Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager - Developer Experience & Analytics

We’ve simplified how you manage your Auth0 tenants

**TL;DR:** In mid-February, we released Auth0 Teams- our new parent entity that consolidates managing tenants and tenant members and allows for clearer visibility into your Auth0 dashboard.

## The Problem

Auth0 is a software-as-a-service (SaaS) product. As with any SaaS product, a risk-free and intuitive experience is key in helping accomplish any and all business objectives. However, we often come across products that are not impressive when it comes to complex multi-contributor, multi-resource deployments. 

Our customers continue to leverage multiple environments (typically represented by numerous tenants) and resources while addressing Identity challenges in their business use cases. 

As we continue to address Identity challenges in innovative ways, such as passwordless authentication with [Passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) and custom logic for pre and post-login with [Auth0 Actions](https://auth0.com/docs/customize/actions), we want to continue to afford our customers the protection and feature benefits that are ingrained in our products; especially when managing dashboard users and resources.

## The Solution

Teams provides a platform to simplify the management of your tenants and tenant members while allowing for clearer visibility into the Auth0 dashboard. With Teams sitting on top of the tenant account membership, it’s the single point for visibility and control for a user to create, read, update, and delete any details within the tenant account membership. 

The introduction of Teams now allows for:

* Visibility and control of Team members
* Visibility into Tenants with relevant details (region, tenant type, etc)
* Visibility and control of Tenant members (who has access to which tenant with what role)
* Ability to enforce Single Sign-On with your own Identity provider for all Team and Tenant member's access to Auth0
* Ability to restrict tenant creation on a given Team
* Ability to manage subscription and billing details (for self-service subscriptions)

## Why Teams?

Auth0 prides itself on providing a platform that is designed to help implement complex Identity and security features without the need to become a security or Identity access management expert. We believe this so much that the very same features created for our developer community are the same features we use internally to build, expand, and enrich developer interactions. 

Teams is a perfect example of “dogfooding”, the practice of using one's own products or services. Teams is built on the [Auth0 Organizations feature](https://auth0.com/docs/manage-users/organizations) that allows our B2B customers to better manage their partners and customers, therefore affording flexibility in customization of how end-users access their applications. Learn more [here](https://auth0.com/blog/introducing-auth0-organizations/) about how Organizations can help support your B2B, B2C and B2B2C use cases.

Beyond the value being delivered as part of Teams GA, we’re planning to leverage Teams further with the support of session controls for dashboard users, the programmatic team, and the tenant management API in the upcoming months. Stay tuned.

![A view from a team owner shows a centralized place to visualize all tenants that belong to the account](https://images.ctfassets.net/23aumh6u8s0i/4QwKsdN0Cd7tT4RmbiNtXR/e14ed79166a6ce2a5748e4da7d09f27b/teams01.jpg)
A view from a team owner shows a centralized place to visualize all tenants that belong to the account.


![Team owner's view of other team members](https://images.ctfassets.net/23aumh6u8s0i/7fqwPB2Uf0jeqvduqqOwhk/13f99ad88e1af540a4c10bb22e33572f/teams02.jpg)
Team owner's view of other team members


![Setting the menu of Teams, enabling or disabling tenant creation](https://images.ctfassets.net/23aumh6u8s0i/3YcQXpBsIQW6RmbnZ2Z9Oh/0c21097cbcff8b6b40176fecdee55ae8/teams03.jpg)
Setting the menu of Teams, enabling or disabling tenant creation


![View of security tab- allowing you to access and enable security policies like SSO](https://images.ctfassets.net/23aumh6u8s0i/1NeWSLYX0aSvGNWIYwvK00/4c176b7c57be47320b0f76589ed7c43f/teams04.jpg)
View of security tab- allowing you to access and enable <a href="https://auth0.com/docs/get-started/auth0-teams/configure-security-policies#enforce-sso">security policies like SSO</a>


Teams allows users to manage their dashboard more securely, while allowing for better collaboration of the dev team/s. This new feature provides relief if you’ve ever had to manage multiple Auth0 tenants and want to restrict permissions on tenant creation and deletion. Teams will help alleviate any stress that comes along with the outdated way of doing things.

![](https://images.ctfassets.net/23aumh6u8s0i/TcmEh7vARJVBbcuqdeBf7/f4d5d6ce506ef48a3090dbe30596eb0c/teams05.jpg)

## Getting Started

Teams is turned on by default for new self-service users as of November 2023. For self-service customers that have been using Auth0 prior to November of 2023, Teams is automatically provisioned on plan upgrades.

Existing Enterprise Public and Private Cloud customers can request to be onboarded onto Teams through their Technical Account Manager or via [Support](https://support.auth0.com/). 

## FAQ

**Can a customer have more than one Team?** 
We currently support only one Team per subscription. However, support for multiple Teams is an opportunity that we might consider in the future. 

**Are there any impacts as a result of opting into using Teams?** 
There are no impacts to using Teams. The initial provision state of Teams is “Tenant” and “Tenant Member Visibility,” with no behavioral changes or restrictions without an explicit user-actioned configuration change through the Teams Dashboard.

**I am using Teams, and I want to associate a new tenant with my current subscription; what should I do?** 
Self-service customers can link a tenant under a free plan for which they are the tenant admin from the Teams Dashboard. Note that the tenant must not be currently attached to either another Team or a subscription. Enterprise customers can request a tenant to be linked to their team through their Technical Account Manager.

**I am using Teams, and I have a Teams-associated issue; how do I get help?** 
Please open a [general support ticket](https://support.auth0.com/tickets/new) and select any of your tenants in order to contact support for team-specific reasons.

**Will turning on the [Teams Tenant Member Management](https://auth0.com/docs/get-started/auth0-teams/tenant-member-management) affect how my users login?** 
Turning on Tenant Member Management will trigger the following:

* Background process of adding existing tenant members to Teams as Team Contributors
* The connection type used to login to the tenants associated with the team is activated on the Teams dashboard
* Team owners can view and update connections used to login to the Teams dashboard
* The login context is through Teams when Tenant Member Management is turned on

**Why can’t I update or delete tenant members from the Teams Dashboard?** 
Support is coming in the near future. For now, tenant members can be deleted, and roles can be updated from the Auth0 Dashboard.

**What happens if the Tenant Member Management replication process fails?** 
Toggle the feature off and back on. If the process is still failing, toggle the feature off and open a [support ticket](https://support.auth0.com/).

**Why can some customers invite Tenant Members from Manage Dashboard and others can not?** 
Invitation from the Auth0 Dashboard is not allowed for Non-Enterprise customers (self-service & growth plans); however, it is allowed for Public Cloud Enterprise customers.

**Why can’t some customers utilize SSO/JIT and Social Connections customization?** 
These features are not part of the Non-Enterprise customers (self-service & growth plans) plans but are available to our Public Cloud Enterprise customers.

Auth0 Teams

mimi-chakravorti

I help define the Okta brand and bring it to life. I’m a part of the Brand Team within the Studio that works on brand strategy, naming, brand management, brand messaging and research. I am excited to help build our brand that not only reflects who we are today, but also helps us define our future.
 
I’ve spent most of my career helping some of the world’s biggest companies create their brands and tell their stories. Having done stints in advertising, research and media, most recently I was at Landor & Fitch, a leading global branding agency.
 
I’m a San Francisco Bay Area native and have lived in London and New York before finding my way back to the East Bay- Lafayette, to be exact. When I’m not working, I'm most likely running after my two young kids.

VP, Brand - The Studio - The Studio

Mimi Chakravorti

Since Okta acquired Auth0 in 2021, we’ve been continually aligning and integrating our teams and technologies.

Today, we’re excited to introduce the new icon and wordmark for **Auth0 by Okta!** We believe the new icon better reflects Okta’s strategy and the relationship between Workforce Identity Cloud, Customer Identity Cloud, and the Auth0 platform. 

Read on to learn a bit about the meaning behind it.

## Why the Change?

First, let’s call out what is not changing — we have not changed any URLs, APIs, or code libraries. “Auth0 by Okta” is still the same platform you know and love, and the Auth0 name remains.

With the new wordmark and icon, we reflect how the Auth0 technology is an integral part of Okta’s success and strategy. These updates evolve the Auth0 by Okta logo and wordmark to feel like part of the Okta brand family, using the Okta font and rounded shapes.

This new icon brings Auth0’s heritage forward into its place as a foundational technology of Okta and its flagship product line — Okta Customer Identity Cloud.

## New Wordmark and Icons

![New Wordmark and Icons](https://images.ctfassets.net/23aumh6u8s0i/5jPPy94Y0qylVsZeWWWKYe/65e9aa6d49e931cbc874a90886238eca/new-brand.jpg)

As a reminder of our structure, here’s how to look at it:

* **“Okta”** is one company — The World’s Identity Company.
* **“Okta Workforce Identity Cloud” **is our flagship IAM offering. Its icon alludes to the way you can bring together disparate technologies that enable your people to do their best work, all while creating a safe perimeter.
* **“Okta Customer Identity Cloud, powered by Auth0” **is our flagship CIAM offering. Its icon is an evolution of the Auth0 logo and alludes to the way you can bring together amazing experiences that are personalized to the individual, all while protecting their Identity. It carries the Okta brand promise of enterprise-level scale, support, and expertise.
* **“Auth0 by Okta”** is the technology that powers Customer Identity Cloud. Developers will continue to see this name in the code and APIs, as well as developer resources and tooling. We use the same icon as Customer Identity Cloud.

Note: Because Customer Identity Cloud and Auth0 by Okta are the same technology, you’ll likely encounter both names.

## What to Expect

You’ll notice changes to display names and icons throughout the experience and in communications. As we update things over the coming months, you may encounter both the old and new visuals. We appreciate your patience as we change these elements on a rolling basis.

## What You Need to Do

If you’re a customer, you do not need to do anything. There won’t be any interruptions to services based on these changes.
If you’re a partner who needs these icons to update your co-marketing materials, please contact [partners@okta.com](mailto:partners@okta.com).

