable package version starting with 3.2. Again, you are not sure of the specific version you are running in your application. So, use a specific version for your dependency to make sure you are getting the package you trust. Check out [the NuGet package versioning document to learn more](https://docs.microsoft.com/en-us/nuget/concepts/package-versioning).

### Locking Client-Side Assets with Subresource Integrity

Hosting scripts and stylesheets on a CDN is a common practice. It helps to reduce bandwidth consumption and improve performance. However, that code is out of your control. The code maintainer may apply changes to it, or an attacker can replace it with malicious code without you realizing it.

Using third-party CDNs exposes your application to a potential security risk. How can you mitigate this risk?

The typical approach to mitigate it is to apply [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity). This standard feature, supported by all recent browsers, allows you to block any third-party asset that changed since your latest security review. Let's take a quick look at how Subresource Integrity works.

Assume you have a reference to React in your HTML page as in the following:

``` html  
<script src="https://unpkg.com/react@17.0.1/umd/react.production.min.js">
</script>
```

This reference uses [the unpkg CDN](https://unpkg.com/) to load a specific version of React. Indicating a specific version is a good practice to make sure you have the exact version of a library you already verified. In the unpkg CDN, if you just indicate a major version of a library, for example, `react@17`, you will get the most recent update of that library. So, similarly to npm, you specify version 17 but will get version 17.0.1 and subsequent patches and minor updates.

However, even if you specify a given version of your library, you may not be sure if the code has not been tampered with, say, after an attack. You may also need to use libraries or scripts that don't provide any explicit version number.

The Subresource Integrity feature ensures that the third-party asset has not been changed since your latest security review. To enable that feature, you need to add two attributes to the script element seen above. The protected script would appear like the following:

``` html  
<script src="https://unpkg.com/react@17.0.1/umd/react.production.min.js"
  integrity="sha256-Ag0WTc8xFszCJo1qbkTKp3wBMdjpjogsZDAhnSge744="
  crossorigin>
</script>
```

You added the `integrity` and `crossorigin` attributes to the `<script>` tag.

The value of the `integrity` attribute is [the hash value](https://en.wikipedia.org/wiki/Hash_function) of the third-party asset. It is represented by a string in the form `algorithm-hash`. In the example above, the algorithm is `sha256`, and the actual hash value is `Ag0WTc8xFszCJo1qbkTKp3wBMdjpjogsZDAhnSge744=`.

The `crossorigin` attribute enables the browser to requests the asset to the server and to check its integrity. Without `crossorigin` the browser will load the asset independently on its integrity.

When the browser loads the asset from the CDN, it will compute the file's hash value. If the value is equal to the value specified in the `integrity` attribute, the asset is loaded. Otherwise, the asset will be blocked, and an error will be thrown in the browser's console, as in the following picture:

![Invalid integrity hash value in Chrome console](https://images.ctfassets.net/23aumh6u8s0i/6momWxXgjwk5VKmpXM1N0s/f87bfd27e0d5330ee52568756d524962/chrome-console-invalid-hash)

The console shown above is from Chrome. In this specific browser, the error message also provides the expected correct value for the hash. So, you can leverage the Chrome console as a manual tool to compute the value for the `integrity` attribute as a side effect of the integrity verification.

> Consider that not all browsers generate an error message with the expected hash value.

Alternatively, you can use the [SRI Hash Generator](https://www.srihash.org/), an online tool that generates the whole script tag with the computed `integrity` value.

If you prefer a command-line tool, you can use `shasum` in a Linux-based environment. In this case, you need to download the asset on your machine to calculate the hash value. Assuming you downloaded the React library file on your machine, the command you need to run looks as follows:

``` bash  
shasum -b -a 256 react.production.min.js | awk '{ print $1 }' | xxd -r -p | base64
```

This will show the computed hash value on your screen.

You can also use [openssl](https://www.openssl.org/) to generate the hash value. This is the command you have to run:

``` bash  
openssl dgst -sha256 -binary react.production.min.js | openssl base64 -A
```

> So far, you have seen an example of protecting from an external script with Subresource Integrity. Additionally, the same mechanism applies also to CSS files. To protect your application from external stylesheets, you can use the same `integrity` and `crossorigin` attributes for the `<link>` tag.

<include src="asides/AboutAuth0" />

## Conclusion

Throughout this article, you learned that writing your code with security in mind may not be enough to make your application secure. You also need to pay attention to third-party assets. Once you add them to your application, they become a part of it, with any potential vulnerability they may have.

The article suggested the best practices you should follow to keep your third-party assets under control. First, you should know what your third-party assets are, which vulnerability they may be affected by, and which level of risk they bring to your application. Then, once you reach an acceptable security risk level, you need to freeze the current situation to avoid unwanted updates or tampering. You can do it by locking package versions on the server side and using Subresource Integrity on the client side.

To learn more about managing vulnerabilities of third-party dependencies, check out the [OWASP Vulnerable Dependency Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerable_Dependency_Management_Cheat_Sheet.html).

Managing Third-Party Assets Security Risks in Your Web Apps

How to tell if your business at risk of user impersonation and what to do about it



Broken authentication is an umbrella term for several vulnerabilities that attackers exploit to impersonate legitimate users online. Broadly, broken authentication refers to weaknesses in two areas: session management and credential management. Both are classified as broken authentication because attackers can use either avenue to masquerade as a user: hijacked session IDs or stolen login credentials.

Attackers employ a wide variety of strategies to take advantage of these weaknesses, ranging from huge [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) to highly targeted schemes aimed at gaining access to a specific person’s credentials.

In recent years, broken authentication attacks have accounted for many of the [worst data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/), and security experts sound the alarm about this underrecognized threat. The [Open Web Application Security Project (OWASP)](https://owasp.org/www-project-top-ten/) has included it in its “Top 10” list of the biggest web application security risks since 2017. By 2020, broken authentication had climbed to the number two spot.

Below, we’ll explain what weaknesses are associated with broken authentication and how businesses can guard against them.

<include src="ebook-ads/BrokenAuthChecklist" />

## Session Management Flaws Open the Door to Attacks

Session management is part of broken authentication, but the two terms are often listed side by side so people don't assume that “authentication” refers only to usernames and passwords. Since web applications use sessions and credentials to identify individual users, attackers can impersonate them using either mechanism.

### Session Management Basics

A [web session](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) is a sequence of network transactions associated to the same user within a period of time. Let’s say you go to a social media website and browse for a while before logging in to your account. You find an interesting post where you want to comment, which requires you to log in. Once you leave a few comments, you log out and close the web browser window or tab. Everything you did from the moment you arrived to the website was a session. Web applications can track sessions before and after authentication.

Web applications issue every user a unique session ID for each visit, which allows the web app to communicate with the user as they move through the site. These [session IDs commonly take the form of cookies and URL parameters](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-management-implementation).

Session management concerns how you define the parameters of that session. For instance, how long can a session last before you automatically log a user out? How do you issue and revoke session IDs? How securely are they linked to a user’s IP address?

> Auth0’s long-lived sessions can help you improve user experience and reduce password reset costs. [Learn how to balance user experience and security to retain customers](https://auth0.com/blog/balance-user-experience-and-security-to-retain-customers/).

It's important to note that a user establishes an authenticated session with the web application once the user logs in. Consequently, OWASP states that the session ID of an authenticated session is temporarily equivalent to the strongest authentication method used by the application, such as username and password. **A hijacked session ID is as strong as a stolen login credential**.

### Session Management Attacks

#### Session Hijacking

Without appropriate safeguards, web applications are vulnerable to [session hijacking](https://auth0.com/blog/developers-guide-to-common-vulnerabilities-and-how-to-prevent-them/), in which attackers use stolen session IDs to impersonate users’ identities. The most straightforward example of session hijacking is a user who forgets to log out of an application and then walks away from their device. A hacker can then continue their session.

#### Session ID URL Rewriting

Another common avenue for session hijacking is “URL rewriting.” In this scenario, an individual’s session ID appears in the URL of a website. Anyone who can see it (such as via an unsecured Wi-Fi connection) can piggyback into the session. This is how [Zoombombing](https://www.cnet.com/how-to/how-to-prevent-zoombombing-in-your-video-chats-in-4-easy-steps/) happened.

#### Session Fixation

One commonly overlooked best practice is to rotate session IDs after a user logs in, instead of giving a user the same ID before and after authentication. Web applications that fail to do this are vulnerable to a [session fixation](https://owasp.org/www-community/attacks/Session_fixation) attack, which is a variation of session hijacking.

According to [Troy Hunt](https://www.troyhunt.com/learn-ethical-hacking-and-session/), the main idea behind a session fixation attack is that the attacker _predetermines_ the session ID the victim will use. The attacker then may send the victim a link that contains the predetermined session ID. The link will point to a resource that requires the victim to log in.

If the web application persists the authentication state of the victim in the session, the attacker can use that predetermined session ID to impersonate the victim after the victim logs in. Whether the attacker or the victim present that session ID to the server, the server will establish that the session ID corresponds to an authenticated session and grant access to protected resources.

Developers can prevent the attacker from following the victim by making the web application issue the legitimate user a new session ID after logging in. When the web application rotates the session ID, the predetermined session ID becomes useless.

![Hackers](https://images.ctfassets.net/23aumh6u8s0i/15UY9ZPvcKOsqy9pM078pc/65fe774d42beeaa18fb8ebb418810739/WhatIs_Broken_Auth_sep-1)

## Attackers Exploit Weak and Compromised Credentials

In recent years, attackers have discovered that the easiest way to access off-limits systems is to log in with someone else’s credentials. According to [Verizon’s 2020 Data Breach Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf), phishing and using stolen credentials are now the two most common mechanisms to execute a data breach. They report that “hacking and even breaches in general... are driven by credential theft.”

Malicious actors use various methods to steal, guess, or trick users into revealing their passwords.

#### Credential Stuffing

When attackers access a database filled with unencrypted emails and passwords, they frequently sell or give away the list for other attackers to use. These attackers then use botnets for brute-force attacks that test credentials stolen from one site on different accounts. This tactic often works because people frequently use the same password across applications. 

![Credential Stuffing](https://images.ctfassets.net/23aumh6u8s0i/aklnhl37XxWkoCKLY0OTK/e5874c9f07ef7e4b7f5d7ceb6b220bc1/anatomy-credential-stuffing)

There are currently billions of compromised credentials available to attackers. Most of the time, users don’t even know that the password they’ve been using since high school just became a skeleton key for all their accounts.

#### Password Spraying

Password spraying is a little like credential stuffing, but instead of working off a database of stolen passwords, it uses a set of weak or common passwords to break into a user’s account. A [2019 survey by the UK's National Cyber Security Centre (NCSC)](https://www.cnn.com/2019/04/22/uk/most-common-passwords-scli-gbr-intl/index.html) found that 23.2 million accounts used “123456” as their password, while millions more used sports names, curse words, and the ever-popular “password".

Password spraying is a type of brute-force attack, but it often slips by automatic lockouts that block IP addresses after too many failed login attempts. It does this by trying the same password, one user at a time, rather than trying password after password on a single user.

#### Phishing Attacks

Attackers typically [phish](https://auth0.com/blog/phishing-goes-viral-covid-19-themes-in-cybercrime/) by sending users an email pretending to be from a trusted source and then tricking users into sharing their credentials or other related information. It can be a broad-based attempt that hits everyone at an organization with the same phony email, or it can take the form of a “spear phishing” attack tailored to a specific target.

Spear phishing can be particularly useful to attackers. They can use that attack technique to manipulate someone’s emotions based on their personal information. For example, an email with the subject line “pictures of your sister” is much more effective if it mentions your sister’s name.

[The 2020 CrowdStrike Services Report](https://www.crowdstrike.com/blog/2019-services-report-key-findings-part-1/) found that 35% of successful network breaches started with a spear phishing attack in 2019. Attackers had different mechanism to lure their victims through spear phishing: 19% used attachments, 15% included a malicious link, and 1% employed spear phishing via a service.

By now, most organizations are familiar with phishing attacks and warn their customers not to open suspicious emails. Despite that, the [2017 Phishing Resiliency and Defense Report by Cofense](https://cofense.com/phishing-resiliency-%20report-2017/) found that “organizational susceptibility” to phishing was still around 5%. If you have 20 employees, one of them might still click a phishing email.

## How to Fix Broken Authentication in Your Organization

Broken authentication attacks are devastating and common, but they are also highly preventable. By putting a few safeguards in place, you can make your organization a much less appealing target for attackers.

### Update Session Management

#### Control Session Length
Every web application automatically ends sessions at some point, either after logout, a period of no activity, or a certain length of time. Tailor your session length to the type of user and the application they’re using.

A streaming-video service might want their sessions to be weeks long, so users can navigate straight to Netflix without having to log in every time. But a banking app should automatically log users out after a few minutes since the risk of a hijacked session is much higher.

#### Rotate and Invalidate Session IDs
As we discussed, the best way to prevent session fixation is to issue a user with a new session ID after login. Similarly, sessions and authentication tokens must be immediately invalidated after a session ends, so attackers can’t reuse them.

#### Don’t Put Session IDs in URLs
There are so many ways that URL rewriting can end up exposing session IDs, so your safest bet is not to go that route. Use cookies generated by a secure session manager.

![Scare_Off_Hackers](https://images.ctfassets.net/23aumh6u8s0i/3Cu6Hhk4uxBk10a168mv7g/b7d9b0fcd37582dd087327574361ff8b/WhatIs_Broken_Auth_sep-2)

### Tighten Password Policies

#### Implement Multi-Factor Authentication (MFA)

[OWASP’s number one tip](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A2-Broken_Authentication) for fixing broken authentication is to “implement multi-factor authentication to prevent automated, credential stuffing, brute force, and stolen credential reuse attacks.”

Given how vulnerable passwords are to credential stuffing and password spraying, it’s clear that they are no longer adequate to secure an account. MFA provides an extra level of security by demanding an additional credential that’s harder for attackers to fake, such as a biometric scan or one-time code.

