leonardo

Leonardo is a Senior Software Architect at Okta, working on the new Auth0 platform and cutting-edge product features. He is a seasoned technical leader with 17 years of experience in a wide range of segments, from enterprise to SaaS systems. As an Apache committer, he has contributed to various open-source projects. He is a self-learner, passionate about new technology, and has spoken at several developer events.

Senior Software Architect

Leonardo Zanivan

Guidelines and security best practices to protect from third-party threats

Secure Node.js Applications from Supply Chain Attacks

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

How to deal with the most common security threats in web development.

The focus on security has never been more important than in the current times. In the IT world, it gains more relevance every day. But ensuring security is not just about system administrators. It must also be a developer's skill, especially if they are web developers.

Auth0 brings you [a free ebook about security and web development](https://auth0.com/resources/ebooks/security-for-web-developers). Learn more about it and why you should care about web development security.

## The Web as a Development Platform

Today's Web is not the Web of the early '90s when it was invented. Originally, it was created primarily as a content management system, that is, a platform for sharing and linking static documents. The HTTP protocol and HTML language were sufficient to achieve these basic goals, and security concerns were mostly limited to controlling access to confidential documents.

The demand for interactivity led to the introduction of JavaScript and dynamic page generation technologies, both on the client and on the server sides. That has completely changed the primary use of the Web. It has evolved from a simple way to share and link documents to the backbone of the software and human connection. **The old content management system platform has switched to become a development platform**.

This paradigm change has brought benefits but also pitfalls. And it also brought a slew of new challenges, the most pressing of which is security.

## Web Applications and Security

Web application security refers to the measures taken to protect a website or web application from external attacks that could result in data loss, denial of service, or privacy violation, among other things.
When you deploy a web application, it can be accessed by anyone. You can't make any assumptions about who will access it: authorized or unauthorized users, humans, or bots. By default, **you should assume that your application is exposed to any security risk**. But what are security risks?

Three key concepts should be clear to you when analyzing your application security:

- **Threats** are incidents that can potentially harm your application. Think of them as external processes that your application must defend against.
- **Vulnerabilities** are weaknesses in your application that attackers can exploit. They can depend on design flaws or bugs, not just in your code, but also in its dependencies. Deficiencies can also exist at the infrastructure level, such as insecure protocols or network issues.
- **Risks** are the potential damage your application can suffer when a threat exploits a vulnerability. You can think of risks as the intersection of threats and vulnerabilities.

Understanding these concepts is fundamental for protecting your applications against attackers.

<include src="BigQuote" quoteText="Know your enemy and know yourself, find naught in fear for 100 battles. Know yourself but not your enemy, find level of loss and victory. Know not thy enemy nor yourself, wallow in defeat every time" quoteAuthor="Sun Tzu" />

**Consider threats as your enemy’s weapons and vulnerabilities as your weakness**. You need to know both to face the battle and make decisions with a calculated risk. In other words, learning how security attacks work is the first pass to avoiding them.

## Common Web Application Threats

It is not possible to make a complete list of potential threats to which a web application is exposed. The constantly-shifting state of web security means that there are too many variables at play. However, there are well-known threats that you should be aware of.
The [Open Web Application Security Project](https://owasp.org/) (OWASP), the online community devoted to spreading knowledge and awareness about web security, tracks the most common security risks for web applications in its [OWASP Top Ten](https://owasp.org/www-project-top-ten/). This document intends to create security awareness in the developer audience by detailing the ten most critical security risks. It represents an excellent first step towards creating a security culture in the developers’ community. Hopefully, this first step may push developers for the adoption of a [security by design](https://en.wikipedia.org/wiki/Secure_by_design) mindset, i.e., an **approach that makes you think of security at each step of your application development**.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## Security for Web Developers

In this path toward security awareness, Auth0 wants to contribute with a free ebook dedicated to security for web development: "[Security for Web Developers](https://auth0.com/resources/ebooks/security-for-web-developers)".

As we said, to protect your web applications from security risks, **you need to know how threats work to understand your application's vulnerabilities**. Each chapter of this book is dedicated to one threat and provides you with working examples of vulnerable applications. Using these examples, you’ll learn the “behind the scenes” details of each threat and how to remediate the application’s vulnerability.