Branding Updates

alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

Customizing identity flows by stacking no-code integrations allows dev teams to innovate efficiently

As healthcare delivery models evolve and digital information unlocks new possibilities, a vast array of ecosystem participants face pressure to:

* **Build and manage consolidated patient portals** that link patients, patient advocates, and extended healthcare teams and that extend across multiple service providers.
* **Empower patients** with convenient self-service options and quicker access to appointment information, test results, diagnoses, forms, documentation, and their healthcare providers.
* **Provide rapid virtual care and assistance,** overcoming distance and time constraints and increasing accessibility of healthcare (and related) services.


 
From established healthcare providers to newcomers aspiring to dominate entirely new markets, the organizations best positioned to succeed will be those that are best able to implement fundamental identity capabilities and extend beyond the identity basics.

All the while — and in everything they do — healthcare organizations have to comply with complex regulatory requirements (e.g., HIPAA, GDPR), which vary by jurisdiction and are often layered (i.e., state laws versus federal laws).

But with developer resources already in short supply and with a healthcare organization's primary applications rightfully commanding the lion's share of attention, engineering organizations need to satisfy identity requirements as quickly — and with as little custom code to write or maintain — as possible.

For example, Jay Anslow, Senior Software Engineer at [Babylon Health, shared with us that](https://auth0.com/case-studies/babylon-health), "We estimated that it would take a team of eight staff at least a year to meet our new requirements with a home-built solution. As well as the cost of having that team, it would have delayed our timeline, so we wouldn't have been able to get our functionality out the door as quickly."

## Identity Enables the Healthcare Ecosystem

Identity, particularly as it relates to securing sensitive data and complying with privacy regulations, has been a foundation of healthcare since long before the digital revolution — but as healthcare delivery organizations (HDOs) embraced new information formats and leveraged the Internet for collaboration, communications, service delivery, and other functions, customer identity and access management (CIAM) systems became essential elements of healthcare organizations' technology stacks.

On top of the transition that was already happening, the COVID-19 pandemic "caused a seven to ten-year acceleration in consumer and digital trends," [according to Richard Schwabacher, Senior VP of Digital Health and Chief Digital Officer at BioReference](https://auth0.com/case-studies/bioreference). The result is that "Securing, transmitting, and authorizing patient access to health information digitally is now critical to the practice of medicine and core to what is needed from a modern digital health solution."

And CIAM is vital to this functionality. Out of the box, leading CIAM solutions include many features that can help healthcare organizations meet new needs, allowing even small engineering teams to:

* [Create patient-centric experiences](https://auth0.com/case-studies/bioreference), built around each individual’s needs and preferences;
* [Enable a vast, interconnected, and growing healthcare ecosystem](https://auth0.com/case-studies/providence); and
* [Simultaneously meet security, privacy, and convenience](https://auth0.com/security) needs, rather than trading off between these necessary elements.

But while out-of-the-box functionality is important, the real world is a complex and dynamic beast (as anyone who's ever done a year-over-year roadmap comparison understands). Being able to accommodate change and tailor identity to your unique needs — and doing both without drawing too heavily upon developers — is the difference between CIAM as a necessary component of your application stack and CIAM as an operational and competitive advantage.

## Actions Integrations and the Auth0 Marketplace

A modern CIAM solution can tackle [the healthcare identity basics](https://auth0.com/healthcare) (e.g., signups, logins, account updates, password retrievals, etc.), but satisfying advanced use cases often requires transacting with other business systems and third-parties to execute complex conditional flows.

However, identity is a very difficult and specialized domain. Here's a quick exercise: think of a subject that you know a lot about, something where you're truly an expert. And now, think about how non-experts oversimplify the problems in that area and are overconfident in their ability to solve them. Sure, it's not _impossible_ for them to do so, but it will likely take much more time and effort than they imagined, and the implementation would potentially fail to address corner cases and other complexities.

Identity is like that! An in-house developer team could drop everything else and focus considerable effort on extending an identity implementation by building (and maintaining) a custom solution to every new use case — or they could leverage a straightforward way to make identity work with other business systems quickly and effectively.

And that's where [extensibility](https://auth0.com/extensibility) comes into play.

Since launching in late 2020, [the Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party identity solutions for their applications and APIs.

[Actions Integrations](https://auth0.com/blog/auth0-no-code-actions-integrations-now-available-in-beta/) make it even easier to extend Auth0 with partner-built innovations, often with no-code, drag-and-drop ease; in fact, you can even 'stack' these integrations like building blocks to keep up with new needs and address advanced use cases.

To illustrate, let's look at some examples of how [identity proofing](https://marketplace.auth0.com/categories/identity-proofing), [mobile device verification](https://marketplace.auth0.com/integrations/incognia-authentication), [customer data platforms](https://marketplace.auth0.com/integrations/tealium), and [consent management](https://marketplace.auth0.com/categories/consent-management) integrations can be combined and conditionally employed to contribute to a strong security posture and create positive experiences for customers.

### Registering, logging in, and scheduling appointments

To meet growing expectations for convenience, healthcare organizations must make it easy for patients to register and schedule appointments — but at the same time, the signup process must be secure and must address compliance requirements.

Here's how third-party integrations can help satisfy these simultaneous needs:

* The patient initiates the registration process/account creation
* The sign-up flow within the identity engine calls upon an identity-proofing solution to verify the patient's identity
* Next, the flow calls upon a consent management solution to ensure the patient understands and agrees with how their information will be handled with respect to regulations
* Finally, the identity engine encourages the patient to enroll in [multi-factor authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa) as an added security measure; if the patient agrees, then the flow walks them through the process

To simplify future logins, the identity engine can employ mobile device verification when the patient attempts to access healthcare services via the organization's mobile app.

Once logged in, a patient can schedule an appointment:

* The patient selects "schedule appointment."
* The identity engine uses MFA to verify it is indeed the patient attempting to make the appointment
* If the patient passes the MFA challenge, the appointment is confirmed

Note that this process can be augmented by employing [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa) and limiting MFA's use to when a risk threshold is exceeded.

### Changing/updating personal information

Healthcare organizations handle an enormous volume of sensitive data, including personally identifiable information (PII) and protected health information (PHI). Consequently, it's vital that only authorized users can access and modify information.

Here's a potential identity flow for patient self-service:

* The logged-in patient clicks on "update my profile."
* If the patient is using the mobile app, then the identity engine can call upon a mobile verification solution; otherwise, the identity engine can employ an identity-proofing solution
* With the patient's device or identity verified, they are now authorized to change their information
* If the information being changed is of sufficient sensitivity (e.g., relating to financial or insurance records), then the identity engine can engage MFA as an added layer of security/confirmation
* The patient's information is saved
* The identity engine passes the updated information to the CDP

### Securely accessing healthcare documents and services

Delivering healthcare services requires holding and managing access to huge numbers of documents, from information forms to lab results. Enabling patients to access their healthcare documents eases the workload for staff and can accelerate care.

In addition, telehealth reached new levels of adoption during the pandemic to help protect vulnerable people and reduce the spread of COVID-19 — but with healthcare fraud a real risk, it's important to verify that a patient is who they say they are.

Here's how identity can help. Suppose a logged-in patient clicks to access a particular health document or service. Depending upon the situation, the identity engine can conditionally branch into a number of paths:

* If the patient is using the mobile app, then the flow can call upon a mobile verification solution.
* If the patient is using a new or different device, then the identity engine can initiate an MFA challenge.
* And for especially sensitive information, then the identity engine can call upon an identity-proofing solution.

With verification complete, the patient is now able to access the document or service.

Note that these flows can also incorporate risk scoring and behavioral validation. For example:

* The identity engine can check the patient's device posture against a third-party risk service: if a risk threshold is exceeded, then a higher level of verification can be employed.
* The identity engine can check behavioral data against the patient's CDP profile: for instance, if the patient usually accesses their healthcare portal from a particular geography but in this attempt is somewhere new, then additional verification may be warranted.

### Paying bills

Healthcare organizations also hold vast amounts of financial records — including bills, bank account details, and insurance information — that must be safeguarded. But at the same time, making it easy for patients to view and pay their bills is important.

Fortunately, identity flows can allow patients to view, download, and pay invoices remotely through a third party or an in-house app:

* The logged-in patient navigates to a bill and attempts to open/view it
* The identity engine calls upon mobile verification to confirm the patient's device; alternatively, the identity engine can upon a CDP to confirm the patient's location
* If the device is not recognized or the patient is logging in from a new location, then the identity stack can initiate an MFA challenge
* With the patient's identity verified, they are able to open the bill and access the billing/payment system

## A World of Extensions and Opportunities

Extensibility is a core Auth0 principle. [Our identity platform](https://auth0.com/resources/videos/platform-introduction-video-2020) is designed to be easy to deploy and even easier to tailor to your unique business needs, so you never have to choose between customizability and ease of deployment.

Plus, with [a long list of security and privacy certifications](https://auth0.com/docs/secure/data-privacy-and-compliance) and[ the option to deploy the Auth0 Identity Platform in a private cloud](https://auth0.com/resources/whitepapers/private-cloud-deployment), healthcare organizations can be confident that their identity implementations help meet their regulatory requirements.

We're excited about the potential unlocked by the rich ecosystem of third-party integrations, as they allow our customers to continually add new capabilities as needed.

Whether you prefer the pro-code approach of [Actions](https://auth0.com/docs/customize/actions) or the no-code convenience of Actions Integrations found within [the Auth0 Marketplace](https://marketplace.auth0.com/), we encourage you to explore the options to see which of your identity and identity-related use cases already have a ready-built solution just waiting to be integrated!

Extending CIAM to Enable Modern Healthcare Applications

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Recognizing the efforts of the Okta and Auth0 teams during 2021

As 2021 starts to draw to a close, we all find ourselves reflecting on the year. We’ve all been through a lot — both inside and outside of work — and I know how hard our employees have worked this year to provide the best possible product, innovations, and service for our customers.

So to say thanks for all their efforts — and to ensure everyone has the chance to spend time with family, go on an adventure, or just kick back on the couch with ice cream — both Okta and Auth0 teams will have the week of US Thanksgiving and the week following Christmas as a company holiday.