#### Don’t Permit Weak Passwords

When designing your application’s login page, OWASP recommends following [NIST guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret) on password length and complexity. They also advise automatically rejecting any of the most common passwords on the web.

Use an identity and access management (IAM) platform that helps you create and implement a password strategy easily. The platform should also provide you with login and signup pages with forms that enforce your password policies. [Auth0 Universal Login](https://auth0.com/universal-login) offers you that secure login infrastructure to authenticate your users to your apps.

#### Don’t Store Passwords in Cleartext

A strong password storage strategy is critical to mitigate data breaches that put the reputation of any organization in danger. Hashing is the foundation of secure password storage. The [premise of hashing is simple](https://auth0.com/blog/how-secure-are-encryption-hashing-encoding-and-obfuscation/#What-is-Hashing-): given arbitrary input, output a random string of a specific length.

What's important to highlight is that the hashing operation is irreversible. An attacker cannot determine the original password by looking at the hashed password. However, if two users choose the same password, the hash will be the same. You can add random data to the password to guarantee that the output of the hashing process is unique. [This random data is known as a "salt"](https://auth0.com/blog/adding-salt-to-hashing-a-better-way-to-store-passwords/).

Due to the properties of hashing mentioned above, you don't need to encrypt the hashed password before you store it in the database. [When a user attempts to log in](https://docs.oracle.com/cd/E26180_01/Platform.94/ATGPersProgGuide/html/s0506passwordhashing01.html), your web application uses the supplied password as input to a hashing function and compares the output to the database value. If the password hashes match, the login is successful.
 
Hashing with salts can protect you against different attack vectors, such as rainbow table attacks, while slowing down dictionary and brute-force attacks. 

Use an identity and access management (IAM) platform that helps you prevent critical identity data from falling into the wrong hands. Auth0 never stores passwords in cleartext. Passwords are always hashed and salted using [bcrypt](https://auth0.com/blog/hashing-in-action-understanding-bcrypt/), an industry-grade and battle-tested algorithm. Additionally, Auth0 encrypts both data at rest and in motion. All network communication uses TLS with at least 128-bit AES encryption. Auth0 built state-of-the-art security into its platform to protect your business and your users.

#### Use Breached Password Protection

Use an identity and access management (IAM) platform with [breached password protection](https://auth0.com/docs/anomaly-detection/references/breached-password-detection-triggers-actions). When the platform discovers a compromised credentials cache, it will notify you if any of your users were compromised. Those users will be locked out until they change their passwords, so attackers can't use their compromised passwords against you in a credential stuffing attack.

### Guard Against Attacks

#### Conduct Workplace Phishing Training

Teaching your workforce how to spot malicious emails is a project you must take seriously and update frequently. As phishing attacks get more sophisticated, they become harder to spot, and the only way to combat this threat is to keep your staff informed.

#### Implement Brute-Force Protection

Attacks involving broken authentication can compromise not only your data but also crash your site. [Traffic can spike by 180x](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) during a credential stuffing attack, so brute-force protection is an absolute must to stay online. It works by limiting the number of times a specific IP address can attempt to log in, so bots can’t flood your system.

#### Employ anomaly detection

A sophisticated IAM system doesn’t look at just logins and session IDs to determine whether a user is legitimate or malicious. It should also flag other types of suspicious behavior. [Anomaly detection](https://auth0.com/docs/anomaly-detection) will alert you if, for instance, an employee logs off at 10 p.m. in North America and logs back on at 3 a.m. in Bangladesh.

## Address Broken Authentication, Discourage Attackers

Web applications will become more attractive to attackers as companies move more valuable and sensitive data to the cloud. Broken authentication has made it relatively easy for motivated attackers to slip by because even companies with big security budgets often overlook these basic security flaws. It’s a little like barring every window in your home while leaving the front door wide open.

Fortunately, you can deter attackers by putting the protocols we’ve discussed in place. To quote Verizon’s report: “Attackers prefer short paths and rarely attempt long paths. It means anything you can easily throw in their way to increase the number of actions they have to take is likely to decrease their chance of fleeing with the data significantly.”

To learn about how a dedicated IAM platform can help you address broken authentication, [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=reach%20out%20to%20the%20team%20at%20auth0).

<include src="asides/AboutAuth0" />


What Is Broken Authentication?

antoniofuentes

Antonio is a Product Manager in charge of features and functions used by thousands of customers implementing identity systems to keep their users safe and prevent malicious activity.

Product Manager, Continuous Auth

Antonio Fuentes

How Auth0 uses risk signals to detect and help you manage scripted, high-volume attacks on your identity flows



## The Problem

Attacks on an identity infrastructure using stolen credentials are a difficult problem to solve. [Credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) occur when a bad actor sends scripted, automated login attempts to an application or website in extremely high volumes, with the objective of gaining access to user accounts. This is an increasingly common problem: on any given day, up to 69% of login attempts on the Auth0 infrastructure are suspected to have originated from credential stuffing attacks. 

This type of attack can be quite sophisticated. Sometimes they come in the form of hundreds of thousands of login requests to a site in a short time window, at a very high velocity, and from a relatively small number of IP addresses from unusual locations. They can also come in the form of scripts that send traffic using tactics to dynamically evolve their velocity, location, and number of IP addresses to avoid detection.  

Generally, solving this problem involves a tradeoff between usability and security, in which user experience pays the price. Measures like multi-factor authentication (MFA) are effective in limiting the success rates for a script involved in a credential stuffing attack, but they also add friction for legitimate users. 

To tip the scale in favor of user experience, malicious bots and scripts need to be detected and rejected before a login call is even processed by the authentication server. Doing so enables you to limit the impact of credential stuffing attacks while delivering a better experience for the end user. 

## Bot Detection from Auth0

Auth0 is launching Bot Detection, the first in a series of features to detect credential stuffing attacks on the login flow. Once enabled, this feature will use a variety of signals to assess the likelihood that a login call originates from a scripted attack. If the risk assessment is high, a CAPTCHA step is inserted into the login flow. 

![Bot Detection](https://images.ctfassets.net/23aumh6u8s0i/3Fs7MAvNuLZTFJ20QOSw6m/63bf1b065314dd2bea4a7451782dfb6b/bot-detection-anomaly)

Bot Detection will be supported at launch with Auth0’s Universal Login experience. For customers who have built more customized user experiences using native SDKs such as `lock.js` and mobile SDKs such as a `lock.Android` and `lock.swift`, Auth0 will support an exception scenario so that customers can recognize a risky call and take steps to render a CAPTCHA step on the screen. The feature will also support presenting CAPTCHA using a generic flow or a customer’s own Google reCAPTCHA.

<table>
<tbody>
<tr>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/1sos7fOgZYGp148983HyH5/809ea54d105104de83c2e922fe22de7f/bot-captcha" alt="Bot Detection-1" width="396" height="602"/></td>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/1U3FsuEZ0rHL9kDNQv17J5/cb207f20b5eb8b676f1b2549866456dd/bot-captcha-2" alt="Bot Detection-2" width="382" height="735"/></td>
</tr>
</tbody>
</table>

## Mitigating Abuse with Auth0

Bot Detection will be the latest addition to Auth0’s collection of features designed to prevent abuse, including [Breached Password Detection](https://auth0.com/docs/anomaly-detection/breached-password-security), [Brute Force Protection](https://auth0.com/docs/anomaly-detection/brute-force-protection), and [MFA](https://auth0.com/docs/mfa). These features help customers mitigate the tradeoffs between security and usability without unnecessary compromises to user experience. 

## Learn More

* [Credential Stuffing Attacks: What They Are and How to Combat Them](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)
* [The Anatomy of a Credential Stuffing Attack](https://auth0.com/resources/webinars/credential-stuffing-attack-webinar)

Auth0 is the first identity management platform for application builders, and the only identity solution needed for custom-built applications. With a mission to secure the world’s identities so innovators can innovate, Auth0 provides the simplicity, extensibility, and expertise to scale and protect identities in any application, for any audience. Auth0 secures more than 100 million logins each day, giving enterprises the confidence to deliver trusted and elegant digital experiences to their customers around the world.
<include src="asides/AboutAuth0" />


Reducing the Impact of Credential Stuffing Attacks

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Gain cloud flexibility and agility while maintaining security and control


Amazon famously brought [book publishing “to its knees”](https://mashable.com/2014/07/30/amazon-has-killed-publishers-they-just-dont-know-it-yet/) by dominating distribution, creating eBooks, and transforming the publishing world with its own titles and opportunity for authors to self publish. 

In 2018, [Amazon entered the insurance market in India](https://www.insurancebusinessmag.com/us/news/breaking-news/amazon-set-to-file-for-insurance-licence-111581.aspx). [And in 2019, the U.S.](https://www.geekwire.com/2019/amazon-jpmorgan-roll-new-health-insurance-plans-part-haven-joint-venture/) 

After killing off [car insurance comparison tools](https://www.businessinsider.com/google-kills-auto-insurance-comparison-tool-2016-2), Google’s invested in [insurance agency software](https://www.insurancejournal.com/news/national/2019/01/02/513324.htm) and signaled further interest in the market. 

In other words, digital transformation is already here. 

While industry complexities afford some protection, they offer greater opportunity for insiders, says TechCrunch. 

A recent [J.D. Power survey](https://www.jdpower.com/business/press-releases/2019-us-home-insurance-study) on customer satisfaction with home insurance noted that the home insurance business model was “primed for change” and that “weak points in customer experience offered an opportunity for startups.” 

The other side of the desire for customer experiences that are real-time and online is the fact that FinServs are tasked with protecting hackers’ favorite data targets. And the [global rise in data privacy regulation](https://auth0.com/explore/data-privacy/) makes stronger protections important from customer, legal, and compliance perspectives.

While digital transformation can seem daunting for incumbents relying on decades of legacy code, the right identity solution can create seamless customer experiences while increasing your data protection — even if you’re an incumbent partnering with (or acquiring an) up and coming Insurtech startup.

Forbes expects [XaaS (everything as a service), UX, CX (User/Customer Experience), and digital privacy](https://www.forbes.com/sites/danielnewman/2019/07/14/top-10-digital-transformation-trends-for-2020/#3dfc8bdc76be) to “take center stage” in as a digital transformation trend 2020. Like other industries, the need to streamline services, reduce capital expenditures, and be increasingly agile and innovative is fueling FinServ’s change. But FinServ’s need for security, stability, and high availability kept many systems in On-Prem solutions that have proven expensive to scale and maintain — putting the ability to keep up with evolving customer expectations at risk.

For FinServ’s looking to innovate (or even just keep pace), Public Cloud is often touted as an option, but it isn’t the best choice. Public Cloud outages and uptimes provide a strong reason to go private. Auth0 Private Cloud helps (or eliminate) that risk, by providing a secure, flexible, extensible solution. 

![Deployment Options Diagram](https://images.ctfassets.net/23aumh6u8s0i/23TVeU9N9cKlxxrenpT6hA/ae7991f61be42885833856bed91a74f7/deployment_options_diagram)

## Why Is Private Cloud Particularly Suited for Finserv Environments

For many years, incumbent FinServs have been buffered by deep compliance capabilities and an established customer base. But FinTech disruptors have eroded that edge says a recent PWC [report](https://www.pwc.com/gx/en/financial-services/assets/pdf/technology2020-and-beyond.pdf), in part because successful disruptors are able to offer a stronger customer experience at a lower cost to customers and with less investment. 

To solidify standing and increase the customer base in this environment, FinServ’s need to:

* Improve customer experience
* Keep ahead of evolving data privacy regulations
* Reduce costs without sacrificing cybersecurity

The data that FinServs hold makes them a prime target for hackers — and the sheer company scale usually means millions of breached accounts, rather than thousands. Globally, the increase in data privacy laws like GDPR and CCPA demonstrates that regulators have lowered tolerance for breaches and expect greater protections to be in place. When not implementing features like multi-factor authentication (MFA) can hit an insurer with a large fine, like what happened to [Dutch public insurance company UWV](https://auth0.com/blog/gdpr-fines-hit-these-companies-hard-heres-how-to-avoid-them/), the need for greater security while still ensuring flexibility becomes more appealing.

<include src="TweetQuote" quoteText="The data that FinServs hold makes them a prime target for hackers — how Private Cloud can help."/>

From an identity perspective, let’s take a closer look at what Auth0 Private Cloud can mean for key digital transformation considerations.

### Performance at Scale
The most innovative solution in the world does zero good if it doesn’t offer you the performance you need.  Auth0 Private Cloud offers request-per-second (rps) baseline is higher than public cloud, with the option of adding on capacity up to 1500 rps.

### Reliable High Availability
FinServ is more aware than most industries the dramatic impact of service interruptions, especially given the pressures of changing global conditions. High availability helps guard against those challenges, especially since Private Cloud can be deployed between two regions to provide failover.

### Control & Segregation
Managed Private Cloud offers a fully-isolated development environment that is updated independently from the production environment. Standard Private Cloud is a single instance production environment. Both Standard Private Cloud and Managed Private Cloud meet standards that require all data to be housed within specific regions.

### Free Developers to Improve Customer Experience
For a developer coming up with an innovative solution while working only On-Prem can feel like trying to code while wearing handcuffs — it’s hard to even get your hands on the keyboard. 

To keep up with the pace of customer’s hunger for real-time innovations, streams of data from connected vehicles and smart homes, and the data privacy compliance requirements from laws like GDPR and CCPA, developers need not only the flexibility but also the scale of a [cloud deployment](https://auth0.com/cloud). And they need that deployment to be secure and reliable enough to handle the demands of enterprises whose customers are often interacting during moments of high stress or need.

### Unify Legacy and New Data Stores
Unifying legacy and new data stores can be a giant headache, as well as a source of weeks of downtime without a plug-n-play identity solution that allows bulk imports, but can also streamline user migration without expensive forced password resets – whether unifying stores at a single organization or when an incumbent partners or acquires an insurance startup.