For example, you will learn how *Cross-Site Scripting* (XSS), *Cross-Site Request Forgery* (CSRF), and *Clickjacking* attacks work in practice and how you can prevent them. But it's not all about reading. You can also download and get your hands on the code explained in the book. So, what are you waiting for? [Download your free copy](https://auth0.com/resources/ebooks/security-for-web-developers) and leave your feedback in the comments!

<include src="ebook-ads/WebSecurity" />

Security and Web Development

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Inaugural report reveals insidious trends and provides mitigation strategies for security professionals.

**BELLEVUE, Wash. – June 16, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of its inaugural security report: [The State of Secure Identity](https://auth0.com/resources/whitepapers/state-of-security-identity-report). This detailed report highlights key areas of concern for security professionals responsible for managing digital identities, including the exponential rise of credential stuffing attacks (automated attempts to compromise a large number of user accounts with stolen credentials), fraudulent registrations, and the widespread use of breached credentials. 

Recent headlines and high-profile cyber attacks give today’s security professionals a wide swath of serious threats to worry about. The primary goal of cybercriminal activity is to access critical resources, systems, and personal data, yet systems that can be put into place to minimize the risk of attack — like identity management — often get deprioritized. Lack of budget, resourcing, or attention on managing digital identities give threat actors a prime opportunity to take advantage of these discrepancies and surreptitiously execute their attacks. 

Research into Auth0’s global customers over the past year found these key facts and figures: 

* In the first 90 days of 2021, credential stuffing accounted for 16.5% of attempted login traffic on its platform, with a peak of over 40% near the end of March — all of which Auth0 detected and prevented. 
* Travel & leisure and retail are the top two industries most affected by credential stuffing attacks. 
* The number of fraudulent registrations vary by industry vertical, but roughly 15% of all attempts to register a new account can be attributed to bots.
* In the first 90 days of 2021, the Auth0 platform detected breached passwords at an average of more than 26,600 per day, with a minimum of just under 7,300 and a high on Feb. 9, 2021, exceeding 182,000.

“Securing customers’ identities is made more difficult by industry-wide failures to protect data. The prevalence of breached passwords and the availability of automated attack tools makes the humble password a protective measure from the past,” said Duncan Godfrey, VP of Security Engineering, Auth0. “The State of Secure Identity Report is designed to share our unique identity security insights and recommendations with the industry so that application builders and developers at any organization can take the steps they need to improve their overall security posture and make things more secure for end users.” 

The most prevalent threats detailed in the report include Credential Stuffing (the most common threat observed by Auth0); Fraudulent Registrations; Multi-factor Authentication Bypass; Breached Password Usage; and other common identity attacks. The complete Auth0 State of Secure Identity Report, which includes additional key findings and recommendations on how organizations can improve their identity security posture, can be downloaded **[here](https://auth0.com/resources/whitepapers/state-of-security-identity-report)**. Auth0 will also be hosting an online meetup to examine these insights in greater detail on **[Thursday, June 24 at 8:00 AM PDT](https://auth0.com/resources/upcoming-webinars/state-of-security-identity-report-session-one)**. 

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit the [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Releases State of Secure Identity Report, Highlighting the Most Pervasive Threats to Digital Identities

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Learn how to address the risks that today’s top mobile security threats pose to your organization.

Mobile initiatives are a top priority for many organizations these days because research shows that increases in mobility help enterprises [improve operations](https://cdn2.hubspot.net/hubfs/1789978/Content%20Offers/enterprise-mobility-trends-report-2020.pdf) and [productivity](https://insights.samsung.com/2016/08/03/employees-say-smartphones-boost-productivity-by-34-percent-frost-sullivan-research/).

However, increases in organizational mobility typically result in an increase in the number of mobile devices that are accessing your systems from a remote location. And for your security teams, this means a growing variety of endpoints and threats they need to secure in order to protect your organization from a data breach.

As in the past, the most common threats to mobile security include mobile malware. However, as Verizon’s [2020 Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf) shows, there are new threats organizations need to consider as well in order to ensure they’re protected.