While these weeks are designated holidays, business continuity and reliability are our first priority. All support, customer success, engineering, and communications teams will rotate weeks away to ensure there is no disruption for our customers. We’ve also implemented an extended period of code freeze during the holiday season, with an elevated approval process for exceptions to limit any risk of service disruption. For all of the details on our ongoing resiliency efforts, [please visit here](https://auth0.com/blog/improving-our-platform-resiliency-and-upcoming-holiday-plans/).

Too often in our industry, we overvalue work and undervalue rest. We don’t work so we can rest. We rest so we can work — and grow and change, which lets us continue to provide our customers the best possible experiences.

We are committed to bringing our very best to you all in the coming year.

Thank you,

Eugenio Pace

We Are Thankful for Our Team

ginocingolani

Obsessed about providing the best experience to the customers that use Auth0 everyday. I've been building products for the last years in a wide range of companies. I enjoy riding two-wheel vehicules and eat yummy things on my free time. Based in Buenos Aires, Argentina.

Product Manager @ DX-DevPro

Gino Cingolani Trucco

A simpler user experience for the teams in charge of protecting your end-user identities.

Security is one of the [main concerns for any software company](https://auth0.com/resources/whitepapers/broken-authentication), and nowadays, every company is a software one. One [security incident or data breach](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/) can make customers lose trust in an organization or even put the entire business at risk. At Auth0, we know that, and that's why we've been laser-focused on [improving the security capabilities](https://auth0.com/resources/whitepapers/real-time-credential-stuffing-attack) of our product over the last months. 

From the moment we started engaging heavily with our customers' security teams, we heard feedback that the experience of configuring security features could be much better. Today we're introducing a new and improved way to configure all the security-related features in your Auth0 dashboard. Our aim is to provide a simpler and clear experience for developers, operators, and administrators in your tenant.

Here's a quick demo of the changes:

<include src="Vidyard" id="TdcAGF2oqmcEMjFKSYYaFZ" />

## A Single Destination 

[Multi-factor authentication](https://auth0.com/docs/mfa) and Anomaly Detection are the key-feature sets our customers use to protect their users' accounts. Used separately or in combination, these features have the ability to identify and stop malicious access attempts before they occur. We grouped them into a unified section in our Management dashboard called Security. By doing this, we're creating a centralized place that will be the main destination for security teams and where the current and the upcoming functionalities will live in our dashboard.

## Better Feature Names, Aligned With Industry

We listened to feedback from many customers, and one of the most common comments is that some of Auth0's feature names could use more clarity. For example, while any security engineer could understand what a brute force attack is, few could guess what our feature "Brute Force Protection Targeting Multiple Accounts" did. In this case, the feature actually throttles traffic from IPs that are sending a suspicious number of requests, attempting to login to a large number of accounts. In this particular example, we renamed the feature "Suspicious IP Throttling," which clearly reflects what the feature does.

![Better Feature Names, Aligned With Industry](https://images.ctfassets.net/23aumh6u8s0i/6qRab3rfTbgAqJfN1AQGGU/824dae1b55a1c0c411d70900cecbae12/better-feature-names-table-final)

## Status Overview

On the new Attack Protection view, teams [can quickly understand if a feature is disabled, in monitoring mode, or enabled](https://auth0.com/docs/attack-protection). Monitoring mode means that the events triggered by the functionality are being logged in the Auth0 Tenant Logs. Enabled means that in addition to the events being logged, a response is triggered. That response can be a CAPTCHA displayed when a suspicious login is detected with Bot Protection, an IP being throttled when an automated attack is detected with Suspicious IP Throttling, a user block for multiple failed attempts to one account from a single IP with Brute Force Protection, or blocking a user with compromised credentials with Breached Password Detection.

![Status Overview](https://images.ctfassets.net/23aumh6u8s0i/20izyZlMtSCoOh1sJaCVRO/7f31cbacd8fdd85480ca08a1e9e7230f/attack-protection-03)

## Monitoring Guides to Empower Security Teams

At Auth0, we know that security teams want to access the information they need with the tools they already use and love. That's why we crafted guides to empower and enable teams to build security-oriented dashboards on third-party analytics tools. By [leveraging the power of our Log Streaming feature](https://marketplace.auth0.com/features/log-streaming), customers can stream events to [Datadog](https://auth0.com/blog/auth0-partners-with-datadog-to-deliver-mission-critical-identity-data-in-near-real-time/), [Splunk](https://auth0.com/blog/auth0-and-splunk-provide-enhanced-security-and-operational-monitoring-and-insights/), and [Sumo Logic](https://auth0.com/blog/auth0-partners-with-sumo-logic-for-continuous-intelligence/) and build powerful dashboards to enable real-time threat detection monitoring.

![Monitoring Guides](https://images.ctfassets.net/23aumh6u8s0i/6bsqGnswIMbHRDtSMQxk4A/75efa9b765f986be947ffd61c7cefce1/monitoring-01)

## Learn More and Give Us Feedback

* Let us know what you think using [Auth0 Community](https://community.auth0.com/t/improving-the-way-you-configure-security-settings-in-the-auth0-dashboard/54556).
* Read the updated [Attack Protection](https://auth0.com/docs/attack-protection) documentation.
* Understand [how you can use Multi-factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/) to protect your users.
* Learn more about [our recently launched beta for WebAuthN](https://auth0.com/blog/fido-security-key-support-comes-to-auth0/) with security keys.

 
<include src="asides/AboutAuth0" />

Improving the Way You Configure Security Settings in the Auth0 Dashboard

kerry-ok

Kerry is a marketer that loves to partner with the sales organization. As our SVP for Marketing, she is focused on sharing the Auth0 narrative across the globe. Before Auth0, Kerry spent many years working in B2B Tech at Skytap and F5 Networks. She spends her spare time with her family, dog, working in the yard, and enjoying fantasy football.

Chief Marketing Officer

Kerry Ok

Auth0 teamed with SD Times to discover how organizations evaluate and purchase technology

Over the last decade, most organizations have transformed into software companies. [As Marc Andreessen famously said](https://a16z.com/2011/08/20/why-software-is-eating-the-world/), “Software is eating the world, in all sectors. In the future, every company will become a software company.” Additionally, you often hear expressions like, “In the application economy, software developers reign supreme.” And yet, there is a persistent stereotype that executive management holds all of the power in how organizations evaluate and purchase technology. We wondered: is this still true? Do developers and technologists actually hold more power now? Can the way a company buys technology to be a competitive advantage?	

To uncover the answers, Auth0 partnered with SD Times to survey developers, managers, and executives in application development across the globe. We discovered their views on the importance of SaaS components to their teams and on how they research, evaluate, and purchase these platforms. All of the research findings have been pulled together into the Auth0 Report: [_How Development Teams Purchase SaaS_](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas). Here are a few of the insights we found:

* Companies that innovate fast (speed/frequency of releases) use SaaS components far more often than those that don’t.

![Percentage Apps](https://images.ctfassets.net/23aumh6u8s0i/2yrBhT0Q5hbBt0vreKpASv/8b82d69eec462155337af2fc3c05a3b3/saas_01_percentage_app)

* Outsourcing authentication can help companies reduce their time to market.

![Reduce your Time](https://images.ctfassets.net/23aumh6u8s0i/75kiSjLIngUxTKfqMtPmSh/3b788f7511a3db4a05390352b0fde11d/saas_02_reduce_time)

* Company size does not have a large impact on how they research third-party SaaS components.

![Researching](https://images.ctfassets.net/23aumh6u8s0i/3rA8zPrHqSad7vKs6P75TW/0b88a1e19eb9897d2862802a4823e9d5/saas_03_researching)

* Developers initiate 34% of SaaS component purchases, which is slightly higher than both technology management or technology executives.

![Product](https://images.ctfassets.net/23aumh6u8s0i/3hNCCyr8pdqYAEQXQyXLwX/787f028184e311d74a927f3c9af09b27/saas_04_product)

* Developers care greatly about being consulted in SaaS component purchase decisions. It impacts both job satisfaction and productivity.

![Developers](https://images.ctfassets.net/23aumh6u8s0i/1e7ug06moZrxRfQZaruvHK/5926f8ffff6ca7320524bd0c7f54c6ee/saas_05_developers)

* These are just a few of the insights for the How Development Teams Purchase SaaS report; [you can download the full research report here](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas).

<include src="asides/AboutAuth0" />

How Development Teams Buy SaaS

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New survey reveals behaviors and usage patterns of application builders; authentication required in 83% of applications built

**BELLEVUE, Wash. – May 19, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today released a [**2020 State of Application Assembly**](https://auth0.com/resources/whitepapers/state-app-assembly-2020) survey, revealing that a majority of development teams are turning to best-in-class SaaS services and the adaptability of APIs for building unique features and functionalities into the many apps they are responsible for each year.

Surveying 426 global technical professionals across a variety of roles (developers, engineers, CTOs, directors of engineering, software architects) and company sizes, Auth0 determined that 51% of respondents are responsible for building two to five apps per year, and more than a quarter (28%) build 6-10+ apps per year, with three-quarters of these apps being used for external audiences. There are currently more than 4.1 million apps available on leading app stores ([Statista](https://www.statista.com/statistics/276623/number-of-apps-available-in-leading-app-stores/)), indicating the staggering amount of development these builders are responsible for. 

The survey explored application builder behavior around several services and key findings included: 

* For applications that required payment, 74% of respondents outsourced, with Stripe being the dominant tool of choice.
* For applications that required messaging, 71% outsourced this solution, with Twilio being the highly preferred tool.
* The third service explored was authentication, cited as a requirement in 83% of applications built. However, the numbers for outsourcing authentication were lower than the other two services, with respondents outsourcing 58% of the time. 

With a substantial percentage of companies still building authentication tools in-house – and because authentication is present in the majority of apps – there’s a large potential opportunity for application building teams to streamline their processes and improve efficiency by using a third-party IDaaS tool. 

The accelerated timelines that come with app launches are driving teams away from in-house development and towards microservices – app ‘building blocks’ – that provide features and functionality that would be nearly impossible to build and maintain themselves. Relying on third-party services that are adaptable to their specific needs, significantly frees the team’s resources to focus on core innovation and speed-to-market. 