### Support for Different Languages/Architectures (SDK)
Aside from unifying data stores, incumbent companies often rely on a maze of programming languages and architectures. Shutting down one part of the maze can have unexpected consequences if all the interrelationships aren’t fully mapped out or even understood due to poorly commented code or loss of institutional knowledge due to attrition or staffing turnover.

Your devs will be a lot happier (and more productive) when working with an identity solution that can handle multiple programming languages and architectures and already has SDKs (software development kits) that can be dropped into place to provide rapid access to functionality. And the right solution gives you the flexibility to map the maze at your own pace, reducing costs by removing unnecessary middleware, maintenance, and security as you deem appropriate.

### Extensibility
<iframe width="560" height="315" src="https://www.youtube.com/embed/kCmU4EMMPf0" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

The real world is a messy place where you might have an out-of-the-box tool that needs to be integrated with custom code. The ability to inject code into the Auth0 Identity solution means that developers can handle the last-mile customizations that execute on the C-suite’s business strategy without weeks of downtime or missed opportunities. To delve into this topic in greater technical detail, you might also check out Auth0 Principal Architect Vittorio Bertocci’s whitepaper “[The Tao of Extensibility.](https://auth0.com/resources/whitepapers/tao-of-extensibility)”

## Support and Failover
Uptimes, updates, failovers, and support can have a big impact on the success of your deployment. 

With Public Cloud coming in with an uptime SLA of 99.90%, Private Cloud offers a stronger uptime SLA of 99.95% with the option to upgrade to maxim uptime guarantees of 99.99%. Geo redundancy can provide resiliency against catastrophic events. As mentioned above, Private Cloud offers failover between two geographic regions. 

For teams that would appreciate additional support, Auth0 offers a support SLA as an add-on, as well as the add-on option to work with the skilled identity experts on our Professional Services team.

## Managed Private Cloud vs. Standard Private Cloud
Let’s take a look at the different deployment Private Cloud models and benefits, including a checklist to help you assess deployment needs.

**Standard Private Cloud** is a low touch engagement model that offers additional power, security and compliance* benefits through an isolated tenant just for a single customer. Uptime SLA is 99.95% with an upgrade possible to 99.99%. PCI compliance is available as an add-on.

**Managed Private Cloud** is a high-touch engagement model where customers are much more involved with all aspects of this deployment model. Our team will work closely with the customer to ensure all aspects of their Auth0 environment are tuned for what best suits their business needs. Uptime is 99.99%. PCI compliance is available as an add-on.

**Reasons to choose Managed Private Cloud**                                                                                                          * **Choice of update frequency**<br>Coordinated with Auth0 (required once per 3 months). The update cycle begins with the Pre-Production Environment.
* **A separate DEV (Pre-Production) environment**<br>Fully-isolated and independently updated instance for development and testing (Single Node)
* **On-demand scaling**<br>WIll scale customer environment for any spikes                                                                              * **Load Testing**<br>4x Load Testing per year with dedicated Auth0 MSE Support                                                 * **Customer-hosted AWS deployment**<br>More **control** over the environment                                                                              * **GEO-HA deployment option**<br>Datacenter **redundancy** and automatic **failure handling**.                                                               
<br>
**Reasons to choose Standard Private Cloud**
* ***Doesn’t require any of the Managed Private Cloud reasons***
* **More cost-effective**
* **Less involved with managing the deployment**<br>The customer is looking for an offering that feels similar to a standard Public Cloud SaaS but has isolation and the other advantages of our Private SaaS Deployments. |

<include src="TweetQuote" quoteText="Legacy code can make #digitaltransformation feel like a high hurdle for FinServs. Find out how Private Cloud can help securely smooth the jum"/>

## Reduce Risk, Increase Innovation With Private Cloud
Like identity, digital transformation is not a one-and-done solution, but an ongoing need to keep pace with the evolution of technological change. Auth0 Private Cloud provides the flexibility, agility offered by cloud deployments but allows FinServ’s to maintain the control and security they need to protect their customers and their businesses. Your IAM solution is a critical component of your security strategy, but even if you’re dealing with decades of legacy code, you don’t need to sit down and build it in-house. The more secure option is to let identity experts protect those critical credentials, freeing your team (and resources) to focus on what you do best. Identity no longer needs to be a roadblock or an afterthought. Identity Access Management (IAM) is an essential component of customer security and privacy. If you’d like to learn more about how Auth0 Private Cloud might work for your particular situation, please reach out to an [Auth0 resource](https://auth0.com/).


How FinServs Can Reduce Risk, Increase Innovation with Private Cloud

Healthcare AI and risk-prediction platform relies on Auth0 to connect healthcare providers and payers quickly and securely


**BELLEVUE, Wash. — June 10, 2019 —** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has been selected as the identity management platform for KenSci, a machine learning and artificial intelligence-powered risk prediction platform for healthcare. Recently having closed a successful round of funding, [KenSci](https://www.kensci.com/?utm_source=AIMed&utm_medium=PressRelease&utm_campaign=Press) is growing rapidly and will use Auth0’s authentication platform for thousands of healthcare users as it continues to scale.

KenSci is designed to help health systems across the globe improve the quality of care they provide at lower costs. Its machine learning-powered risk prediction platform helps healthcare providers and payers intervene early by identifying clinical, financial, and operational risk to save costs and lives. 

As its roster of healthcare clients continued to grow, KenSci realized the need for an outsourced identity management solution that was easily customizable. With the specialization required by their clients to provide access and authentication to the right parties, KenSci realized that managing the solution they had built in-house soon became a full-time job. After a thorough review of solutions, they selected Auth0 for its extensibility. 

“Auth0 really impressed us from the start, and the further we dug into it, the more it became clear that this was a natural extension of our platform,” said Ian Davies, Software Development Manager, KenSci. “Out-of-the-box, Auth0 covers about 80% of our clients’ needs, but it's really the last mile integration that requires a solution that we can modify for specific client requirements. We looked at several offerings, but Auth0 is the only identity management platform that offers the level of customization and flexibility we need.”

The sensitivity of healthcare data requires the utmost security when it comes to protecting user information. Auth0’s HIPAA-compliant platform enables authentication at any point of the customer’s journey, provides end-to-end protection, and allows for any custom-made requirements, as evidenced by KenSci.

“KenSci is bridging a major gap between healthcare providers and their clients, and making an impact in reducing their overall risk when it comes to healthcare decisions,” said Ghazi Masood, VP of Sales, Americas, for Auth0. “KenSci represents a large step in the modernization of healthcare and we are excited to be a part of its AI platform.”

<include src="asides/AboutAuth0" />

### Media Contacts

Kasia Hall<br/>
Matter for Auth0<br/>
[khall@matternow.com](mailto:khall@matternow.com)<br/>
971-246-7898


Auth0 Powers Authentication for KenSci to Enable Seamless Access to Quality of Care

Implement MFA, store minimal information, and take employee cybersecurity training seriously to minimize data breach risk.


The holiday season is the biggest shopping time of the year, and for that reason, it's also the most popular time of year for cybercriminals. 

If you’re a [retailer](https://auth0.com/retail), it's on you to ensure that your customers' data is safe. [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) hurt your customers and they hurt your reputation. 

With this post, we show retail teams how Auth0 can help them keep customers safe with three actionable tactics. 

While these strategies are critical during the holidays, they're also highly applicable throughout the year. Teams that take security seriously are those that will safely scale and thrive in 2019 and beyond.

## 1. Implement Multi-Factor Authentication

With data breaches of retailers on the upswing in 2018 — including ones at [Macy's](http://fortune.com/2018/07/11/macys-data-breach/)  and [Adidas](https://www.newsweek.com/adidas-breach-hack-us-website-customers-warned-their-data-has-been-hacked-1000974) — teams clearly need extra support. [Multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) delivers this. Implementing it correctly can make a huge difference in how secure your customers’ accounts are. 

MFA ensures that even if a data breach does occur and passwords are leaked, hackers still can't get into customer accounts. To do so, they need a second piece of sensitive information, like a customer's thumbprint, facial features, or mobile device.

With [Auth0 Guardian](https://auth0.com/multifactor-authentication), you can add MFA to your site simply and securely.

![Multifactor Authentication (MFA) with Auth0 Guardian](https://images.ctfassets.net/23aumh6u8s0i/4x4BhKDZLXWTlScCGVZ5B6/a53550e45f8a7d895b8ac2ae251c5a6d/multifactor-authentication-with-auth0-guardian.png))

After [installation](https://auth0.com/docs/multifactor-authentication/factors/push), retailers can easily switch on MFA push notifications. For your employees, it is a quick double-check that they are who they say they are (and that they can access sensitive customer data for work purposes). For your customers with the Guardian app, they receive a QR code on their device that they can scan before accessing their account. It's one more protective barrier to be sure they're not a hacker with the customer's credentials.  

With more than 80% of passwords having [inherent vulnerabilities](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/), MFA is a critical investment to seal your customer data from unwanted eyes during times of high activity.

## 2. Only store the data and information you need

Storing only essential customer data means that if someone does get into your system, there’s less to exploit. This is a key component of complying with the EU's [General Data Protection Regulation (GDPR)](https://auth0.com/gdpr). Some teams think that adhering to GDPR's strict standards is primarily to avoid hefty fines (the greater of €20 million or 4% of the global annual revenue); however, the standards are a must for protecting end users’ data and the integrity of your company.

If a cybercriminal does gain access to a company's confidential customer information, they can make off with:

* names
* email addresses
* mailing addresses
* phone numbers
* customer device information
* financial data
* personal details like age, race, and religion

[When hackers got into Under Armour's system](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) this year, they were able to access many customers' hashed passwords. Since studies show that people tend to [recycle their passwords](https://securityboulevard.com/2018/05/59-of-people-use-the-same-password-everywhere-poll-finds/), hackers have the ability to take these and access even more personal data in other accounts. The damage can quickly spiral out of control.

Storing less data can make you less of a target. You can also separate data, depending on how confidential it is. With [Auth0's user management solutions](https://auth0.com/user-management), you can restrict access to specific data sets for only the most privileged employees.

## 3. Train employees in the importance of cybersecurity

Training employees in the importance of data security is an often overlooked—but essential—pillar of protecting your customers’ data. Taking the time to bring them up to speed on the latest cybersecurity concerns early in their [onboarding process](https://www.intercom.com/blog/onboarding-focus-culture/) can help ensure that when the holidays roll around, they're on high alert.

When employees are aware of common hacks such as malware infiltration and phishing, they'll be able to recognize threats as they arise. And when they understand the reasons behind provisions such as automatic updates and multi-factor authentication, it’s easier to get their buy-in. 

Our blog has many pieces you can use to help communicate security issues to your employees. Here are a few to get you started:

* [Four Cybersecurity Attacks Your Employees Need to Know](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/)
* [What is a Data Breach?](https://auth0.com/blog/what-is-a-data-breach/)
* [What is Data Security?](https://auth0.com/blog/what-is-data-security/)

You also might want to bring in experts for cybersecurity training sessions. While Auth0 doesn't offer these specifically, here are a few we recommend:

* *InfoSec Institute's [Security Awareness & Anti-Phishing Training](https://www.infosecinstitute.com/securityiq/).* The program includes more than 1,000 phishing simulations, along with tailored learner assessments, to bring employees up to speed.
* *[The SANS Institute](https://www.sans.org/about/)*. This non-profit was established in 1989 and now collaborates with 165,000 security professionals worldwide. Offers many private trainings to upskill existing IT team members.
* *Inspired eLearning. *These efficient modules even include [security awareness training programs for executives](https://inspiredelearning.com/security-awareness/awareness-c-suite/). 

Sometimes education isn't enough. If you do suffer a system breach, Auth0 can quickly step in to protect your customers with tools like [anomaly detection](https://auth0.com/docs/anomaly-detection) and [breached password detection](https://auth0.com/docs/anomaly-detection/breached-passwords). In the first instance, in the Auth0 dashboard, an admin will receive a notification of a strange behavior like multiple failed login attempts and can quickly block the user while researching the issue further. 

In the second case, Auth0's security team will work to keep a retailer informed if any of its customers' passwords match with those in our database of leaked passwords (which we update daily). If we see a match, we can work with a retailer's IT team to block the potential impersonator from getting further into the system.

### Take advantage of what the season has to offer.

Holidays are the most important time of the year for retailers. It's when most retail teams make the majority of their sales, and missing out due to a security breach can set you back several quarters or years from hitting your targets. It’s more important than ever to keep your customer data safe so they continue to trust and work with you.

It’s never too late – or too early – to start thinking about the best ways to do so. Auth0 would love to help. [Reach out](https://auth0.com/) at any time, and we'll be glad to set you up.

<include src="asides/AboutAuth0" />


3 Ways Auth0 Can Help Retailers Protect Customer Data During the Holidays

Information and tools to help you mitigate risk against cyber attacks and data breaches. Learn more about Malware Infiltration, Phishing, USB Traps, and Mobile Attacks.



In 2017, nearly [_179 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. It's clear that cyber criminals are growing more creative with how they gain access to networks and valuable data.

Many of today’s most common cyberattacks have been socially engineered to rely on human error. Even your best employees can become your greatest weakness if they open a suspicious email, click on a malicious link, or pick up and use an anonymous USB device.

There are ways to protect your organization against sensitive data breaches. Here are four of the most common cyberattack examples and the ways you can avoid them.

## **1. Malware Infiltration**

**What makes you vulnerable: outdated software and lack of backup protocols**

Malware is a term that encompasses many different types of malicious software, including ransomware and spyware. Each type of malware can wreak havoc once it gains access to a system.

WannaCry, for example, a form of ransomware, recently [took advantage of a weak spot in Microsoft’s operating system](https://www.symantec.com/security-center/writeup/2017-051310-3522-99). Banks, health care providers, manufacturers, and other businesses across the globe reported WannaCry's encryption.