Below are the most common and critical mobile security threats that organizations face in 2021.

## 4 Different Types of Mobile Security Threats

Mobile security threats are commonly thought of as a single, all-encompassing threat. But the truth is, there are four different types of mobile security threats that organizations need to take steps to protect themselves from:

* **Mobile Application Security Threats.** Application-based threats happen when people download apps that look legitimate but actually skim data from their device. Examples are spyware and malware that steal personal and business information without people realizing it’s happening.
* **Web-Based Mobile Security Threats.** Web-based threats are subtle and tend to go unnoticed. They happen when people visit affected sites that seem fine on the front-end but, in reality, automatically download malicious content onto devices.
* **Mobile Network Security Threats.** Network-based threats are especially common and risky because cybercriminals can steal unencrypted data while people use public WiFi networks.
* **Mobile Device Security Threats.** Physical threats to mobile devices most commonly refer to the loss or theft of a device. Because hackers have direct access to the hardware where private data is stored, this threat is especially dangerous to enterprises.

Below are the most common examples of these threats, as well as steps organizations can take to protect themselves from them.

## 1. Social Engineering

Social engineering attacks are when bad actors send fake emails (phishing attacks) or text messages (smishing attacks) to your employees in an effort to trick them into handing over private information like their passwords or downloading malware onto their devices.

Reports by cybersecurity firm [Lookout](https://www.lookout.com/phishing-spotlight-report-lp) and [Verizon](https://enterprise.verizon.com/resources/reports/dbir/2020/results-and-analysis/) show a 37% increase in enterprise mobile phishing attacks and that phishing attacks were the top cause of data breaches globally in 2020.

![Social Engineering](https://images.ctfassets.net/23aumh6u8s0i/1wPMqUJN6nHgmQTVo4poQz/8b4fea1cb9600bcb1bc5b93f8881d49b/image1.jpg)
<a href="https://www.cybersecurityintelligence.com/blog/it-governance-cyber-security-phishing-awareness-course-180.html">Source</a>


### Phishing Attack Countermeasures
The best defense for phishing and other social engineering attacks is to teach employees how to spot phishing emails and SMS messages that look suspicious and avoid falling prey to them altogether. Reducing the number of people who have access to sensitive data or systems can also help protect your organization against social engineering attacks because it reduces the number of access points attackers have to gain access to critical systems or information.

## 2. Data Leakage via Malicious Apps

As Dave Jevans, CEO and CTO of Marble Security, [explains](https://www.esecurityplanet.com/mobile-security/10-trickiest-mobile-security-threats.html), “Enterprises face a far greater threat from the millions of generally available apps on their employees’ devices than from mobile malware.”

That’s because 85% of mobile apps today are largely unsecured. Tom Tovar, CEO of Appdome, [says](https://technologyadvice.com/blog/information-technology/cybersecurity-trends-2020-byod-mobile/), “Today, hackers can easily find an unprotected mobile app and use that unprotected app to design larger attacks or steal data, digital wallets, backend details, and other juicy bits directly from the app.”

For example, when your employees visit Google Play or the App Store to download apps that look innocent enough, the apps ask for a list of permissions before people are allowed to download them. These permissions generally require some kind of access to files or folders on the mobile device, and most people just glance at the list of permissions and agree without reviewing them in great detail.

However, this lack of scrutiny can leave devices and enterprises vulnerable. Even if the app works the way it’s supposed to, it still has the potential to mine corporate data and send it to a third party, like a competitor, and expose sensitive product or business information.

### How to Protect Against Data Leakage

The best way to protect your organization against data leakage through malicious or unsecured applications is by using mobile application management (MAM) tools. These tools allow IT admins to manage corporate apps (wipe or control access permissions) on their employees’ devices without disrupting employees’ personal apps or data.

## 3. Unsecured Public WiFi

Public WiFi networks are generally [less secure](https://www.wired.com/story/public-wifi-safety-tips/) than private networks because there’s no way to know who set the network up, how (or if) it’s secured with encryption, or who is currently accessing it or monitoring it. And as more companies offer remote work options, the public WiFi networks your employees use to access your servers (e.g., from coffee shops or cafes) could present a risk to your organization.