“These results confirm a trend of application development teams increasingly relying on first- and third-party APIs and external SaaS services when assembling apps, to simultaneously decrease time-to-market and increase completeness and security,” said Martin Gontovnikas, SVP of Marketing and Growth at Auth0. “Whether it’s payments, messaging, or authentication, this survey shows that teams are turning more to a ‘must-have SaaS stack’ to expedite development and enable them to focus on their core product.” 

The move to outsource services that are proven and fully adaptable gives application teams a competitive edge in innovation and implementation. By 2022, 90% of all apps will feature microservices architectures that improve the ability to design, debug, update, and leverage third-party code. Combined with agile/DevOps approaches and methodologies, enterprises can dramatically accelerate their ability to push out digital innovation – at 50-100x (or more) the frequency of traditional approaches ([IDC](https://www.idc.com/getdoc.jsp?containerId=prUS44417618)).

Please visit the [State of Application Assembly](https://auth0.com/resources/whitepapers/state-app-assembly-2020) for further details and to view all survey results.


<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk 
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com)

Hannah Carroll 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Majority of Application Development Teams Rely More On SaaS Services vs. Building In-House

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Savvy insurers are forging ahead with digital transformation. Don't let your team fall behind.



Many people believe the insurance industry is stagnant. However, in reality, insurance is constantly evolving.

As the world changes, insurance companies must provide new offerings to keep up. For example, insurance for driverless cars or rideshare services wasn't on the radar of most insurance companies until only a few decades ago. And, new technologies — such as drones and [IoT](https://auth0.com/blog/security-for-smart-home-devices/) — also challenge insurance companies to keep pace.

Add to that [increasing customer expectations](https://auth0.com/blog/how-to-keep-up-with-hyperconnected-consumers/), new threats to security, [the rise of insurtech](https://useindio.com/how-to-defend-insurance-agency-against-insurtech/), and ever-changing regulatory requirements, and the insurance industry is anything but dry.

However, despite these frequent shifts, too many insurance companies are resistant to digital transformation, and that resistance means they risk falling behind — or worse.

## What Exactly is Digital Transformation?

[Digital transformation](https://auth0.com/app-modernization) is more than just an oft-repeated buzzword. Put simply, digital transformation means leveraging technology. Digital transformation refines or even [automates existing business processes](https://auth0.com/blog/staying-safe-in-the-automated-workplace/) to ultimately improve the operation of your business and the experience of your customers.

“Insurers that digitize the enterprise in this way can automate slow, error-prone and expensive processes for increased speed, accuracy and cost efficiency,” explains a [whitepaper for EY](https://www.ey.com/Publication/vwLUAssets/ey-digital-transformation-in-insurance/$FILE/ey-digital-transformation-in-insurance.pdf).  

![Outdated infrasrtucture presents risks](https://images.ctfassets.net/23aumh6u8s0i/2tHULoDyNDOhrE58j4hLPJ/8bf6a6e1653a647f3e5c73c2e821aaa2/outdated-computer)

[Image via Pexels](https://www.pexels.com/photo/computer-computer-keyboard-contemporary-display-257881/)

When executed correctly, digital transformation will streamline and simplify company operations for both short-term and long-term gains.

## The Risks of Outdated Infrastructure in Insurance

Despite the numerous benefits of digital transformation, many people still bristle at the idea. Change is difficult, and in an industry like insurance — where established firms have succeeded with business-as-usual for decades — introducing new technologies can ruffle some feathers.

However, failing to keep up comes with numerous risks and consequences.

Of course, cybersecurity is top of mind for many companies. But, it’s become a major priority in the insurance industry.

Hackers are increasingly [targeting insurance companies](https://www.cio.com/article/2899488/data-breach/health-insurance-companies-prime-targets-for-hackers.html) because they deal with sensitive customer information for the claims and underwriting processes — such as healthcare and financial data — yet are notoriously slow to implement measures to protect themselves and their customers.

International business auditing firm KPMG [surveyed more than 100 insurance CEOs](https://home.kpmg/qm/en/home/insights/2017/01/facing-the-cyber-threat-in-the-insurance-sector.html). Less than one in five of them believed that their company was adequately prepared for a cybersecurity threat.

Any sort of cyber event or data breach is undeniably bad for business. First, there’s the financial fallout. [Liberty Mutual’s shares dipped by 4%](https://www.businesslive.co.za/bd/companies/financial-services/2018-06-19-liberty-share-falls-after-data-breach/) in June of 2018 after the company disclosed a recent data breach.

In the well-known breach of the information of approximately [78 million policyholders at Anthem](https://www.insurancejournal.com/news/east/2017/10/10/466958.htm), the company agreed to pay $115 million to settle lawsuits resulting from the breach. The total amount that event cost them is more than triple that, once you include costs associated with incident response and resulting security enhancements.

Finances aside, a disregard for changing technologies and increased security threats can have dire effects on a business’ relationship with customers as well.

When customers feel that their private information isn’t treated with the care and consideration it deserves — such as in the case of a [State Farm customer](https://abc7news.com/technology/exclusive-sj-woman-discovers-security-breach-in-state-farm-app/775904/) who discovered a breach within the company’s app when she was able to access other policyholders’ information — all trust is lost.

"How can I not worry?” the customer said in an [interview with ABC7 News](https://abc7news.com/technology/exclusive-sj-woman-discovers-security-breach-in-state-farm-app/775904/). “Who has my information if I have their information?"

## What Insurance Companies Can Do to Step Into the Digital Age

Digital transformation is a must for insurance companies; however, the risks of botching an update that compromises vast sensitive data are real. How can insurers move forward without fear?

Here are three strategies insurance companies should use to protect themselves and their customers and improve their businesses in the process.

![Digital transformation is a must for insurance companies](https://images.ctfassets.net/23aumh6u8s0i/6vRX3OydveKV04LmxKKJF5/48b97c4270ecba8e0be7b1dedcaf9fc7/new-computer)

[Image via Pexels](https://www.pexels.com/photo/person-using-macbook-374720/)

### 1. Implement Better Customer Identity Management Measures

Nearly all insurance companies provide a portal for customers to log in and access their profiles, personal information, claim statuses, and more. But legacy systems for user registration and authentication are a barrier they need to move past.

Insurers need to establish better [customer identity management](https://auth0.com/b2c-customer-identity-management) to make it easy for customers to access their accounts— while making it simultaneously difficult for hackers.

### 2. Invest in advanced features like Anomaly Detection to Better Identify System-Wide Threats

Unfortunately, it’s far too easy for breaches and other malicious events to go undetected for a surprisingly long time.

As just one example, an [investigation into the well-known breach at Anthem](https://www.bankinfosecurity.com/new-in-depth-analysis-anthem-breach-a-9627) revealed that it all started with a lone phishing email that was opened by an employee in February 2014.

However, Anthem wasn’t able to [disclose the attack and notify customers](https://www.usatoday.com/story/tech/2015/02/05/anthem-health-care-computer-security-breach/22917635/) until February 4, 2015 — a year after it all began. By that point, the hacker had compromised at least 90 systems within the Anthem enterprise environment.

This speaks to the importance of having [anomaly detection](https://auth0.com/docs/anomaly-detection) in place that can alert you and your users of suspicious activity the moment it happens. Auth0 not only makes you aware of the attempts to access your application, but also blocks future login attempts—so you can catch the problem before it becomes even bigger.

### 3. Ensure You’re Up to Date With Changing Security Regulations

The increasing threats in the insurance industry haven’t gone unnoticed. That’s exactly why security regulations and requirements continue to be introduced to mitigate the potential of malicious activity.

[GDPR](https://auth0.com/gdpr/), which went into effect in May 2018, requires that organizations using data of EU citizens abide by a set of strict standards when collecting, processing, storing, and sharing personal information. Teams that fail to comply could be fined €20 Million or up to 4% of annual revenue.  The regulation has had a [ripple effect](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/) across the world, with states like California following suit.

And, the insurance industry itself has taken steps toward stricter regulations and protective measures. The [National Association of Insurance Commissioners](https://www.naic.org/cipr_topics/topic_cyber_risk.htm) formed the Cybersecurity (EX) Working Group in response to the increasing demands on insurance companies. (These charges now fall under the Innovation and Technology (EX) Task Force.)

Before disbanding, this group completed numerous cybersecurity activities. Most notably among these was the adoption of the new Insurance Data Security Model Law (#668), which requires insurers and other entities licensed by state insurance departments to develop, implement, and maintain an information security program, investigate any cybersecurity events, and notify the state insurance commissioner of such events.

Keeping up with these sorts of regulations can be challenging, but Auth0 makes it painless. The platform supports industry-wide authentication standards and ensures compliance with the growing requirements of numerous leading organizations. Plus, [Auth0’s extensibility features](https://auth0.com/app-modernization) ensure that your identity platform can grow and evolve along with your business and industry.

![Stay up to date with changing security regulations](https://images.ctfassets.net/23aumh6u8s0i/2FdDc3lTZZSe4yBmMKpWwP/0779ad8e95312299b7fafc971e57dc77/security)

[Image via Pexels](https://www.pexels.com/photo/internet-screen-security-protection-60504/)

## Updating Legacy Systems: Insurers Need to Keep Up

The above steps will help insurance companies protect their information as well as the information of their customers. However, there’s also no neglecting the importance of employee education and awareness.

The better trained and informed insurance teams are about suspicious activity, the less likely they are to fall for various phishing scams and attacks.

Combine thorough employee training with the above tips, and insurers will step into the digital age — while also improving their businesses and customer relationships.


How Insurance Teams Can Quickly Step Into the Digital Age

How top teams are updating their legacy systems with more secure and efficient solutions.

You used to pay with cash. Then credit cards. Then EMV cards. Now, we’re moving toward things like [cryptocurrency](https://auth0.com/blog/an-introduction-to-ethereum-and-smart-contracts-part-3/) and [biometric authentication](https://auth0.com/blog/tags/biometric-identity/).

Payments and the technology involved in making them are constantly evolving. For example, payment company Square recently added [_Square Register_](https://techcrunch.com/2017/10/30/square-announces-the-register-a-999-point-of-sale-device-for-larger-businesses/) to its hardware lineup. Unlike most of Square’s other equipment, Square Register targets the needs of larger sellers.