![WannaCry encryption](https://images.ctfassets.net/23aumh6u8s0i/1vTw3WKZIs3Fs1RZGhNNeI/18d3869c4068bf29ce62e9ce8eb6e9db/WannaCry-encryption)
  
[[Source](https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/)]

In order to regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [_bitcoin_](https://bitcoin.org/en/). [_Sixteen National Health Service’s offices_](https://developers.redhat.com/blog/2017/05/19/wannacry-ransomware-who-it-affected-and-why-it-matters/) and over 200,000 PCs worldwide reported this.

_Solution: Regularly updating your systems will go a long way toward removing dangerous holes. It's a simple fix that many teams, including [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/), have neglected._

_If you want added security, consider [moving to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/). Not only will this allow your enterprise more flexibility to scale, but you can also delegate specialized security tasks like IAM and encryption to expert providers._

## **2. Phishing **

**What makes you vulnerable: lack of education and attention to detail in suspicious e-mails**

In 2016, [91% of cyberattacks](https://phishme.com/2016-enterprise-phishing-susceptibility-report/) were the result of a spear-phishing email. Phishing e-mails steal data either by tricking recipients into giving it to the cyber criminals or by getting users to download a file that installs spyware—software designed to steal information directly from a user’s device.

Children’s Mercy Hospital [_recently reported a breach_](https://healthitsecurity.com/news/childrens-mercy-hospital-phishing-attack-impacts-phi-of-60k) that exposed the health care information of at least 60,000 people. E-mails tricked users into disclosing their work e-mail credentials, which led to the exposure of patient health data when the hackers gained access to the inboxes of the targeted hospital workers. Children’s Mercy [_is now being sued_](https://www.hipaajournal.com/childrens-mercy-hospital-sued-for-63000-record-data-breach/) for this major breach.

Here’s an example of an imitation Dropbox e-mail asking for confirmation of a user’s e-mail:

![Imitation Dropbox email phishing scam asking for confirmation of a user’s e-mail](https://images.ctfassets.net/23aumh6u8s0i/7jVF95LDb067AOrODuA8SI/2fb640b69a3567e208636c1abad55fc1/dropbox-email-asking-confirmation-of-user-email)

[_Source_](https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250)

When users click the “Verify your email” link, spyware software is automatically downloaded onto the users' computers.

_Solution: As these e-mails start to look more realistic, it’s important to educate employees on how to spot a questionable e-mail chain._

_Creative training programs include the following:_

- _Digital Defense's [SecurED training program](https://www.digitaldefense.com/professional-services/secured-training/) that works with award-winning Hollywood comedy writers_
- _Terranova's [customizable newsletters](https://terranovacorporation.com/solution/communication-material/)_
- _Inspired eLearning's [Security Awareness for the C-Suite](https://inspiredelearning.com/security-awareness/awareness-c-suite/)_
- _Wombat Security's [everyday tips](https://www.wombatsecurity.com/security-education/free-security-awareness-resources)_

_[See here for a larger list.](https://www.csoonline.com/article/3225471/security/please-dont-send-me-to-cybersecurity-training.html)_

## **3. USB Traps**

**What makes you vulnerable: lack of education and policy on outside device use **

Hackers who want a direct route to company data often use a hardware device, such as a USB drive. A [_recent Google study_](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/45597.pdf) revealed that at least 45% of people who find a USB drive will plug it into their computers. Planted USB drives may contain malware or a link that requests information, similar to a phishing e-mail.

The worst-case scenario is a drive that contains a HID spoof. This is where the USB drive tricks the computer into believing the drive is actually a keyboard and then issues a set of keystrokes that forces the computer to dump data back to the hacker. It can also allow them access to whatever network the computer is connected to.

![HID spoof process](https://images.ctfassets.net/23aumh6u8s0i/6tgD3dKhZRBiDXExHQw0H3/b36a8b23e6518b6d0c93f44e0e0f69f3/hid-spoof-process)

_Solution: Outlawing anonymous, external drives on company devices will send a clear message to your organization. Whether a drive was planted or simply purchased from an illegitimate source, removing the temptation to plug something in without properly vetting is a low-hanging fruit that can have enormous power to secure your team and your end users._

## **4. Mobile Attacks**

**What makes you vulnerable: employees accessing company data and networks via cell phones**

Hackers are well aware of the explosion of smartphone and tablet use and have created attacks specifically designed for mobile software. [_The Pegasus attack_](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message.

<p style="text-align: center;">
  <img style="width: 300px;" src="https://images.ctfassets.net/23aumh6u8s0i/1ii40f6m9VQ1rBmWpgY1pF/de53a4b3444b16e607d52ee34bb9933e/pegasus-mobile-attack-on-ios" alt="Example of Pegasus attack on Apple iOS mobile software."/>
</p>

[_Source_](https://www.hax4us.com/2017/03/hindi-english-smishing-brother-of.html)

Phishing text messages are composed to look legitimate, just as phishing e-mails are. With Pegasus, clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. The software also copied all of their calendar, contact, and e-mail data.

Pegasus was an especially frightening cyberattack because it took advantage of [_“zero day” vulnerabilities_](https://www.huffingtonpost.co.uk/entry/what-is-the-pegasus-iphone-spyware-and-why-was-it-so-dangerous_uk_57c0043fe4b0ba22a4d3f930?guccounter=1), meaning there wasn’t any prior knowledge of the vulnerabilities in Apple’s iOS until Pegasus struck. Once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

_Solution: If a mobile phone or tablet has been breached, you need a Plan B. Make sure employees quickly change their passwords by using a professional password manager, such as [LastPass](https://www.lastpass.com/) or [Valt](https://valt.io/). Many employees secure critical information with easy-to-guess iterations of a single password. Encouraging length and complexity in all passwords going forward will make it difficult for hackers to access multiple areas at once._

## Additional Security for All Systems at the Login Stage

Good password policy and sound employee education are key; however, taking the next step with [secure login procedures](https://auth0.com/b2c-customer-identity-management) will add a new dimension of safety to your system. Specialized identity solutions providers can offer support with [multifactor authentication](https://auth0.com/docs/multifactor-authentication).

Tracking your users from the start will help eliminate fraud at its origin, helping provide a secure foundation to allow your team to scale.

<include src="asides/AboutAuth0" />


Four Cybersecurity Attacks Your Employees Need to Know

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. <br /><br />Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. <br /><br />She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Learn how responsible disclosure of a cybersecurity vulnerability made the risk mitigation process safe for Auth0 customers and vendors.



On October 5, 2017, security company [Cinta Infinita](http://www.cintainfinita.com) contacted Auth0 to report a vulnerability in our Legacy Lock API ([CVE-2018-6873](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6873)). Cinta Infinita discovered the issue while conducting independent research. In specific cases, Cinta Infinita was able to bypass password authentication when logging into Auth0’s Management Dashboard by forging an authentication token. After verifying the vulnerability, we responded immediately, pushing a patch to our cloud service within four hours of initial notification. Our engineers then worked around the clock to patch our Private SaaS Appliance customers over the following two weeks.

During our investigation it became clear that the vulnerability was a special case of a deeper structural problem. The attack exploited an underlying Cross Site Request Forgery (CSRF/XSRF) vulnerability ([CVE-2018-6874](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6874)). CSRF vulnerabilities are a common structural flaw when embedding a login widget into a web application due to the nature of cross-origin authentication (one of the reasons we’ve been pushing for [Universal Login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/)).

To fully remediate this issue and protect our customers, we needed to make a significant change to our [Lock login widget](https://auth0.com/lock) and its [supporting library](https://auth0.com/docs/libraries/auth0js/). Unlike the fix for the special case discovered by Cinta Infinita, this issue could not be solved without forcing our customers to upgrade the libraries/SDKs on their end, a much more significant undertaking.

We worked with Cinta Infinita to allow us time to address the issue prior to their public release. Neither party wanted the vulnerability to be exposed for a lengthy period of time, so we agreed on an aggressive schedule that still provided ample opportunity for all of our customers to upgrade.

With Cinta Infinita’s support on the timing, we moved forward with a strategy to mitigate the vulnerabilities by rewriting the affected libraries and releasing new versions of our SDKs (auth0.js 9 and Lock 11). This was an all-hands-on deck effort that included our Engineering, Customer Success, and Security teams as well as many individuals from across Auth0. Our goal was to provide a seamless upgrade. We achieved that for customers who were on Lock 10 and auth0.js 8.

We launched a multi-touch communications plan to all customers announcing the deprecation and removal of the vulnerable endpoints, giving them notice to migrate to the new SDKs. Customers on Enterprise plans were contacted and given the opportunity to speak directly with the Security and Professional Services teams to work out individually tailored migration plans.

Understanding that the upgrade would be cumbersome for many customers, our Engineering team continued to work on the underlying issue and was able to develop a mitigation strategy that could be implemented on the server side. This strategy not only decreased the burden to our customers, it also significantly reduced the <a href="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Verifying_Same_Origin_with_Standard_Headers">severity rating of the API vulnerability</a>. This occurred three weeks before planned public disclosure.

With server-side mitigations in place for our Cloud Customers, users are now much better protected even prior to migrating to new software versions. Due to the heavily downgraded severity, we are able to provide customers with three additional months to upgrade, with the **vulnerable endpoints removal of service now taking place on July 16, 2018 instead of April 1, 2018**.

<include src="TweetQuote" quoteText="Due to the heavily downgraded severity, vulnerable endpoints removal of service now taking place on July 16, 2018."/>

Security is a top priority at Auth0, and we’ve invested heavily in building up our program over the last year.

* We have implemented a new Secure Software Development Lifecycle process that encompasses all new development efforts.
* All of our developers take part in regular secure development training.
* We have embedded Product Security engineers into the various engineering teams to focus on the internal code and processes, while building out our Application Security team to focus on external interfaces and component security.
* We perform regular penetration tests and code reviews executed by industry-leading third parties, as well as automated vulnerability and component security scans.

With these people, processes, and tools in place, a project to review and refactor our code base is already underway. This project will make the introduction of vulnerabilities even more unlikely in the future.

<include src="TweetQuote" quoteText="Security is a top priority at Auth0, and we’ve invested heavily in building up our program over the last year."/>

Vulnerabilities are a part of life in software development. We would like to thank Cinta Infinita, an excellent partner in this process. Cinta Infinita has worked responsibly with us to protect our customers. We encourage anyone to report potential vulnerabilities to us through our [Whitehat responsible disclosure program](https://auth0.com/whitehat). We take all such reports very seriously as part of our commitment to providing the best security for our customers.

Migration guides are available to help customers upgrade to [auth0.js version 9](https://auth0.com/docs/libraries/auth0js/v9/migration-guide) and [Lock version 11](https://auth0.com/docs/libraries/lock/v11/migration-guide).

If you have any questions or feedback, please reach out to us. You can contact your CSM, open a [support ticket](https://support.auth0.com/), or chat with us in the Auth0 community forum on the [deprecations roadmap topic](https://community.auth0.com/t/upgrade-reminder-changes-to-deprecation-roadmap/9552 ) and the [migrations FAQ topic](https://community.auth0.com/t/april-1st-migrations-deprecations-faq/9723).


Managing and Mitigating Security Vulnerabilities at Auth0

Unprotected IoT devices can make it easy for malicious actors to cause global damage. Botnets increased 140% last year. Auth0 can help safeguard your IoT devices.



## Is the UK’s ‘Secure By Design’ the Answer?

If 2017 was the year of the cyberattack, 2018 could be the year when IoT attacks make you feel like you’re living through a personal version of [Taken](https://www.youtube.com/watch?v=uPJVJBm9TPA&feature=youtu.be).

<include src="TweetQuote" quoteText="Unprotected IoT devices can make it easy malicious actors to cause global damage — botnets increased 140% last year. Auth0 can help safeguard your IoT devices"/>

Accessing vulnerable IoT devices, cybercriminals can grab photos of your kid; drain your bank account; alter your health records; hold your coffee maker, thermostat or vehicle hostage; and stop your heart (if you have a pacemaker).

On the business side, they can attack virtually every industry where rapid adoption of low-cost, easily-installed IoT devices has led Gartner analysts to predict that [more than 20 billion connected things](https://www.gartner.com/newsroom/id/3598917) will be in use by 2020.

## Yes, Your Wearable Could be Involved in a Global Threat

In addition to personal and business vulnerability where devices can be held hostage for ransom or more directly nefarious intent, unprotected IoT devices can provide easy ways for malicious actors to cause global damage, as can the apps that support them.

Just this week, [Under Armour announced that a data breach had affected 150 million users](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) of its fitness and nutrition site, MyFitnessPal, which can sync with wearables like Fitbit, Misfit, and LumoLift, as well as IoT-linked scales and cardio machines.

![MyFitnessPal Data Breach](https://images.ctfassets.net/23aumh6u8s0i/3jjLYQZLu72oDrX2RYAkgy/e720f072cde3386f0605923dedf7c15f/myfitnesspall-breach)

Using malware, they can gain control of the IoT devices and group them together to create a botnet with the IoT devices acting as “zombies” tasked with fulfilling the hackers’ desires. Dark Reading reported that [botnet controllers increased by 140% in 2017](https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924).

What’s especially shocking about that rise is how fast these troubles can spread.

## How Minecraft Accidentally Inspired Network Takedowns

Starting in 2016, three guys in a dorm room created Mirai, an IoT botnet targeting devices with one of [60 popular default passwords](https://www.grahamcluley.com/mirai-botnet-password/), hijacking them without the owner’s knowledge.

Their exploits targeted French cloud computing company OVH, internet services company Dyn, and knocked out major platforms like Netflix, Amazon, Twitter, and Github.

While the FBI lay honeypot traps and worried Mirai was a sign of potential U.S. presidential election interference from Russia or China, Mirai’s creators realized they could also run a click-fraud scheme in addition to the original goal of [getting an advantage in the online game Minecraft](https://www.wired.com/story/mirai-botnet-minecraft-scam-brought-down-the-internet/).

Eventually, all three guys plead guilty, facing up to five years in prison, $250,000 each in fines, and five years of supervised release.

When Netlab 360 stopped tracking Mirai last summer, [2.7 million devices had been influenced in less than a year](https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924?image_number=5).

## Billions of Devices at Risk

If you’re still calmly sipping your coffee, you’re not paying attention.

Satori, the IoT botnet that infected more than a quarter million devices within 12 hours of being spotted, [now has a version that can run on ARC processors](https://www.darkreading.com/vulnerabilities---threats/satori-botnet-malware-now-can-infect-even-more-iot-devices/d/d-id/1330875?). Why does that matter? More than [1.9 billion](https://www.synopsys.com/designware-ip/processor-solutions/arc-processors.html) ARC-based systems ship annually, making things run smoother in cars, industrial settings, homes, mobile, and IoT, including hearing aids and fitness bands.

Reaper, an IoT botnet built from Mirai’s code, had already [infected a million networks](https://www.wired.com/story/reaper-iot-botnet-infected-million-networks/) by October of 2017. Rather than exploit a single vulnerability, Reaper is a multi-vector opportunist. Written for on-the-fly updates, the malware can run fresh attacks as soon as they become available. As of the first week of March, The Hindu reports that WiFi cameras have proven most vulnerable to Reaper, with a [nearly four-fold increase in attacks over a three-month period](http://www.thehindu.com/todays-paper/tp-miscellaneous/tp-others/iot-botnets-attack-multiple-vulnerabilities/article22938435.ece).

Meanwhile, attacks are growing in complexity and sophistication, with one of the most recent botnets, Hide N Seek, developing the ability to have devices communicate directly with each other in peer-to-peer communication, which means it can spread via web and internal networks.

Botnets are rapidly becoming more mature and automated. With [400K-device botnets available for rent online](https://www.bleepingcomputer.com/news/security/you-can-now-rent-a-mirai-botnet-of-400-000-bots/) and others being [given away as Christmas gifts](http://www.zdnet.com/article/satori-malware-code-given-away-for-christmas/), IT departments are feeling the heat.

## What’s A Breach Going to Cost your Organization?

So how likely is it that your company is going to get hit with an IoT breach?
In the U.S., a 2017 [Altman Vilandrie & Company survey](http://www.altvil.com/wp-content/uploads/2017/06/AVCo.-IoT-Security-White-Paper-June-2017.pdf) of 397 U.S. executives across 19 industries revealed that 48% of businesses had already suffered an IoT breach.

Okay, so you’re breached. What’s the impact?

Breaches in that survey were found to cost 13.4% of the total revenues for companies with revenues of under $5 million annually. Of larger companies with revenues of $5 billion or more, 44% reported losses of more than 20 million.

For a more global perspective, Cisco’s [2018 Annual Cybersecurity Report](https://www.cisco.com/c/dam/m/digital/elq-cmcglobal/witb/acr2018/acr2018final.pdf?dtid=odicdc000016&ccid=cc000160&oid=anrsc005679&ecid=8196&elqTrackId=686210143d34494fa27ff73da9690a5b&elqaid=9452&elqat=2) found that by the time victims added up lost revenues, customers, opportunities, and out-of-pocket costs more than
50% of attacks results in damages of $500,000 or more. Nearly 40% of surveyed companies reported that attacks resulted in costs of more than a million.

When [GDPR](https://auth0.com/gdpr) comes into force in May, breached companies serving EU customers could also find themselves faced with additional fines, as well as greater public outcry that they should have been prepared.

## Why the World is Not Ready

If we know all of this is happening why aren’t we better prepared?

The answer is two-part. One having to deal with corner-cutting that happens when technologies are rushed to market. The other has to do with clear gaps in cybersecurity readiness which caused Cisco’s report to label IoT a “serious threat vector.”

IT teams are strained with burgeoning cloud responsibilities while also managing the proliferation of IT devices. After surveying 3,600 international security officers and security operations managers and conducting tech partner research, Cisco’s report also concluded that:

* 83% of devices in their partner sample displayed vulnerabilities
* IoT devices are called into action without security planning
* Organizations are unaware of the total the number of devices on their network
* Patching, a prime defense, happens slowly, if at all
* When patching does occur, the prior best-practice of patching within 30 days now only leaves you open to additional attacks.

Even when organizations do actively patch, they can run into troubles created by device design.

After [WannaCry](https://www.helpnetsecurity.com/2017/05/17/wannacry-iot/), spread globally via a combination of infected computers and IoT zombies to take down everything from hospitals in England and a telecom provider in Spain to computers in the Russian Ministry of Internal Affairs, IT departmartments all over the world were spurred into action. Patching did work for many of the Microsoft computers affected, but not for legacy IoT products that can’t be patched.

In a world where neither hackers nor botnets respect borders, no country offers safe haven, which is why the UK is suggesting a more global solution.

## UK Drafts Code of Best Practices, Calls for Input

“IoT security is a global challenge requiring global collaboration.”
—UK Government’s [Secure by Design Report](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686089/Secure_by_Design_Report_.pdf)

After researching serious global threats for several days, encountering the UK’s hope to create a “free, open, peaceful and secure cyberspace” proved remarkably soothing. Part of the conception of this cyberspace means that we’re all participating in a global digital economy. This is part of why the UK reached out to the public and private sectors and academia, and “like-minded countries” for ways to fight this IoT-driven threat.

The UK government’s recent examinations and explorations of best practices could allow us to better protect ourselves. The [Secure by Design Report](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686089/Secure_by_Design_Report_.pdf) makes it clear that no one country, organization, or individual can fix this situation by themselves. We’re going to have to do this together.

For businesses creating IoT devices and supporting apps, this will mean re-addressing the entire product life cycle with an emphasis on security. For organizations employing IoT devices, it will mean having a methodical approach to their security. Consumers, who are showing interest in purchasing an ever-increasing number of IoT devices, will be protected by security being built in into products from conception — “secure by design.”
The UK government is hoping the market will right itself, but given the urgency of the situation, they’ve also warned that they will consider regulatory action if change doesn’t happen naturally, noting that they will continue monitoring through the remainder of 2018.

In addition to outlining the gravity of mounting threats and suggesting best practices, the report also cites 5 key principles to help shift IoT thinking: Reducing burden (on consumers and others in the supply chain), Transparency, Measurability, Facilitating Dialogue, and Resilience.
With an emphasis on sharing best practices and encouraging dialogue, the UK government is seeking input from all areas of interest. To contribute to the conversation, send comments to [securebydesign@culture.gov.uk](mailto:securebydesign@culture.gov.uk) by the 25th April 2018.

## How Auth0 Can Help You Immediately Secure IoT

Justice from captured hackers is notoriously thin. Organizations and individuals currently receive little compensation for their losses and/or harm to their reputation. Remember those three guys that created Mirai? Together they paid only $750,000 in fines — and that money didn’t go to the victims.

<include src="TweetQuote" quoteText="Will the UK’s call for IoT standards help protect organizations from the rapid rise of botnets?"/>

Government efforts like the UK’s or even the one of multiple U.S. bills to secure the Internet of Things could lead to real change, but they’re going to take time. Meanwhile, the hackers are evolving their attacks at frightening rates. What can you do to protect yourself right now?

In the [UK’s literature review for IoT principles and best practices](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686090/PETRAS_Literature_Review_of_Industry_Recommendations_and_International_Developments_on_IoT_Security.pdf), authentication was the first protective measure listed. Reliance on common credentials without encryption is part of what made it so easy for Mirai to sweep through all those IoT devices. Securing the devices you have now and devices coming online with well-encrypted (hashed and salted) passwords can provide a strong line of defense. [Multifactor authentication](https://auth0.com/multifactor-authentication) (MFA) also offers the possibility of securing devices with other factors like geographic location or time.

Auth0 can help you put all of these things into use quickly and efficiently. We support IoT authentication with the most advanced password hashing algorithms. Our code is regularly submitted to independent penetration and black box testing and we also perform continuous vulnerability assessments. And because hackers are always evolving, we have a team of 12 engineers dedicated to full-time work on security, lead by Auth0 CISO Joan Pepin, former CISO for both Nike and Sumo Logic.

If you’d like to learn more about how Auth0 can help you secure your IoT devices and streamline your identity solution, reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


Security Risk: 20+ Billion IoT Devices by 2020

The risks of legacy authentication and why you should migrate to IAM



Many businesses, especially those that appeared online in the 1990s, invested large amounts of time and money deploying complex identity authorization systems across their business.

A large number of these systems have web access management, or WAM, as their central design metaphor. At one point, WAM was one of the most common ways for large companies to handle identification and resource access inside their businesses.

As time passed, however, these kinds of systems have grown increasingly expensive to maintain, and most are unprepared for the kind of threats and issues that businesses need to worry about today. In other words, legacy WAM solutions leave your business exposed.

<include src="TweetQuote" quoteText="Web access management systems are expensive to maintain and unprepared for the threats of today."/>

## What Is Web Access Management?

Web access management systems are focused on providing security to web-based tools and applications, and they focus on two main identity operations:

* **Authentication**: Ensuring a given user is who they claim to be
* **Authorization**: Ensuring a given user has permission to access a particular web page/area of a web product

First appearing in the 1990s, most WAM products also permitted the use of limited single sign on (SSO)—allowing users to sign in with their credentials on one domain and then use those same credentials to access data on other domains without signing in a second time.

WAM products were generally deployed using one centralized authentication server and as many individual agents as necessary to cover all of a corporation's web servers.

![Web access management](https://images.ctfassets.net/23aumh6u8s0i/4viWMdhEKfHNvATKktZeo6/67741ffba4aff26a6821f85dd6229c18/web-access-management)

In this traditional on-premises setup, requests for access went from users to the agents on individual servers, each of which would call back to an external server to either approve or deny access.

Web access management systems could also be set up using proxy servers (in which all requests would flow through a single proxy server) or tokens (in which users use individual tokens to gain access to the resources they need).

![Proxy server request flow](https://images.ctfassets.net/23aumh6u8s0i/5qY4OYbXcSqgrmxp9k2inR/4fc16ecef828aea7cdfe6649d6d8540a/proxy-server-request-flow)

_How a proxy server works. Requests flow from servers within the library (network) to a proxy server on that local network, and finally out to the external internet._

All of these types of deployments were complicated, expensive (and even more expensive to maintain) and rooted tightly in an “on-premises” model—where the perimeter of your network is limited by the perimeter of your building.

Today, most organizations are moving on and migrating to more integrated identity management (IdM) and identity and access management (IAM) solutions.

## What Is Identity Management (IdM)?

Identity management (IdM) is an umbrella term for all  of the core logic around identity in a corporate environment.That means:

* **Provisioning**: Assigning identities to users
* **Account management**: Maintaining those identities
* **Identity governance**: Assigning them to groups and roles and adjusting permissions as needed

IdM is often used interchangeably with IAM, or identity and access management. IAM, however, is most often used to refer not just to identification but to the whole suite of practices that a corporation needs to manage their users and data, including:

* **Authentication**: Ensuring that a given user is the user they identify as
* **Authorization**: Ensuring the given user has the proper permissions to access a certain piece of data
* **Identity federation**: Ensuring users can use the same identification data to access resources on related domains

In other words, [IAM](https://auth0.com/learn/cloud-identity-access-management/) is the entire set of practices around identity that an organization needs to allow “the right individuals to access the right resources at the right times for the right reasons.”

## The Difference Between Web Access Management and Identity Management

The primary difference between legacy web access management and more modern identity and access management is the comprehensiveness and flexibility of the solutions they offer.

Web access management systems don't generate user identities, provision them or maintain those identities over time. They rely on an identity provider—an IdP—to do that.

![Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/64i4SsBi0aDhSWZzvjmlOZ/daf5e5b93ef9b80af42355f62f170563/auth0-dashboard)

_The Auth0 web management dashboard._

At the same time, because their standards are often a few years behind, legacy WAM providers generally don't allow for the use of technologies like Google Authenticator, multifactor authentication, and Touch ID. And that's just the tip of the iceberg—other shortcomings of WAM solutions include:

* **Slowed development time**: Maintaining interoperability between your IdP and WAM—and maintaining your network architecture requirements more generally—means you'll be slower to push out new applications, both internally and for your customers.
* **Security vulnerabilities**: Because of the maintenance needs of legacy WAM setups, and their general inflexibility to new technologies, they can leave both you and your customers vulnerable to security breaches.
* **Customer engagement**: Modern marketing and analytics tools that can help you leverage customer data in powerful ways to retain and acquire new revenue require modern, integrated identity solutions.

An IAM like Auth0, on the other hand, can serve as an IdP or identity provider (although you can use your own IdP as well, of course), an identity manager (for provisioning/maintaining user identities) and an access manager (for your native, mobile or web applications).

It can connect to a wide variety of social and enterprise identity providers and APIs and applications—and provide single sign on, granular user management, extensibility with JavaScript and the most up-to-date security protocols.

![IAM in the cloud](https://images.ctfassets.net/23aumh6u8s0i/3gOKNMTjm9Z8HhVWMOuk0D/759807fea82ab299abe4d56b83976ec4/iam-in-the-cloud)

The biggest reason why IAM is surpassing the role of WAM in the modern day is the cloud. The traditional on-premises identity management that many enterprises have used for decades served its purpose. Today, however, more and more of the activity in the workplace is not literally in the workplace. It's in the coffee shop, or at a co-working space, or at home, or on the road—and no matter where your employees are, they will most likely need to access some kind of privileged resources every day.

<include src="TweetQuote" quoteText="Identity management is surpassing the role of web access management because of the cloud."/>

The cloud makes identities more complex because it removes the on-prem notion of “perimeter security.” You can no longer protect your company's network by just securing your four walls—your notion of security must extend to all the BYOD devices and public wireless networks that your employees are using to do their work.

## Identity Management in the Cloud

Legacy authentication tools sold themselves to their customers with the promise of airtight, long-term security. But the world those authentication tools must live in has changed.