![New Square Register hardware that targets larger sellers](https://images.ctfassets.net/23aumh6u8s0i/3cB517ydiTQ1OrJtW1Xcgp/21b12b0ff377b06d77686c542522fb9f/square-register)

At the same time, Mastercard is [_doing away with signatures_](https://newsroom.mastercard.com/press-releases/signing-off-mastercard-moves-beyond-signatures-worldwide/) on the backs of credit cards, and on receipts themselves, in favor of exploring more advanced technologies for identity verification. 

Even PayPal has jumped on the payment revolution by going beyond ecommerce. PayPal now offers customers the option to use their [_PayPal balances_](https://www.tearsheet.co/payments/how-paypal-is-moving-into-physical-retail) at physical retail shops through Android Pay. 

Needless to say, the [_financial services_](https://auth0.com/financial-services) and payments landscape is ever-changing. And a business that wants to remain competitive within its industry needs to look at [updating its legacy system](https://auth0.com/blog/how-do-i-modernize-my-legacy-system/) (or even ripping and replacing it) in order to be more secure, efficient, and compliant with customers’ financial data.

## What’s Inspiring These Changes?

We live in an age of [seemingly constant innovation and advancement](https://www.teampay.co/insights/how-blockchain-will-change-finance/), so it makes sense that payments are following suit.

But there are a few other factors involved in pushing these advancements in payment technology.

One is the uptick of credit card fraud and, as a result, the increasing consumer concern about their security and protection.

![Advancements and the Future of Payments and Payments Processing in 2019](https://images.ctfassets.net/23aumh6u8s0i/2tbJEM41OF7GvxFNduJbpT/1726b2e1900063ee05eb56c52b9a572f/future-of-payment)

Credit card fraud has steadily been on the rise. In fact, the [_financial industry estimates_](https://www.accenture.com/us-en/insight-banking-future-payments-ten-trends) that we’ll reach $31.3 billion in global credit card losses by the end of 2018. Credit card scammers are getting smarter. Today, these fraudsters are capable of not only [_selling credit card numbers_](https://www.businessinsider.com/credit-card-fraud-scam-what-to-do-2018-8) but also identifying information like zip codes. 

Additionally, new [_payment regulations_](https://home.treasury.gov/sites/default/files/2018-07/A-Financial-System-that-Creates-Economic-Opportunities---Nonbank-Financi....pdf) demand an increasing level of transparency and security. To stay compliant, businesses have no choice but to keep up with the changing technology and rules.

## The Future of Payments: 3 Advancements to Be Aware of in 2019

There’s no shortage of changes happening in the payments space. But trying to stay on top of (or even *ahead* of) all of them is a daunting task.

If you're like most companies, you're primarily focused on what you need to know right now. But to remain competitive, you have to stay ahead of the curve. What will payments look like in the future? Here are three burgeoning areas that you should be aware of as you look at updating your own legacy systems.

### 1. Multi-Factor Authentication Will Gain Even More Importance

As concerns over security continue to grow (for good reason), [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) will be of increasing importance for consumers and businesses. 

Traditionally, you could access various accounts by entering a single identifier (think a username or an email address) and a correct password. 

But multi-factor authentication adds another layer to the identity-verification process by asking you to prove your identity in another way — for example, by entering a code you receive on your cell phone or even scanning a fingerprint.

You can think of it as a second security door. Hackers and thieves who are able to make it through the first will have a much tougher time passing through the second.

Because more and more financial and payment data is linked to our personal accounts (your credit card being stored in your Amazon account is just one example), we’ll see multi-factor authentication become the norm more and more. 

Many regions are actually instituting policies to mandate strong customer authentication—like [_PSD2 in Europe_](https://auth0.com/blog/open-auth-standards-psd2/). 

### 2. Point-of-Sale Analytics Will Become Even More Advanced

While the protection of data is an area of primary focus, so is* leveraging* data.

To make more informed predictions about the future, businesses are hungry for any information about what their customers are purchasing. That means we’ll see [_retail analytics_](https://auth0.com/blog/retail-analytics-past-present-and-future/) continue to expand — with an emphasis on point-of-sale analytics. 

Previously, POS analytics were fairly straightforward — they shared what was purchased, and by whom. But today these analytics are capable of reporting on where the item was stored or where it was shipped from and can provide information about inventory and dead stock and even details about the [_customer's identity_](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/) and their consumption patterns.

As we move into the future, payments are no longer just a one-time transaction with little to no data attached to them. Instead, this important point of contact will become an informative touchpoint for businesses to learn even more about their consumers. 

### 3. User Experience Will Be Paramount

Convenience and ease of use are main areas of focus for today’s customers. They’re no longer writing out checks or counting out stacks of coins—they want the payment process to be as streamlined as possible.

Just look at something like [_ZAPBuy_](https://www.prnewswire.com/news-releases/omnyway-launches-zapbuy-allowing-shoppers-to-buy-products-from-ads-with-a-snap-300425915.html), which was launched by Omnyway in early 2017. The tool allows users to hold their smartphones over an advertisement on any channel and immediately purchase what’s being promoted to them. 

Consumers have a desire to reduce or eliminate friction in the purchasing process, which is fueling this move toward more [_“invisible” payments_](https://www.tearsheet.co/payments/4-charts-that-show-the-coming-autonomous-payments-wave). Think about Uber as just one of many examples. You don’t think about making a payment when you step foot out of that Toyota Corolla—the transaction happens seamlessly behind the scenes. 

![Uber user interface and simple experience for the future of payments](https://images.ctfassets.net/23aumh6u8s0i/5bRmcm4wRgjkEXsWdYrgJz/24020dd49f3fcabbe8d6c24fcd5b69ab/uber)

When today’s customers see a clunky or cumbersome purchasing process, they immediately head in the other direction. Payments are expected to be fast and easy—and that’s an expectation that will only increase as Generation Z makes up [_40% of consumers_](https://www.accenture.com/t20171012T092426Z__w__/us-en/_acnmedia/PDF-62/Accenture-Driving-the-Future-of-Payments-10-Mega-Trends.pdf#zoom=50) by the year 2020.

## What This Means for You: Updating Legacy Systems in Your Business

Change is here for payments, and it’s going to keep coming.

That means it’s time to start looking at [updating legacy systems](https://auth0.com/blog/how-do-i-modernize-my-legacy-system/) related to payments in your business. While your current systems, tools, and software may work for you right now, they might not have the level of flexibility required to keep up in this ever-evolving industry.

Having the right resources in place will make it much easier to stay on top of—and maybe even ahead of—the constant barrage of changes and advancements in the world of payments. 

Wouldn’t you rather do that than fall behind? We thought so. 

<include src="asides/AboutAuth0" />

The Future of Payments in 2019

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Biometric authentication and Apple’s new T2 chip improves security in and out of the physical workplace.



On October 30th, Apple released three new pieces of hardware. The MacBook Air, iPad Pro, and Mac mini come hot on the heels of [Apple's iOS 12 rollout](https://auth0.com/blog/apple-ios-12-is-it-the-most-secure-ios-ever/) in September, along with additional changes to the iPhone and Apple Watch.

Far more than just expensive stocking stuffers, these devices have important security features that Mac-using teams should be up to date on. For teams looking to modernize their legacy systems, endorsing device upgrades is a concrete first step.

While many companies, particularly in finance, still rely on PCs, several tech-forward teams like IBM and SAP have brought Macs into the workplace. With many more employees working remotely and from their personal devices, it's important for all companies to stay up to date on these new devices — and their security features.

## The new MacBook Air includes Touch ID.

![MacBook Air - Touch ID](https://images.ctfassets.net/23aumh6u8s0i/2tel54DnDT3fvLAH6ON80Z/bcfe26059120b72a152c0c9d5272584c/macbook)

[[Image Source](https://www.macworld.co.uk/news/mac/macbook-air-2018-3605337/)]

In gold, silver, and space gray, the new MacBook Air finally has a fresh design for the first time since 2015. Its screen (13.3 inches) stretches across almost the entire width and has four times as many pixels (4 million total) as the prior version, which makes for a far more immersive visual experience. It also has an [improved keyboard](https://www.wired.com/review/apple-macbook-air-2018/), which is quieter than the 2015 version and has a larger trackpad.

In addition to the new retina display, the 2018 MacBook Air incorporates [Touch ID](https://auth0.com/docs/multifactor-authentication/touchid) that allows users to log on and make payments more securely.

Touch ID is a form of [biometric authentication](https://auth0.com/blog/tags/biometric-identity/), which requires inputting a unique physical feature (e.g., a thumbprint) to move forward.

![Macbook Air Touch ID Location](https://images.ctfassets.net/23aumh6u8s0i/2vlUvVOQP1yfPcHUQPAq4H/21a32a9693ebf715b163f646f2348c1a/touch-id-location)

[Source: [Apple](https://support.apple.com/en-us/HT207054)]

Biometrics used elsewhere include voice recognition, typing recognition, and even gait analysis.

Touch ID isn't a new feature (many users use it on their iPhones); however, it's new to the MacBook Air and improves the speed and quality of the experience.

Touch ID on the MacBook Air has several advantages. Primarily, if someone steals your device, and you've set up Touch ID, they won't be able to access your files without your fingerprint. Even if they have figured out your [password](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/), they won't be able to break in. As with other [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) methods, sealing sensitive data with additional layers of proprietary information can divert hackers towards easier targets.

One disadvantage of Touch ID is that Apple learns a user's fingerprint, based on a series of initial images it takes, which leaves room for error. A sensor combines several sections of a fingerprint and categorizes them into one of three basic fingerprint types: the arch, the loop, or the whorl. According to Apple, this mathematical representation leaves a [1 in 50,000 chance](https://support.apple.com/en-us/HT204587) that two people will be able to log into the same device to make the same transaction. To mitigate the risk, Touch ID improves its matching accuracy over time, based on a larger sample of log-in attempts.

Touch ID runs on Apple's new [T2 chip](https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overview.pdf). The T2 is a secure co-processor that works alongside the main CPU — the part of a computer that receives inputs and runs programs. The T2 (an update on the 2016 T1) focuses largely on encryption-related operations, underlying Touch ID. Because it exists separately from the CPU, the T2 diverts sensitive data from the core processor, which is what hackers often aim for.