Auth0 is [SOC 2 Type II certified](https://auth0.com/why-auth0) and offers HIPAA BAA agreements to healthcare companies that must comply with HIPAA regulations as part of their business. Auth0 also conforms to the OpenID Connect protocol and the new EU-U.S. Privacy Shield Framework for data privacy.

Whether you're migrating from a WAM provider, looking to extend your current system of [enterprise federation](https://auth0.com/learn/identity-management-matters-finance-2/), or just looking to learn more about what identity and access management looks like today, [read more about us here](https://auth0.com/learn/).


The Difference Between Web Access Management and Identity Management

While it's hard to show direct returns on investment from an IAM solution, companies can't risk 2018 without one. Here are the most salient benefits to help you make a business case for an IAM budget.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

No one needs to tell you how important Identity Access Management (IAM) is to your company. You are well aware of the security risks, operational inefficiencies and missed growth opportunities that the business will suffer without a modern IAM solution.

There's only one problem. Budgets are tight and no one wants to add a new line item to the budget that doesn't provide a guaranteed return on investment. The good news is that most IT budgets are increasing in 2018. How can you convince your company that a modern IAM solution is worth the money?

![2018 corporate IT budgets](https://images.ctfassets.net/23aumh6u8s0i/1w0HX9wIMXBulBSkgvO9p3/ccb19436f6514dc9a25536689d18c9a0/2018-it-budgets)

[Source](http://www.zdnet.com/article/infographic-2018-it-budgets-are-up-slightly-spending-focus-is-on-security-hardware-and-cloud/)

You need to have a killer business case that the budget committee can't ignore. It needs to clearly and concisely illustrate how IAM will save the company money and directly impact growth.

Here are three ways to grab management's attention and have them sipping the IAM cool-aid.

## 1. Don't Increase the Security Budget, Reallocate It

Mobile devices and cloud computing have changed the way companies approach security, yet most budget allocations have not evolved to address the new risks associated with these off-premise assets.

The reality is that most companies need to increase their overall security budgets to deal with the current barrage of cyber attacks, but if that is unlikely, you need to adjust the budget to prioritize based on threat.

For example, the average IAM spend currently represents [about 5 percent](https://www.gartner.com/newsroom/id/3836563) of the security budget, yet compromised identity and access is the cause of over [80 percent](https://www.cso.com.au/mediareleases/29642/hacked-passwords-cause-81-of-data-breaches/) of breaches. Year after year, companies invest most of their security budget in network perimeter protections.

Cybercriminals don’t care about the [Fort Knox perimeter](https://auth0.com/blog/how-poor-identity-access-management-equals-security-breaches/) you spend millions on to maintain. They simply go phishing to steal credentials or infiltrate a vulnerable web app outside the firewall. The security strategy must change, and the budgets align with this new reality.

### Major Security Breaches Start with Stolen Credentials

Equifax, Target, Deloitte, and Yahoo are just a few of the huge companies with multi-million dollar security budgets who fell at the hands of compromised usernames and passwords.

Many of these data breaches could have been prevented with a simple [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) protocol from an IAM solution. Instead, hackers caused billions of dollars worth of damage. Unfortunately, 2018 is expected to be even worse.

![Data breaches due to compromised credentials](https://images.ctfassets.net/23aumh6u8s0i/4WAKZGWTrAn9sEKIjoscpr/347e6c3511666a13f4fe7e0ba5860b11/data-breachs-due-to-compromised-denials)

Criminals are becoming more sophisticated in their phishing schemes, even using [artificial intelligence](https://www.csoonline.com/article/3244924/data-protection/2018-cybersecurity-trends-and-predictions.html) and automation to collect intelligence that will get them through any firewall.

IAM companies like Auth0 spend their time staying one step ahead of hackers who target identity and access. From [encryption](https://auth0.com/security) to [password breach detection](https://auth0.com/blog/announcing-password-breach-detection/), IAM solutions offer several layers of protection to keep your logins secure. When your login is secure, your data and customers' information is in a safer place.

### Secure Your Applications Before You're Exposed

Most enterprises have over 700 apps in use that are operating on personal mobile devices all over the world. When you have so many apps with company data outside the traditional security perimeter containing, you are extremely vulnerable to an attack.

IAM is becoming more and more complex as authentication and access to all of these applications must be managed and protected. Companies without a comprehensive IAM solution are failing with an estimated [25 percent](https://www.sans.org/reading-room/whitepapers/application/2016-state-application-security-skills-configurations-components-36917) blaming their apps as the source of breaches. The reason for [95 percent](https://blogs.gartner.com/anton-chuvakin/2015/05/18/highlights-from-verizon-data-breach-report-2015/) of these app attacks is stolen passwords.

![IAM is becoming more and more complex as authentication and access to all of these applications must be managed and protected](https://images.ctfassets.net/23aumh6u8s0i/32lcneRfrCoBVbNtsk8CnO/01ff394135754482b1db75f70e209123/how-enterprise-app-stores-work)

Auth0 offers several approaches to secure your apps without losing the convenience of accessing them on the go. Solutions like [single sign-on](https://auth0.com/learn/how-to-implement-single-sign-on/), [social login](https://auth0.com/learn/social-login/) and [passwordless](https://auth0.com/passwordless) add the necessary security to credentials and allow you to monitor login behaviors to flag suspicious activity.

It is clear that IAM is a critical piece of your company's security strategy. [Juniper Research](https://auth0.com/learn/social-login/) predicts that cybercrime will cost businesses over $2 trillion by 2019. If the past is the best predictor of the future, the majority of those crimes will come from inadequate IAM.

## 2. IAM Creates Efficiencies That Lead to Cost-Savings

IAM solutions are usually thought of as solely a security expense, but the reality is that IAM contributes to other facets of the organization that help drive efficiencies and save money. If you can quantify these cost-savings, you are more likely to secure an IAM budget.

The largest line item on an IT budget is often for utilities, which include things like hardware, help desk, network costs, and maintenance. These costs make up over 60 percent of most[IT spending](https://www.cio.com/article/2439252/budget/how-to-present-your-it-budget.html), and they cause frustration for budget managers because the numbers are huge and it's hard to explain the value.

Anytime you can reduce these dead costs, managers will listen. IAM tools can automate several labor-intensive processes that currently put a strain on IT and drive their utility budgets through the roof.

### Self-Service Access Reduces Help Desk Resources

Imagine you are locked out of your company's analytics application and you forgot your password. If your organization has an updated IAM solution, the process is easy. You reset the password and verify your identity with multi-factor authentication.

If your company does not have the right IAM solution, resetting passwords or verifying a device can be a long and frustrating experience. It usually involves emails and calls to a help desk. IT then has to waste time updating access on their end to get you back into your application. The process is unproductive and incurs unnecessary costs.

![If your company does not have the right IAM solution, resetting passwords or verifying a device can be a long and frustrating experience](https://images.ctfassets.net/23aumh6u8s0i/61BDc9hkyiQNSWITxfulTc/4dedba6f4549f54406728292e30c37b6/auth0-reset-password)

You can do a quick calculation of current help desk costs and determine how many hours were dedicated to helping customers or employees regain access from an interrupted login experience. Even a small drop in the percentage of help desk tickets might create an ROI that pays for the entire IAM investment for the year.

### Automate Certain IT Maintenance Tasks

IT departments are swamped. Some of the work they are doing can be automated, which would not only save the enterprise money on resources but also free your IT team up to focus on innovation and growth initiatives.

For example, IT routinely conducts access reviews to ensure the right employees have access to the right systems and unauthorized people are kept out. Without an IAM tool, IT managers have to do this manually which can take weeks of pulling user extracts, formatting files and going through all the data piece by piece.

![Automate Access Management with Auth0](https://images.ctfassets.net/23aumh6u8s0i/69vWW7XxWjouH6xMqmnHSW/bbc859b5e474bf89741961e590274eca/auth0-identity-access-management)

Auth0 [streamlines this process](https://auth0.com/blog/enhancing-productivity-with-identity-and-access-management/) by centralizing access control of every aspect of user ID including creating and provisioning users, password resets and blocking unauthorized employees. What once took weeks can be done in a few hours.

IT spends a lot of money on utilities that don't help drive growth for the enterprise. Showing your company how an IAM solution can remove a chunk of that budget will be well received.

## 3. Share the Budget with Sales and Marketing

There is an excellent business case to asking sales and marketing to chip in for the IAM solution. Why? IAM can help drive conversions and maintain customer profiles, driving up to [30% efficiencies](https://www.b10v.com/business-case-customer-identity-access-management-ciam/) in sales and marketing.

Successful sales and marketing rely on understanding your customers and delivering an experience that will lead to conversion. IAM solutions like Auth0 can provide customer profile data through [social sign-in](https://auth0.com/blog/customer-data-is-king-four-ways-to-know-your-customers-better/) to help improve targeting and craft [messaging](https://auth0.com/blog/5-killer-email-strategies-for-lifecycle-marketing/) around the customers' interests.

IAM also enhances the user experience by removing the barriers of registration or forgotten login credentials. In fact, when you implement a user-friendly login process, you can increase conversions by [20%](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/).

### IAM Tools Update Your Customer Contacts

Sales teams rely on their CRM to keep track of all their future and past customers. It is the salesperson's digital Rolodex and it is their lifeblood.

Unfortunately, every year about 30% of the customer data becomes outdated because people move around and change their info. When this happens year after year, your CRM becomes a big wasteland of stale information that makes tracking customer contacts a full-time job.

![Identity Access Management updates CRM data](https://images.ctfassets.net/23aumh6u8s0i/5qmLjDyVn57kabQqDMTx9f/4b8b879fced7cdfcf0610e4816df1541/auth0-identity-access-management-2)

An IAM system can help solve this problem by letting your customers manage their own identities. When a customer changes a job or a phone number, they will update their information in their single sign-on account, which is tied to your CRM system. This will ensure that you can keep track of your customers and not risk losing future sales because of bad data.

### Personalized Marketing Drives Sales

Every marketer knows the power of personalizing the customer experience. In fact, personalization affects all areas of marketing, reducing acquisition costs by as much as [50 percent](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/marketings-holy-grail-digital-personalization-at-scale) and increasing sales by up to [15 percent](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/marketings-holy-grail-digital-personalization-at-scale).

IAM tools help facilitate personalized marketing by aggregating your customer's data across various marketing channels to create a [single view](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) of your customer. This is achieved through [single sign-on](https://auth0.com/docs/sso/current), where the user logs into one account to gain access to their other application.

![Personalized website content  makes customers happy!](https://images.ctfassets.net/23aumh6u8s0i/2VNY8Lqz8SygPs9MUnjlBX/70f3e2d63a0606b7e04606b4bbaeb221/personalization-stats-updated)

[Source](http://blog.whereoware.com/wp-content/uploads/2017/06/Personalization-Stats-Updated-1024x382.png)

In addition to aggregated data, Auth0 enables [social login](https://auth0.com/learn/social-login/), where users sign into their apps through a social account like Facebook or Twitter. When your customers use social login, you are able to learn more about their interests and target based on location or special events like a birthday.

Personalization requires customer data that goes beyond demographics. When an IAM solution delivers the deeper profile data and helps keep your CRM system updated, sales and marketing will realize they need an IAM tool for more than security. If you can't find the money in the IT budget, you have a valid case for asking sales and marketing for help.

## IAM Affects the Entire Enterprise

As a security tool, IAM has an extremely compelling business case for an adequate budget. With $2 Trillion on the line from cyber attacks, IAM becomes a no-brainer.

But IAM is more than a security solution, it enhances productivity and improves how users interact with your company. These use cases have tangible benefits that can be quantified. Whether it is by saving costs within IT or driving revenue by supporting sales and marketing, IAM does have a powerful ROI story.


3 Ways to Get an IAM Budget in 2018

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Practical advice for mitigating your risk of identity theft.



Nobody wants to get their identity stolen. In fact, it's probably one thing that is pretty much universally feared. Not only is it scary to think that someone else could access your personal information and take your debit card on a joyride, it can also be a hassle to get everything back in order after suffering from identity theft.

We've put together this article to help you protect yourself from identity theft. Short of going off the grid and living anonymously in the woods, here are the best practices to reduce your risk of having your identity stolen.

## Refresher on personal security

This isn't the first time we've talked about protecting your identity on the Auth0 blog. So, here's a refresher of what we covered in our [most recent article](https://auth0.com/blog/personal-information-security-identity-guide/) on the topic before we begin: 

* **Use multifactor authentication.** Most apps, email platforms, and websites offer some form of multifactor authentication, the practice of using multiple devices to verify entry into an account, so check if it's available for your accounts (email, etc.) and set it up. 
* **Stay secure on social.** Use strong passwords, and update your security settings. 
* **Learn to identify and avoid phishing emails and phone scams.**
* **Protect your home wifi network** by setting up a password. 
* **Use a password manager** so that you can use a unique, strong password for each of your logins.
* **Only use secure wireless networks** and try to avoid unsecured, public wifi.

These are all common-sense suggestions to keep your accounts safe — we all know that we should use a strong password and install an antivirus. So now that we've covered the basics, let's look at some more ways you can protect yourself from identity theft and keep your information secure.

## Signs of phishing

In our previous post, we warned of email scams that can be malicious attempts to collect passwords and other data. Here are some more tips to avoid being duped by phishing.

* **If an email asks you to login to your account and provides a link — don't click!** Instead, type the link directly into your browser. For example, [this](https://twitter.com/benthompson/status/843855792587460610) fake email contains a link that could be legitimate, but redirects you to a malicious website:

![Phising Email](https://images.ctfassets.net/23aumh6u8s0i/4gX377dZcxFagpWph90TX7/d703bca802760f884d6196c5545e60a5/phishing)

* **Pay attention to the URL of the websites you use to log in or enter other information.** Most websites have a lock to indicate that they are “secure.” This is an indication that any data moved between the website and the web browser is encrypted, but it **isn't** an indication that the website itself is not malicious. This means websites like “www.login-paypal-inc.com” can be marked as secure, despite obviously posing as an extension of PayPal. If you're putting in a password or payment, double check the URL — and if it seems a little fishy, do a quick search of the company you're trying to interact with and see if the URLs match.