For teams working with sensitive customer information, T2 and Touch ID work in unison to create a safer workflow.

## The iPad Pro relies on deeper machine learning with new Face ID feature.

![iPad Pro with Face ID Feature](https://images.ctfassets.net/23aumh6u8s0i/1dhgjrqOZJyEybPotsvHZb/a5864ca70d867ff04c8572f3615808e0/ipad-pro-faceID)

[Source: [Apple](https://www.apple.com/newsroom/2018/10/new-ipad-pro-with-all-screen-design-is-most-advanced-powerful-ipad-ever/)]

The iPad Pro offers many advantages for teams and individuals on the go. It's highly portable — 25% less volume and just 5.9 mm thin— yet maintains the largest display of any iPad. Its screen adjusts to the viewer's orientation (e.g., if you flip it lengthwise, like the iPhone, the display will flip accordingly), and Apple's True Tone and anti-reflective coating makes the experience feel more natural, particularly after heavy usage.

The iPad Pro also incorporates Face ID — another form of biometric authentication. As you might guess, Face ID relies on the user's facial features to unlock the device, which many see as a step beyond a simple thumbprint.

To achieve this level of recognition, Apple has embedded a deeper level of [machine learning](https://support.apple.com/en-us/HT208108) into the new iPad Pro. Its TrueDepth camera creates a detailed map of a user’s face from 30,000 data points. From there, the Secure Enclave (part of the T2 processor) encrypts it. The more times a user logs in, the more the software refines the facial model. It starts to learn a user's face even if she or he is wearing a hat or sunglasses, grows a beard, or puts on makeup. If it detects a close match (but not close enough), it prompts a user to enter a password for confirmation.

Because the iPad Pro is easy to travel with, the added facial recognition element helps balance the risk of taking sensitive data outside of an office environment.

## Mac mini helps secure the home office.

Many people don't think of adding an extra layer of security when [working from home](https://www.teampay.co/insights/tools-for-managing-a-remote-workforce/); however, with the number of [data breaches](https://auth0.com/blog/what-is-a-data-breach/) on the rise, being as careful as possible can pay off.

Suitable for both home computing and industrial-size tasks, the Mac mini has finally emerged from its prior 2015 form. The device has five times the speed of the old version and 70% more MSP (maximum sustained power) for working with larger files.

Many people use Mac minis at home if they're doing tasks like creating and uploading videos and music. Because it's not tied to a specific screen, the computer is more versatile, as well. It can easily sit on a desk or in a corner — wherever it's more convenient.

With regards to security, the Mac mini also relies on Apple's T2 chip.

![Apple's T2 Chip](https://images.ctfassets.net/23aumh6u8s0i/nQHG7K8GhMQ7hEiYjO1Yy/3db56419f33a5093c54dad9b05c6ce82/t2-chip)

[Source: [Apple](https://www.apple.com/mac-mini/)]

T2 also supports [Secure Boot](https://support.apple.com/en-us/HT208330), which helps ensure that when you start the computer, it loads only trusted software. If the OS doesn't pass verification, the user will be prompted to reinstall the software — or select a different startup disk, which will also have to pass inspection.

Running software that is outdated can introduce enormous risks into your system — holes that cybercriminals can move through or even the simple danger of losing data on your own if the computer shuts off or doesn't save work properly.

The Mac mini isn't as high profile as the rest of Apple's hardware, but for the employee without the benefits of traditional workplace security, it's a great foundation for keeping safe at home.

## Modernize your legacy systems to stay safe and productive.

[Updating your legacy systems](https://auth0.com/blog/how-do-i-modernize-my-legacy-system/), even at the level of individual pieces of hardware, can have an enormous impact on your workflow and security. New Mac products are expensive (the 2018 MacBook Air starts at $1,199, and the iPad Pro and Mac mini start at $799), but the benefits of safer authentication, separation between the core process and T2 chip for encrypted data, and the ability to double-check your OS before you run it can be profound.

Running on the latest systems can help mitigate threats like spyware, phishing, and bucket brigade attacks, also known as man-in-the-middle (MITM) attacks, which have [nearly destroyed companies](https://www.wired.com/story/equifax-breach-no-excuse/).

Even if your company hasn't invested in Mac devices, with many employees bringing their own devices to work these days or working remotely, understanding the rewards and vulnerabilities of the new Mac products can help you make smarter security decisions for your team as a whole.


What Mac-Using Teams Need To Know About Apple’s Latest Hardware Releases

Jose-Romaniello

I started working at Auth0 before the first line of code for our authentication platform existed. I’ve been able to go through the journey of seeing our ideas go from prototype to living production code that impacts millions of people. It’s satisfying to know that my actions here are having a positive impact in solving problems for developers like me.

Head of Engineering

Jose Romaniello

Learn how to apply the Scout code to software development to get code to a better state continuously.

When I was a kid, I practiced [_Scouting_](https://en.wikipedia.org/wiki/Scouting) for eight years I picked up a lot of excellent values and my scouting experiences helped to shape my character and make me a better programmer. Let me show you why.

As a Scout, you get to experience nature by camping outdoors which teaches you one of the core values — **respect life**. Scout rules help support core Scout values. One of the first rules I learned was:

> Always leave the campground cleaner than you found it.

This rule comes from a quote by [_Robert Baden-Powell_](https://en.wikipedia.org/wiki/Robert_Baden-Powell,_1st_Baron_Baden-Powell), founder and first [_Chief Scout_](<https://en.wikipedia.org/wiki/Chief_Scout_(The_Scout_Association)>) of [_The Scouts Association_](https://en.wikipedia.org/wiki/The_Scout_Association), and founder of the [_Girl Guides_](https://en.wikipedia.org/wiki/Girlguiding):

> Leave this world a little better than you found it.

What this rule represents is that you should not only pick up your trash, clean the area where you started a wood fire and the soil where you built your tent, but also you need to take a look at the campsite and do something to leave it better than it was before.

It is an explicit instruction. It helps you accept the notion that something can always be better. There’s always room for improvement. You had the opportunity to enjoy the area and its resources but you also have the opportunity to pay back by leaving the area in better shape for others.

I believe that when kids are taught this kind of values through games, repetition, and rewards, it becomes a habit. This is nominally known as [_positive reinforcement_](https://en.wikipedia.org/wiki/Reinforcement#Positive_reinforcement). Positive reinforcement takes place when a reward is presented as the result of certain behavior and the behavior increases. This trait has been embedded in my mind so that I don’t need to apply it consciously. It has become a behavioral reflex that integrates naturally in my day-to-day activities.

## The Codebase Is the Developer's Campsite

Even if I don't go camping often nowadays, I follow this rule in a lot of different situations in my life. One of them is in my daily work — programming!

Working on a new feature or a bug feels excellent. Working on a codebase change feels like camping as a Scout. It is an opportunity to:

- Experience the environment.
- Understand the problem.
- Put what I know in practice.
- Use my skills to create solutions.

The codebase will host me for hours or days. Even if I don't enjoy the codebase too much, I still have to respect it because other people have worked hard on it. It gives me an opportunity to learn new things and to possibly use tools I have never been exposed to before.

<include src="TweetQuote" quoteText="Even if we don't enjoy a codebase too much, we still have to respect it because other people have worked hard on it. We can work on taking little steps to improve it."/>

Once again, I have to assume that other people will get to "camp" in the project after me. People I haven't met yet and probably will never meet. They may be developers, project managers, even end-users. As thought leader and software craftsman [_Uncle Bob Martin_](https://twitter.com/unclebobmartin) says in his [_Scout Rule_](https://www.amazon.com/Things-Every-Programmer-Should-Know/dp/0596809484):

> “Indeed, the act of leaving a mess in the code should be as socially unacceptable as littering. It should be something that just isn't done.”

Therefore, not only my work in the codebase needs to be clean, but it should leave the code at least a little better than I found it.

These are some examples in which I have applied this improvement of the status quo within a project:

- It took me 30 minutes to understand what this function does. Can I rename it to something more declarative or expressive so that others can understand it quicker than I did?
- I wasn't able to run this project with the provided instructions. Can I write the instructions that I followed but are not documented in a README file?
- This code is more convoluted than it should be. Can I make it easier and clearer?
- This function doesn’t have enough tests. Can I add some tests?

These small improvements will help my teammates and myself later. The code is not going to end up perfect, but it will be better than it was before. By following this practice, the code grows in a better direction with every action that you take on it.

<include src="TweetQuote" quoteText="Small but powerful actions for teams that improve a codebase gradually: Vague naming? Make it explicit. Confusing code? Make it clearer. No documentation? Add steps to the README. Missing tests? Write one."/>

I have been doing software development for years and being a Scout had already prepared me to transfer the mindset and values exposed by Uncle Bob from the campsite to the codebase. But this approach is not an excuse for not allocating exclusive time and developers to fix issues in a codebase; it is just one way to continuously get things to a better state.

![Binary tree - example of clean code growing organically and gradually following the Scout development approach.](https://images.ctfassets.net/23aumh6u8s0i/5KLuJlW0dEoHg3Wf03i7t9/a11e8be6f2480802675a8d4daaf6c3c2/Binary-Tree)

<include src="asides/AboutAuth0" />

A Scout Approach to Software Development

3 lessons business leader can learn from the T-Mobile data breach to protect their teams and customers.

On August 20, T-Mobile discovered that a hacker had gained personal information from unauthorized access to its system. Over 2 million of its 77 million customers were exposed.

Although T-Mobile quickly reported the incident to authorities, it's apparent that the cybercriminal is [aiming to sell the data](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420), including names, ZIP codes, phone numbers, email addresses, and payment information.

While it's still too early to determine the financial consequences T-Mobile will face from the incident, a recent [study](https://blog.kenan-flagler.unc.edu/risky-business-the-impact-of-data-breaches/) from UNC found that data breaches can cost companies as much as 3% of their market value. Dashlane estimates the average dollar cost at [$7.35 million](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) in the U.S., 60% of which is customer (revenue) loss.

 What can business leaders learn from this incident to protect their teams and their customers going forward?