![Checking HTTPS](https://images.ctfassets.net/23aumh6u8s0i/6Hyhzu6s3D04GtZMZc5ZK7/17d1e4433a1f315cab6caaf49fff5ac6/https-check)

## Securing your email

Aside from having a strong, unique password, you should:

* **Use fake answers to security questions.** Instead of really using your dog's name or hometown, either make up answers that you can remember, or use answers that are close, but not quite — for example, your best friend's hometown instead of your own.
* **Take advantage of account security checkups.** Check to see if your email provider has a security checkup option, and set aside some time to run a checkup on a regular basis. For example, Gmail offers security and privacy checkups:

![Google Privacy Checkup](https://images.ctfassets.net/23aumh6u8s0i/3j8qZzvRrXK1hUeh5kmHAI/c6178ca33ee3fb94635c349a6e2045e5/privacy-check)

* **Keep your recovery information up to date.**
* **Log out.** If you log in to your email on a friend's or a communal computer, make sure you log out and remove your email from being an automatic option for sign in.

## Protecting your financial information

Financial information is always a target for theft. Follow your common sense:

* **Check your bank, credit, and debit card statements.** The more often you check, the more likely you are to notice a fraudulent charge. While it's probably best practice to look in on your accounts every day, aim for at least once a week.
* **Sign up for account alerts.** Most banks offer alerts via email, text, and push notifications. Depending on your banking provider, you should be able to trigger an alert when your account goes under a certain balance, when a payment is made, or even every time a purchase is charged to your account. 

![Account Alerts](https://images.ctfassets.net/23aumh6u8s0i/1pyuqlREl4blvsHy1786gm/4c2772b7d01e761f8adb584b278597bd/avail)

* **Check security settings on payment apps.** Most apps that allow you to easily transfer money from person to person, like Venmo, have more security available than what is set as default. Make sure you take advantage of all available security options.
* **Don't use a shared device to check accounts.** 
* **Don't save your cards on any websites.** Although the convenience of having a card available on your favorite websites is tempting, resist! If a hacker figures out your email and password on a shopping website, storing your card information only paves the way for people tapping into your bank.

## Avoiding skimmers

Another big piece of keeping your financial information safe and avoiding identity fraud is not getting your card information and PIN number “skimmed” at an ATM. Here are some ways to combat this particular issue:

* **Always cover your PIN number.** Some thieves will place cameras on ATMs to nab your PIN number. Cup your hand around the keypad to block your hand from view when you punch in your number.
* **Use ATMs in banks when possible.** Since bank ATMs are monitored with cameras, they are less likely to be the target of thieves using skimmers. Even if you have to pay a small transaction fee, it could be worth heading to the nearest bank to make a withdrawal. 
* **Give your ATM a jiggle.** Although it might look weird, trying to move the plastic around an ATM's card reader is a good habit to get into. ATMs that haven't been tampered with will not budge, but if you feel a wiggle, someone might have attached a skimmer to the card slot. 
* **Use a credit card instead of a debit card.** Debit cards are cash transfers that [require](http://www.pcmag.com/article2/0,2817,2469560,00.asp) a FDIC claim to reverse, which can take weeks. Credit card transactions, however, can be stopped or reversed almost immediately.

## Medical insurance

Although most of us do not store our own medical data in our houses or on our computers, one big target of identity theft and fraud is your medical insurance. 

While it's important to keep your insurance card handy, make sure that any copies or record of its data is secure. 

Most importantly, **check your explanation of benefits**, which shows services that your insurer helped cover. If you notice any procedures that you didn't get, contact your provider immediately. Aside from being a victim of fraud, having your medical insurance stolen can put you in the unfortunate position of having inaccurate medical data tied to your record if you don't deal with it swiftly.

## Device disposal 

When you're ready to move on from your old computer, phone or tablet, make sure to properly remove or destroy all information that you had on the device. This is an especially important step if you're passing your device along to be used by someone else.

**For computers**, wipe or destroy the hard drive prior to disposal. Accessible advice for wiping your computer can be found on the [FTC website](https://www.consumer.ftc.gov/articles/0010-disposing-old-computers).

**For phones**, wipe the memory and remove any SD cards, destroy them if you don't plan on putting them in another device. Accessible basics of wiping your phone can be found on the [FTC website](https://www.consumer.ftc.gov/articles/0200-disposing-your-mobile-device), and [CNET](https://www.cnet.com/how-to/how-to-wipe-your-phone-or-tablet-before-selling/).

## Get your setup running and then build good habits

If this list seems overwhelming, take a deep breath! It all boils down to two things: getting a good setup in place, and getting into good habits. 

Make sure your passwords are secure and update your social media privacy settings. 

Then, try to build good security habits into your everyday life, whether that's checking the charges on your credit card, or setting a calendar reminder to check in on your explanation of benefits every once in a while. 

Although we all want to think of identity theft as something that happens to someone else, it's not worth putting your identity at risk when there are relatively easy steps you can take to mitigate the risk. 


How to Not Get Your Identity Stolen

The risk far outweighs the reward if you aren't an identity management specialist



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

When it comes time to add a login system to your product, it seems like a pretty easy feature to fit in. After all, you're building an entire product, you can surely handle building a way to create a username and password system. It wouldn't even take that long to add Facebook login!

This is exactly the kind of thinking that can get startups into trouble. By the time you figure out how difficult identity management is to build from scratch, you'll have wasted countless hours on it. Not to mention, anything you put in place is unlikely to properly secure your users data.

There's a lot of reasons why you probably won't get identity management right in house. At the end of the day, if you don't have a team of identity management specialists, building your own IAM is not just a steep, uphill climb—it's a sure path to an insecure product.

## Building identity management is harder than you think

An identity management system is no easy build. Right off the bat, the number of different systems you have to integrate can be difficult. It might be the case that your product is simple internally, but that doesn't get you out of the complexity that integrations with systems like social login or biometric login can bring you.

And even if you used streamlined stacks internally, you'd still be facing the need to incorporate proper form validation, some kind of parser to handle potentially damaging user input, and other preventative measures.

We've come far enough to have a variety of options, from passwordless login, to multifactor authentication, to mobile verification and people expect the best and most secure options for each.

![Multifactor authentication with Auth0](https://images.ctfassets.net/23aumh6u8s0i/7MZuhWzsVdemS6DUbzOLC8/f4f307fa06a5d3a989ad98ff270652f3/Auth0_Guardian_-_Auth0-2)

That means that you'll have to build more than just a username and password box.

If all of that weren't enough to dissuade you, that's only for the initial build. Every time you want to add another layer of security or if you want to change a login option, that means more coding. Your engineers will have more on their plate each time they bring your identity management up to scale with a just-released security protocol. When a new bug gets patched, when an API gets changed, when a vulnerability is disclosed—your engineers will need to stop whatever they're doing and fix your identity management system.

Yes, we've only skimmed the surface of each of these aspects of identity management, but it's no stretch to say that what looked like it was going to eat a small chunk of time just became weeks out of your calendar.

## The stakes for identity management are high

There's a lot on the line when you decide to jump into IAM. Whether you're trying to reach a niche market or sell to huge corporations, getting identity management wrong can cost you.

* **Customer trust.** If you don't take every precaution to bolster your login with the best security procedures, you're putting your customers at risk of being hacked. Although you can [prepare for handling a breach](https://auth0.com/blog/data-breach-response-planning-for-startups/), the best way to keep your reputation in tact and your customers safe is to have a constantly updated system that uses only the best security practices. Availability is also at stake. If login isn't scalable and reliable and sees downtime, you'll see customers churn simply because of an erosion of trust.
* **Enterprise deals.** Frequently, enterprise customers require different treatment than other, smaller customers. For your business, that might mean a special sales rep or [enterprise pricing](http://blog.profitwell.com/how-accurate-is-your-revenue-recognition). For your identity management, that means being able to cater to whatever [enterprise identity management](https://auth0.com/blog/how-enterprise-federation-helps-shorten-the-sales-cycle/) and security protocols they have in place. If that means Active Directory for one customer and SAML for another, you've got to work with both or you won't be able to close both deals—at least not without a lot of work by your developers.

![Easily manage identity with Auth0](https://images.ctfassets.net/23aumh6u8s0i/1NXybiK8m1NefhrWRKjdAp/56405dad3c36f8480183b7d88012f195/Enterprise_Identity_Management_-_Auth0)

* **New users.** Not only will users be wary of signing up if you've had a hack, they also might not want to sign up if your only login option is a clumsy username and password. A clean, clear login with a single sign-on or a social or biometric option can [raise your conversion rates](https://auth0.com/blog/bad-login-experiences/).

Implementing proper security, catering to all different shapes and sizes of customers, and optimizing your login for conversions are not easy things to do, but they hold a real implication for the future of your business.  

## Outsource for expertise

It's rare that all your problems can go away with one simple solution, but identity management is about as close as you can get. When you decide to outsource your IAM to Auth0, you get the full weight of a team of identity experts behind your every move.

That takes a load off your shoulders when you're looking at securing sensitive data and implementing a variety of login options. It means that you'll be able to respond faster to a hack, if one ever comes your way. It also means that you'll be able to focus your team on building out your business's core application value—not trying to become experts in security:

![Outsource identity management](https://images.ctfassets.net/23aumh6u8s0i/2X213obJn0W1gCstcjVTMK/5fd3f9222f1b7aa7776f2e175a290e54/Enterprise_Identity_Management_-_Auth0-2)

If you're looking for a variety of login options, from social to enterprise federation, Auth0 can help you integrate with no heavy lifting for your engineers. From your dashboard, you can choose to enable a variety of login options — even things like multi-factor authentication are easy to implement.

When you have a scale challenge or want to set up your own integrations with your login, Auth0 can help you do that, too.

## Don't gamble with login

Your login is simply too important to mess with. As your business grows and login continues to develop, the best way to stay on top of optimizing your login isn't to build it yourself. It might seem scary to turn a part of your business over to another entity, but think of it this way: let your engineers focus on what they're experts at—building your product—and let security experts deal with security.


Why You Should Not Manage Your Users' Identities

Username and password are not enough. So why do most companies still use them?



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

There’s a Technology Basics White Paper first published in 2002 entitled *“Username and Password – A Dying Security Model.”* This paper documents the **HIGH** risk level associated with legacy authentication (using username and password) and predicted that secure access methods using *Biometrics*, [*Single Sign On (SSO)*](https://auth0.com/learn/how-to-implement-single-sign-on/), [*One Time Password Tokens* (a.k.a *passwordless*)](https://auth0.com/passwordless) and [*Multi-Factor Authentication*](https://auth0.com/multifactor-authentication), would quickly replace the use of traditional passwords.

Fast forward to a decade and a half later and the majority of companies are still using username and password authentication. We all agree that legacy authentication is not good enough, so why do most companies still use them?


For many, the path to modern authentication seems difficult and expensive, while others worry about the impact on user experience.


Join me and Garrett Bekker (*Principal Security Analyst of 451 Research*) for a webinar where we will explore this paradox and discuss practices for making secure, modern authentication fast and easy for developers and simple and frictionless for users.

![Risks Posed By Legacy Authentication Webinar](https://images.ctfassets.net/23aumh6u8s0i/725zV9pN6ilKOKGJykmkiL/d6d69f5319e0bcfcff169f50c273574f/webinar-banner)

> The Webinar will be live online Jan 18 9:00 am PST or after on demand.

[Register now!](https://www.brighttalk.com/webcast/10363/235469?utm_source=Marketing&utm_medium=brighttalk&utm_campaign=235469)


Risks Posed By Legacy Authentication Webinar

Parse is shutting down on January 28, 2017. Learn how to easily migrate your users to Auth0, diversify risks and earn more features as a bonus



---

**TL;DR:** Parse is shutting down on January 28, 2017. Auth0 allows you to easily migrate Parse users by implementing just a couple of scripts that interface with the Parse REST API. In this tutorial, we'll walk you through a step by step process of setting up Auth0 to automigrate your existing Parse userbase as well as how to implement Auth0 authentication in your app.

---

<include src="TweetQuote" quoteText="Auth0 allows you to easily migrate Parse users by implementing just a couple of scripts."/>

Facebook shocked the developer community when it announced it would be [shutting down](http://blog.parse.com/announcements/moving-on/) Parse, a [MBaaS](https://en.wikipedia.org/wiki/Mobile_backend_as_a_service), which powers over 500,000 apps. Applications relying on Parse have until January 28, 2017 to find a new home. The Parse team has released two tools to help developers migrate away, [Parse Server](https://github.com/ParsePlatform/parse-server/wiki) and the [Database Migration Tool](https://parse.com/docs/server/guide#migrating).

Today's tutorial will focus on migrating users from an existing Parse application to Auth0. We will implement Auth0's automatic migration feature to work with our existing Parse backend so that when our existing users login their account will be migrated to Auth0. We have developed a sample app that utilizes Parse - and this tutorial will take us step by step through the process of migrating users to Auth0.

## Introduction
David S. founded [CloudCakes](https://github.com/kukicadnan/cloudcakes) to deliver pastry happiness to customers with the click of a button. After the announcement that Parse is shutting down, David has decided to use Auth0 to manage user creation and authentication. CloudCakes has millions of happy users across the world and David wants to make the transition as smooth as possible. David is not alone in this - so let's see how David and you can migrate your existing Parse userbase to Auth0.

![CloudCakes](https://images.ctfassets.net/23aumh6u8s0i/2JKIQp28CSkYfGTQmLzbC6/b8e8eb2ad0a4bde892de06694a148d29/cloudcakes)

## Setting Up Automatic Migration
With an Auth0 account created and verified, David is ready to setup automatic migration for his users. In the Auth0 Dashboard, he navigates to the **Connections** then **Database** menu and creates a new database connection. To enable the migration from Parse, the first step will be to enable the use of a custom database.  To do that, David navigates to the **Custom Database** tab and flips the switch on the "Use my own database" option. Next, he goes back to the **Settings** tab and enables the "Import Users to Auth0" functionality.