## Lesson 1: Hackers Go for Weak Points, So Protect Yours

Understanding how hackers get in is the first step. There are [four common ways](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/) that hackers access systems:

1. Malware infiltration (placement of malicious software, including ransomware and spyware)
2. Phishing (emails that trick recipients into giving away sensitive data or downloading a file that installs spyware)
3. USB traps (a hardware device that contains a HID spoof)
4. Mobile attacks (attacks specifically designed for mobile software)

In all cases, hackers look for the simplest vulnerability they can possibly use to compromise your system. That means they're not necessarily going to try to waltz in the front door. In the T-Mobile data breach, the thief was able to access the system through a hole in an API.

It's critical to plug your leaks. Since APIs run on web servers, they are available to all internet users. Like websites, hackers can crawl APIs.

### Authorize Your Users

To be sure you know who is working within your system at any one time, implement a strong user management system. You can build one in-house or outsource it. Many choose to outsource their identity management since the field is increasingly complex and time-intensive — a challenge for in-house teams to manage with the rest of their workload.

Auth0's [user management](https://auth0.com/user-management) dashboard, for example, lets administrators grant permissions for certain users to access sensitive customer information.

![Auth0's user management dashboard](https://images.ctfassets.net/23aumh6u8s0i/QocoCmdAqGCxzA9wCSqsp/c0f08f478e78129808dea8aa38477077/authorization-permissions)

With this powerful web interface, they can add or remove users, modify their profiles, and identify any root-cause login issues.

With APIs, it's also important to remember to authenticate your apps in addition to authorizing users. You can use a [standardized protocol](https://auth0.com/docs/api-auth) for both authentication and authorization.

## Lesson 2: Update Your Password Practices

A 2017 Verizon report found that [81%](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) of hacking-related breaches were due to stolen and/or weak passwords. While for years teams relied on the MD5 (message-digest) algorithm to hash passwords (create mathematical representations of plain text), today it's not considered the safest method.

<include src="TweetQuote" quoteText="A 2017 Verizon report found that 81% of hacking-related breaches were due to stolen and/or weak passwords."/>

Although originally MD5 hashes were designed to prevent anyone from working backwards from the hash to determine the real password, it's now possible to rapidly generate MD5 hashes to eventually find a matching password.

[Evidence](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420) points to T-Mobile password hashes being MD5, which suggests the company may have been using outdated password practices.

To prevent the risk of password hacking, many providers are using bcrypt instead — a more resistant algorithm. bcrypt uses a salt, an additional layer safeguard for passwords in storage. Over time, users can increase bcrypt's iteration count to slow the process. This makes it more resistant to brute-force search attacks.

### Implement Two-Factor Authentication

Two-factor authentication or 2FA is an alternative verification method. In addition to requiring users to type in a password, 2FA can also request a TOTP (a time-based one-time password algorithm) that it sends to the user's cell phone or other hardware device.

2FA can also require the second form of identification to be a biometric, such as a thumbprint or Face ID.

![iOS 11 iPhone X Face ID](https://images.ctfassets.net/23aumh6u8s0i/i6mkIBMKzZboV96MAaR8I/a18fc7a031c9f5660c611d89a7e52de0/ios11-iphone-x-face-id-hero)

[[Source](https://support.apple.com/en-us/HT208109)]

While none of these solutions are foolproof, a second method of authentication has been found to prevent breaches in [80%](https://www.slideshare.net/cheapsslsecurity/vip-strong-authentication-no-passwords-infographic-by-symantec)of the cases.

## Lesson 3: Improve Communication with Customers After a Data Breach

Although T-Mobile did attempt to notify customers whose accounts might have been compromised a few days after they discovered the incident, many of these recipients were put off — thinking the text message itself was a form of phishing.

![T-Mobile Data Breach Tweet](https://images.ctfassets.net/23aumh6u8s0i/1mspiKVeO2GUD8nXvUZw8z/7ba4d36cdc43e5edbcdbcf60907236b0/tmobile-tweet)

[[Source](https://techcrunch.com/2018/08/24/t-mobile-says-hackers-stole-customer-data-in-data-breach/)]

Texting can be a tricky form of communication for something so sensitive (particularly from a large, impersonal corporation). Organizations like [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) and Equifax have succeeded with well-crafted PR campaigns and explanations on their websites:

![Reddit data breach press release](https://images.ctfassets.net/23aumh6u8s0i/KD5ZLDwuM8UeOKhP3UW2K/bcb28aeb0eda8d90b2a6daee7e69f580/reddit-breach-release)

As a portion of the full announcement (which you can read [here](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)), Reddit clearly defines the scope of the breach, including details of what information the hacker accessed and how to know which users were affected.

Reddit also lets users know ahead of time that they will be contacting them through email to verify if their account has been compromised.

This is in stark contrast to T-Mobile's [vague description](https://go.skimresources.com/?xs=1&url=https%3A%2F%2Fwww.t-mobile.com%2Fcustomers%2F6305378821&xguid=85UTUFk2RzAa&id=66960X1514734&checksum=fc5d6ea7126bb8e6a7af56a7049975e787946c4e625ac9ceef083a8513bb04da) that their team shut down “an unauthorized access to certain information.”

![T-Mobile data breach press release](https://images.ctfassets.net/23aumh6u8s0i/3di8OI1TiR8WKlOTKzEIX3/560aff9c400227387f70fbc291cfad36/tmobile-breach-release)

Being as specific and transparent as possible (as quickly as possible) will help your customers trust that you are handling the situation and keeping them safe.

## Recent Data Breaches by the Numbers

It seems like every week there is a new catastrophe for personal data in the headlines. [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), Saks, Ticketfly, Panera, Lord & Taylor — these are just a handful of the major incidents so far in 2018.

The first half of 2018 saw nearly 700 breaches, on pace to equal 2017's staggering 1,579 breaches.

![T-Mobile Data breach chart](https://images.ctfassets.net/23aumh6u8s0i/2zNkiAn1hkY4MHzNlS1usB/28808e7918247c784def7780f80ae734/data-breach-chart)

The total number of exposed records from these incidents in the past five years tops 580 million.

<include src="TweetQuote" quoteText="The first half of 2018 saw nearly 700 data breaches, on pace to equal 2017's staggering 1,579 breaches."/>

In addition to data breaches, data exposures — when data is improperly defended and open for access on the internet — are on the rise. Instead of a malevolent hacker getting through a protected system, a data exposure occurs if a database isn't correctly configured or doesn't require appropriate authentication. In 2018, Exactis, for example, exposed [340 million records](https://www.wired.com/story/exactis-database-leak-340-million-records/), putting 2 terabytes of personal information at risk.

You don't have to be as large as T-Mobile to take powerful steps to secure your company. [Small businesses](https://www.godaddy.com/garage/online-security-advice-small-business/), for example, can still implement multi-factor authentication and improve their password practices. Taking steps to secure your customer data — whatever your size — will help you avoid becoming an easy target for hackers.

## Bolster Your Security in Order to Scale

Data breaches and exposures can quickly erode customer and investor trust — particularly at critical times in a business's lifecycle. For example, T-Mobile is currently in [a $26 billion merger agreement](https://www.zdnet.com/article/t-mobile-and-sprint-to-merge-finally-strutting-5g-clout/) with Sprint. The deal, which has already been subject to regulatory scrutiny, could face even more hurdles if parties see T-Mobile's lack of updated security practices as a liability.

On the flip side, if you strengthen your defenses and clearly communicate your progress, you have a better chance of emerging from any issues with your reputation intact.

Make sure you are on top of the latest security practices and protocol to avoid worst-case scenarios that could obstruct progress.

3 Critical Lessons from the T-Mobile Data Breach

Outsourcing cloud-based Identity as a Service (IDaaS) and Identity and Access Management (IAM) solutions are increasing in popularity amongst a variety of SaaS startups.

Chances are, if you're a B2B SaaS company (whether you're a large, established firm like Microsoft or an up-and-comer like Slack) — you're focused on being up to speed on the latest security tools. 

For teams of all sizes, however, it can be a challenge to keep up in a rapidly evolving threat environment. How do you ensure that your team has a safe foundation on which to scale?

Building your security practices around the starting point of understanding and managing all of your users can help ensure that you always have a handle on who is working within your system and with confidential information. When crafted well, a robust identity and access management (IAM) system for your users can be a springboard for moving forward.

<include src="TweetQuote" quoteText="When crafted well, a robust identity and access management (IAM) system for your users can be a springboard for moving forward."/>

## What Is Identity and Access Management (IAM)?

According to [Gartner](http://www.gartner.com/it-glossary/identity-and-access-management-iam/), "Identity and access management (IAM) is the security discipline that enables the right individuals to access the right resources at the right times for the right reasons." As teams become more dispersed and users are logging in across multiple time zones and various devices, IAM practices have emerged to organize and control appropriate access.

Historically, when teams were largely on site, enterprises simply used their own IAM software. Nowadays, as companies add more [cloud services](https://auth0.com/blog/moving-your-app-to-cloud/), managing access is becoming increasingly complex. For IT teams that are already swamped with maintenance tasks, outsourcing cloud-based Identity as a Service (IDaaS) and cloud IAM solutions is becoming more popular.

### Identity Management: To Build or To Buy?

While you might have the in-house capacity to build your own identity and access management system, most teams don't. Even if you do, going with a DIY solution is often [less cost-effective](https://auth0.com/learn/build-or-buy-20-identity-management-questions/).

In today's environment, an effective IAM solution should

* provide a clear and centralized view of all users at a given time;
* give an admin quick controls to communicate with, manage the access of, and even block users;
* be powerful yet still flexible to grow with your company; and
* help you comply with the latest security regulations.

Asking yourself the following questions will help you determine whether it's time to outsource your IAM:

* Have you thought about how you’ll [implement user management](https://auth0.com/docs/api/v2) (e.g., self-service or admin managed? 
* How will the user experience your solution?
* What [analytics](https://auth0.com/learn/powering-user-analytics-identity/) will you need for account creation and authentication events? 
* How will you use your system to stay on top of potential security vulnerabilities? 
* How will you [flag and mitigate anomalies](https://auth0.com/learn/anomaly-detection/) in user management and authentication events?
* How will you onboard new [B2B customers wanting SSO](https://auth0.com/learn/the-b2b-customer-value-journey/) for your product or service? 