![Setup Custom Database](https://images.ctfassets.net/23aumh6u8s0i/6zi60xo5Ys26TVr3HNyR3/4afafb85ee2160d8708426b218a92ed1/setup-custom-database)

![Setup User Migration from Parse](https://images.ctfassets.net/23aumh6u8s0i/5k7gLrKM9thzknjfzskzb5/ac0095a7a8072b27bfc9aee71befacab/setup-user-migration)

### Username vs Email
Parse uses the `username` key when creating user accounts. The username key can either be an actual email address or any valid string - it's up to the developer to choose. If your Parse users login with a username rather than an email address, you will also need to enable the "Requires Username" option in the **Settings** otherwise you can leave this setting unchecked.

## Implementing the Database Action Scripts
To get the automatic migration working we will need to implement two scripts - **Login** and **Get User**. These scripts are used to interface with your external data store. We'll explain each of the scripts in greater detail below.

### Login
The login script is executed when a user attempts to sign in but their account is not found in the Auth0 database. Here we will implement the functionality to pass the user credentials provided to our Parse database and see if that user is valid. Auth0 provides templates for many common databases such as MongoDB, MySQL and Sql Server, but for Parse we will have to write our own. We will utilize Parse's REST API to authenticate the user.

```javascript
// The login function takes 3 parameters:
// 1. username/email
// 2. password
// 3. callback function
function login (username, password, callback){

  // Utilizing the request library we make the REST call to Parse
  // Visit https://parse.com/docs/rest/guide#users-logging-in for requirements
  request({
    url: 'https://api.parse.com/1/login',
    qs: {username: username, password: password},
    method: 'GET',
    headers: {
        // Auth0 provides us a configuration object we can use to securly store values
        'X-Parse-Application-Id': configuration.ParseApplicationId,
        'X-Parse-REST-API-Key': configuration.ParseAPIKey,
        'X-Parse-Revocable-Session' : '1'
    }
  }, function(error, response, body){
    if(error) {
      callback(error);
    } else {
      body = JSON.parse(body);
      if(response.statusCode !== 200){
        callback();
      } else {
        // If a user was found and succesfully authenticated through the API
        // We create a new Auth0 user with details returned and log the user in
        callback(null, {
          user_id : body.objectId,
          username: body.username,
          email: body.email,
          // We set the users email_verified to true as we assume if they were a valid
          // user in Parse, they have already verified their email
          // If this field is not set, the user will get an email asking them to verify
          // their account
          email_verified: true,
          nickname: body.nickname
          // Add any additional fields you would like to carry over from Parse
        });
      }
    }
  });
}
```

### Get User
The get user script is executed when the user attempts to do a password reset and their account is not found in the Auth0 database. The get user script interfaces with your Parse datastore and checks to see if the user exists there. If the user does exist, their data is sent back to Auth0 where the user is automigrated and a password reset email is sent out. Once the user confirms the reset, they are good to go and can access your app. Subsequent logins will be authenticated against the Auth0 database as the users profile is not stored with Auth0.

Let's take a look at the code to implement this functionality with Parse. Once more, we will be using Parse's REST API to implement a lookup of the users email and if we get a successful return we'll create the user and send out the reset password request.

```javascript
// The getByEmail function takes 2 parameters:
// 1. email
// 2. callback function
function getByEmail (email, callback) {
  var profile = {
    email:  email
  };

  // We are going to make a query call to the /users endpoint of the Parse API
  // Visit https://parse.com/docs/rest/guide#users-querying for additional info
  request({
    url: 'https://api.parse.com/1/users',
    qs: {where: profile}, // We pass an object with the provided email
    method: 'GET',
    headers: {
        'X-Parse-Application-Id': configuration.ParseApplicationId,
        'X-Parse-REST-API-Key': configuration.ParseAPIKey,
        'X-Parse-Revocable-Session' : '1'
    }
  }, function(error, response, body){
    if(error) {
      callback(error);
    } else {
      body = JSON.parse(body);
      if(response.statusCode !== 200){
        callback();
      } else {
        // The /users endpoint will return either an array or an empty object
        // If what we get is an array, we know we found a user with the provided email
        // If what we get is an empty object, we know that we did not find the user in which case nothing happens
        if(Array.isArray(body.results)){
          var user = body.results[0];
          callback(null, user);
        } else {
          callback();
        }
      }
    }
  });
}

```

The Parse REST API call to return the user data will return everything except the users password. Just like in the **Create User** Database Action Script, you are free to modify which data you  store in Auth0. Additionally, if you would like to restrict the data returned from Parse, you can do so by implementing query constraints on the call, for more info how to do that check out [this](https://parse.com/docs/rest/guide#queries-query-constraints) section of the Parse REST API docs.

### Settings / Configuration

As mentioned in the code sample above, Auth0 provides a convenient configuration object that we can use in our database action scripts. For our Parse integration, we have utilized this feature to create two keys, `ParseApplicationId` and `ParseAPIKey` which hold the values of our Parse Application Id and Parse API Key respectively. Creating additional keys is as easy as picking a unique name for the key and entering the value you want it to hold.

![Database Action Scripts Settings](https://images.ctfassets.net/23aumh6u8s0i/1fkMM5runqlFQYFOMkHTBd/e34dd6d96a699d0f6a62bd1a0bfee517/database-action-scripts-settings)

### Script Debugging
Auth0 additionally provides functionality to try your custom login function as well as debug it when issues arise. As this code runs in a sandbox on Auth0's servers, you will need to install [Webtask](https://webtask.io/) (as well as NodeJS) by running `npm install -g wt-cli` and hook it into your Auth0 app. The instructions are very straightforward and can be found by clicking the **Debug Script** button in the Database Action Scripts section of the page. The webtask that runs will display any `console.logs` you have placed in your Database Action Scripts functions as well as other errors.   

## Implement Auth0 Authentication in CloudCakes
We are now ready to implement Auth0 authentication in our app. CloudCakes was built as an AngularJS app that talks to a REST backend. If you would like to follow along get the code [here](https://github.com/kukicadnan/cloudcakes). Since our app was built with AngularJS we will add all the required and supplemental libraries to make the implementation as easy as possible. AngularJS setup is out of scope for this tutorial - we will primarily focus on integrating Auth0 authentication. We will assume you are following along with the CloudCakes code example.

*Auth0 provides a REST based API that you can use to integrate into any app you are building. Additionally, Auth0 provides official libraries and SDK's for most frameworks and languages including Python, Node, Ruby, iOS, Android, Java, .Net and many others. To learn more about the different SDK's supported visit this [page](https://auth0.com/docs).*

### Hooking Into Auth0
The first and most important step is to properly add your Auth0 credentials. For CloudCakes, David has created a file `auth0-variables.js` where he instantiated three global variables `AUTH0_CLIENT_ID`, `AUTH0_DOMAIN` and `AUTH0_CALLBACK_URL` and inserted the appropriate values into the variables. You can get these values for your app by navigating to your Auth0 Dashboard, selecting your app and clicking on the **Settings** tab. The **Domain** and **Client ID** will be predefined for you and you can just copy and paste them. You will need to insert a value or values in the **Allowed Callback URLs**. The value here should be the domain you will be accessing your app from. In CloudCakes case, we are just going to add our local development url which is `http://localhost:3000`. With these three setting defined, you are ready for the next step.

*In the CloudCakes GitHub repo, we have provided an `auth0-variables-example.js` file that you can use to add your **Client Id** and **Domain** - just be sure to remove the `-example` from the filename*.

### Login Functionality
Next we are going to integrate the login functionality for our application. The code for this can be found in the `login/login.js` file. Auth0 provides numerous ways for a user to sign in, for our purposes we will be using the **popup mode**. Let's look at the sign in function in detail.

```javascript
// We bind the login function to our view using the $scope variable
$scope.login = function() {
  // The auth.sign(options, successCallback, errorCallback) function takes 3 parameters
  // 1. options - if we want to use Auth0's popup modal - we simply pass in a blank object, otherwise we pass the user's credentials
  // 2. successCallback - this callback is executed if a user is successfully authenticated
  // 3. errorCallback - this callback is executed if an error occurred.
  auth.signin({}, function(profile, token) {
    // If success we store the user's profile and toekn information into localStorage and navigate back to the homepage
    store.set('profile', profile);
    store.set('token', token);
    $location.path("/");
  }, function(error) {
    // If the authentication failed we simply log the error to the console.
    console.log("There was an error logging in", error);
  });
}
```

If you have used Auth0 before you may be scratching your head and thinking "well this code isn't any different than implementing Auth0 without the automigration feature enabled." That's the point! Let's explore what happens when a user attempts to login.

![Auth0 Authentication Popup](https://images.ctfassets.net/23aumh6u8s0i/14XqCZY8vTne7PcwLQxSaM/901a21e5058024f19e48f31625fff563/auth0-authentication-popup)

## Automigrating Parse Users
So far, we've enabled the automigration features in Auth0, setup our Database Action Scripts to interface with the Parse API and added Auth0 login functionality in our CloudCakes application. Yay! Let's put it all together now and see what happens when a user attempts to login. Let's go over the potential use cases.

### Existing Parse User Attempts to Login
Our user, let's call him Chris, comes to CloudCakes and attempts to login:

1. Existing Parse user enters their credentials and hits "Access"
2. Check to see if user is in Auth0
3. Since user is not, run the **Login** Database Action Script
4. The **Login** script makes a call to the Parse REST API
5. If the credentials provided are valid, the API will return the user
6. Auth0 will then migrate this user to the Auth0 database and log the user in

![Authenticated User](https://images.ctfassets.net/23aumh6u8s0i/2UP9KKT8b5o0WDEJl712jy/f5cd20bbc29a963f73736dae5778bd05/authenticated-user)

### Existing Parse User Attempts Subsequent Login
A few days later, Chris has the cravings for cake again, but doesn't want anyone to know, so he opens up an incognito window and goes back to CloudCakes.

1. User enters their credentials and hits "Access"
2. Since the user has already migrated and is in Auth0's database, his credentials are verified and he is logged in

The entire migration process is fully transparent to the user. The user did not need to do anything differently to get access. New users registering for CloudCakes will have their account created and stored in Auth0's database. To further illustrate the steps taken please see the graphical representation of the authentication flow below.

![Automigration Diagram](https://images.ctfassets.net/23aumh6u8s0i/7qspqSSTEhIPTVc3zd33zx/4ed4dfc8ab49c3a829f9f7a0460fbe6e/database-migration-logic)

### Closing Migration
Once Parse shuts down, you can close the migration process by going back to the **Connections** -> **Database** menu in the Auth0 dashboard, navigating to the **Settings** tab and unchecking the "Import Users to Auth0" checkbox as well as turning off the "Use my own database" setting in the **Custom Database** tab.

## Social Login with Auth0
David S. has successfully migrated his Parse users to Auth0. Business is booming but he really wants to get to the next level by adding social authentication and letting users sign up with their existing social media accounts. Auth0 has him covered! Navigating to the **Connections**, then **Social** menu, David is presented with an array of authentication providers including Facebook, Twitter, Google, GitHub and more.

David decides that he wants to allow his users to login with **Facebook**. Enabling login through Facebook is as simple as switching the Facebook social connection to the "On" state and then clicking on it to bring up the settings menu. Here, all David has to add is his **App ID** and **App Secret** as well as any attributes and permissions he would like the user to grant. To get the **App ID** and **App Secret** you will need to create a Facebook app on the [Facebook Developers](https://developers.facebook.com/). Once your app is created, you will be able to find the **App ID** and **App Secret** at the very top of the page on the **Dashboard** tab of your app. One additional step that you will need to do to enable Facebook authentication with Auth0 is to add your Auth0 callback URL in the **Client OAuth Settings** of your Facebook app. To do this, inside of your Facebook app, navigate to the **Settings** tab, then **Advanced**. On this page, scroll to the section that reads **Client OAuth Settings** and insert your Auth0 callback url in the **Valid Oauth redirect URIs** box. The callback url looks like `https://{AUTH0_USERNAME}.auth0.com/login/callback`.

Facebook login will now be displayed as an option when a user clicks on the **Sign Up** button in the CloudCakes app. Clicking the Facebook icon will take the user through the Facebook oAuth workflow and if successful the user will be logged in to CloudCakes as well as have their account registered in Auth0. Adding additional social login providers is just as easy - to learn more about the process, benefits and how-to visit the [Social Login](https://auth0.com/learn/social-login/) section of the Auth0 website.

![Auth0 Authentication Popup with Facebook](https://images.ctfassets.net/23aumh6u8s0i/5N8qyhr2I4ZkMojq964K9/53ad37885e8d4d8811baf0133aba4130/authentication-popup-with-facebook)

## Additional Resources
Parse handled more than just user authentication. Since the announcement the developer community has banded together and complied an amazing list of resources to help those affected find alternatives to parse. A GitHub repo, [ParseAlternatives](https://github.com/relatedcode/ParseAlternatives), has been setup containing links and information to alternative SaaS products - some that mimic Parse in features and others which provide very specific functionality many which Auth0 can integrates into. To date the repo has over 60 contributors. As mentioned at the beginning of the article, the Parse team has also released tools to ease the pain of migration: [Parse Server](https://github.com/ParsePlatform/parse-server/wiki) and the [Database Migration Tool](https://parse.com/docs/server/guide#migrating).

## Conclusion
Today we learned how to migrate existing Parse users to Auth0. We walked through setting up our Auth0 account to support the migration, wrote scripts to interface with Parse, implemented the Auth0 login functionality and finally added social authentication via Facebook in our CloudCakes app. Having done this, existing users of CloudCakes or any Parse application will be able to continue using the app as they always have without needing to reset their password, create new account or really change anything. David S is satisfied and getting ready to expand his business to one-click pie delivery. :)


"risk"