For an even more comprehensive checklist, see Auth0's [guide](https://auth0.com/learn/build-or-buy-20-identity-management-questions/).

## Use Auth0 Lock for Simple, Secure Access

An example of a highly successful tool that has worked for a range of growing software companies, more established enterprise-scale companies, and even nonprofits is the [Auth0 Lock](https://auth0.com/blog/auth0-lock-is-here-for-b2b-and-b2c/). Auth0 Lock connects the login boxes of all users (i.e., both employees and customers) via a single, embeddable widget.

![Use Auth0 Lock for Simple, Secure Access](https://images.ctfassets.net/23aumh6u8s0i/7ovBZp8aNbgYrOgYCj2tIR/1dd6bb67c3b7c6807dd0f5375079537e/auth0-lock-connections)

Instead of having multiple login boxes for each category of users, which can add a layer of complexity to the admin process, entrance with Auth0 Lock is streamlined for all. Given distinct usernames and passwords, IT admins are easily able to differentiate between users as soon as they've logged in — and can view all activity at one time, from a central hub. Separate login credentials will usher users to different sites that suit their work needs. For example, if you're in [hiring mode](https://wizehire.com/), prospects can log in to fill out applications as easily as your [finance team](https://www.teampay.co/blog/finance-goals/) can update their records.

Once Auth0 Lock is implemented, your company can add features like [social login](https://auth0.com/learn/social-login/) and [single sign-on](https://auth0.com/single-sign-on) (SS0) to further secure and enhance the UX of authentication. It's simple to [customize](https://auth0.com/docs/libraries/lock/v9/ui-customization) Lock based on your company's needs and how you want the experience to be for your users. 

### The Power of Auth0 Connections

Auth0 sits between your app and the Identity Provider (like Twitter and Facebook, or enterprise providers like Active Directory and LDAP) that authenticates your users. Auth0 Lock is just [one tool of many](https://auth0.com/b2b-saas) that will help secure this connection. 

Auth0 supports over 30 social providers, 11 enterprise providers, and three legal identities. It adds a level of abstraction to your app to help isolate it from disruptive updates or idiosyncrasies of each provider's implementation. For example, as Facebook rolls out [new privacy standards](https://auth0.com/blog/cambridge-analytica-and-facebook/), any technical updates on their end that could change the login process for your users will be internalized and streamlined.

## If You're Still Unsure About Outsourcing Your Identity Management Needs, Consider Compliance

More than simply creating a safer and easier UX, Auth0 can help B2B SaaS teams comply with increasingly stringent [security regulations](https://auth0.com/security). A specialized provider like Auth0 can become a one-stop shop for adhering to GDPR and similar laws.

<include src="TweetQuote" quoteText="More than simply creating a safer and easier UX, Auth0 can help B2B SaaS teams comply with increasingly stringent security regulations."/>

Auth0 tools incorporate

* encryption;
* password protection; and
* five levels of password complexity.

In addition, Auth0 consolidates all of your user data into a single dashboard view, making it simpler to communicate processes to stakeholders — a core tenant of GDPR. 

Auth0 is a team of experts, focused on the specific task of authentication and user management 24/7. The company is up to date on all of the latest security developments and rapid changes in the industry. We monitor for new threats and adapt our tools accordingly for B2B SaaS companies at all stages of growth.

How B2B SaaS Teams Can Stay Up To Date With Identity Management

Insurers know that digital transformation is coming. To stand out from your peers, adopt identity and access management for a secure experience that customers can trust.

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---


Insurers know that implementing digital changes have the potential to benefit them long term. A recent [McKinsey study](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/making-digital-strategy-a-reality-in-insurance) found that insurers that digitized their processes eliminated 30 to 50 percent of the human service costs. The top quartile of those surveyed achieved 2X the growth of their peers.

<include src="TweetQuote" quoteText="Insurers know that digital transformation is coming. To stand out from your peers, create a secure experience that customers enjoy and trust."/>

But specific obstacles in the industry have stalled progress. First, the majority of insurers don't have the in-house technical expertise and equipment to make sweeping changes without support. In addition, many are concerned, particularly in an era of [increased scrutiny around customer data](https://auth0.com/blog/cambridge-analytica-and-facebook/), that a system overhaul could threaten measures they've already taken to protect sensitive information.

Despite these real challenges, customers increasingly expect cutting-edge solutions. Other industries, like [healthcare](https://auth0.com/healthcare/) and [financial services](https://auth0.com/financial-services), are quickly incorporating digital methods, raising the bar for everyone. Eventually, insurers will be forced to change. Early adopters will gain an edge, and those who are slow to transform will lose.

While it's possible to begin a digital transformation in many ways — from creating a new claims platform to simply delivering online quotes — starting with an identity and access management (IAM) strategy is a clear, easy-to-implement step that allows managers to attack several core functions at once.

## Legacy Systems in a Changing Environment

In industries such as [retail](https://auth0.com/retail), many teams are able to rely on consumer data pulled from public sources like [social media profiles](https://auth0.com/learn/social-login/) to underpin their strategies. This might include compiling current and potential customer interests, events they've attended, and pages they've liked. In insurance, it's more complicated. Agents work with higher-touch information sets, like health records and credit scores.

![Legacy, old insurance systems example](https://images.ctfassets.net/23aumh6u8s0i/1T3qVEXkTfn8vpmFRHZyqX/35117cf6090d3668e1aacab3d062734a/legacy-systems-struggle-to-keep-up-with-digital-transformation)

[Source: Electronic Medical Records & Electronic Health Records Software](http://www.emr-ehrs.com/mental-health-electronic-health-records.php)

This data is the foundation for building customer risk profiles, determining premiums, and completing claims. Most teams have developed processes over decades that continue to work well. Although a lot of this data exists on legacy insurance softwares and systems and may not be intuitive for new hires to find and work with, more-seasoned agents understand the process and don't feel an urgent need to change.

With such fixed methods, it can be challenging to know why and how to begin to make updates. Tweaking any aspect of an established insurance company's model, even something as simple as market research or reaching out to new prospects, could skew the whole.

Yet if teams don't start somewhere, they risk becoming irrelevant in markets that are quickly evolving. Home insurers, for example, are facing variables such as interconnected home security and heating systems, like the Google Nest; auto insurers are having to factor in autonomous vehicles and the changes that ride-sharing programs like Uber and Lyft bring; even health insurers are seeing stiff competition from newcomers, like Oscar, that have a strong focus on UX and more-affordable plans.

Just because many insurance teams have succeeded with business-as-usual for decades, it doesn't mean they don't need to revamp for the future.

## Organize Your Users for Greater Security and Efficiency

For insurance teams facing a daunting set of changes, developing a clear [identity and access management - IAM](https://auth0.com/app-modernization) modernization strategy of legacy softwares is a concrete first step. IAM is a simple, initial fix that can form the basis for more updates down the line. It is a single solution for organizing and tracking customers, employees, and even business partners who are working with critical data in your system.

IAM often begins with a portal that collects, organizes, and protects customer data at the login stage. This starts with a simple welcome screen on the front end:

![Customer acquisition starts with a secured, basic identity management](https://images.ctfassets.net/23aumh6u8s0i/6skPK5VXzplAOaOIG2mXAW/d4cc7731371771ffcd5576d3fcf99044/transforming-customer-acquisition-starts-with-a-basic-identity-management-strategy)

Behind this screen, the technology tracks customer logins and platform behavior and enriches their profiles with personal details and historical records. This can be information that the insurer manually uploads or automatically pulls from public sources. Some features also include additional options, such as [progressive profiling](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/), to help build customer data over time (e.g., location, age, and gender).

For administrators, certain features allow for a bird's-eye view of all users in a given system, noting growth in users over time, ratio of new to returning users, who is accessing what levels of information at any time– even what device(s) they're using:

![Customer data visualization in Auth0 reports allows for better reporting and analytics](https://images.ctfassets.net/23aumh6u8s0i/5iw0moRjxmuV8bvOeZ9t16/e39d7192b9ca429b294a43df722dd491/organizing-customer-data-in-a-single-location-allows-for-better-reporting-and-analytics)

Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights on customer histories and current behavior. This approach will make your company more efficient at building risk profiles, communicating with customers in a more personalized way (particularly if and when they are in distress and need to make a claim), and understanding your target audience at a granular level.

<include src="TweetQuote" quoteText="Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights."/>

## Outsourcing IAM to the Experts

While you can try to update your IAM system on your own, most insurers don't have the in-house capacity to do so — at least not at the level needed to meet future needs. This would require building a portal that is a one-stop solution for all users — yet is still flexible enough evolve alongside your business. The advantage of outsourcing IAM is having a dedicated team of experts whose entire job, 24/7, is to build and deliver these solutions — as opposed to adding it to a pile of tasks your IT team is currently balancing.

A provider like Auth0 makes sure all of its [features adhere to the highest industry standards](https://auth0.com/security), including LDAP, SAML, OAuth, OpenID, OpenID Connect, and JSON Web Tokens (JWTs). In addition, it is GDPR, EU-US Privacy Shield, and HIPAA compliant.

![Auth0 compliance and certifications](https://images.ctfassets.net/23aumh6u8s0i/35nsnoblygw4XlOUwuocQ6/c02f2b95ba00c2410da392fe049e68c4/auth0-adheres-to-the-highest-industry-standards)

[Source](https://auth0.com/security">Auth0 Security)

This eliminates the need for your team to do additional research to ensure any changes are up to code in your geographic area or industry.

Top-notch identity and access management providers like Auth0 will offer even more tools, like 2FA options, to help ease the customer experience. These features can provide a clear measure of safety that customers will immediately appreciate. Each step along the way allows your team to move further away from lagging competitors by gaining user trust, invigorating your brand, and creating more-efficient internal processes.

## Be an Early Adopter

If you're an insurer, now is the time to make bold changes to your current strategy. The early digital adopters in the industry will gain sharper insights and win and retain more customers.

No teams will be able to hide from change. With new products constantly coming to market, the industries in which insurance teams operate are themselves being revolutionized. Taking the first step to develop and implement a tight IAM system will open the door for full digital change.

<include src="asides/AboutAuth0" />

"teams"