For example, cybercriminals often set up WiFi networks that look authentic but are actually a front to capture data that passes through their system (a “man in the middle” attack). Here's what that looks like:

![Unsecured Public WiFi](https://images.ctfassets.net/23aumh6u8s0i/3Zdz3P9nnZTNTMNPi2UMPZ/af3eb9262d8440b0fc875da00b0e1eaf/image2.png)
<a href="https://www.consumer.ftc.gov/blog/2014/03/how-secure-mobile-app"> Source </a>

If this seems far-fetched, it isn’t. Creating fake WiFi hotspots in public spaces with network names that look completely legit is incredibly simple, and people are very willing to connect, as shown by [experiments](https://hbr.org/2017/05/why-you-really-need-to-stop-using-public-wi-fi) run at the Democratic and Republican conventions in 2016 and by [an experiment](https://hackernoon.com/a-hacker-intercepted-your-wifi-traffic-stole-your-contacts-passwords-financial-data-heres-how-4fc0df9ff152) run by a researcher in 2019 from [Magic](https://magic.co/).

### How to Reduce Risks Posed By Unsecured Public WiFi

The best way for you to protect your organization against threats over public WiFi networks is by requiring employees to use a VPN to access company systems or files. This will ensure that their session stays private and secure, even if they use a public network to access your systems.

## 4. End-to-End Encryption Gaps

An encryption gap is like a water pipe with a hole in it. While the point where the water enters (your users’ mobile devices) and the point where the water exits the pipe (your systems) might be secure, the hole in the middle lets bad actors access the water flow in between.

![End-to-End Encryption Gaps](https://images.ctfassets.net/23aumh6u8s0i/75ICJ2SUKqSGKvX7OQoXxF/423b5c480a4c09939e62d411ba716b1b/image3.png)
<a href="https://heimdalsecurity.com/blog/the-best-encrypted-messaging-apps/"> Source </a>

Unencrypted public WiFi networks are one of the most common examples of an encryption gap (and it’s why they’re a huge risk to organizations). Since the network isn’t secured, it leaves an opening in the connection for cybercriminals to access the information your employees are sharing between their devices and your systems.

However, WiFi networks aren’t the only thing that poses a threat—any application or service that’s unencrypted could potentially provide cybercriminals with access to sensitive company information. For example, any unencrypted mobile messaging apps your employees use to discuss work information could present an access point for a bad actor.

### Solution: Ensure Everything is Encrypted

For any sensitive work information, end-to-end encryption is a must. This includes ensuring any service providers you work with encrypt their services to prevent unauthorized access, as well as ensuring your users’ devices and your systems are encrypted as well.

## 5. Internet of Things (IoT) Devices

The types of mobile devices that access your organization’s systems are branching out from mobile phones and tablets to include wearable tech (like the Apple Watch) and physical devices (like Google Home or Alexa). And since many of the latest IoT mobile devices have IP addresses, it means bad actors can use them to gain access to your organizations’ network over the internet if those devices are connected to your systems.

> Statistically, there are probably more IoT devices connected to your networks than you realize. For example, 78% of IT leaders from four different countries reported in [a study by Infoblox](https://www.infoblox.com/company/news-events/press-releases/shadow-iot-devices-a-major-concern-for-corporate-networks-infoblox-research-finds/) that over 1,000 shadow IoT devices accessed their networks each day.

### How to Combat Shadow IoT Threats

Mobile device management (MDM) tools can help you combat shadow IoT threats, as well as identity and access management (IAM) tools like Auth0. However, IoT/Machine-to-Machine (M2M) security [is still in a bit of a “wild west” phase](https://www.crn.com/news/internet-of-things/as-5g-nears-iot-connectivity-remains-a-wild-west-) at the moment. So it’s up to each organization to put the appropriate technical and policy regulations in place to ensure their systems are secure.

## 6. Spyware

Spyware is used to survey or collect data and is most commonly installed on a mobile device when users click on a malicious advertisement (“malvertisement”) or through scams that trick users into downloading it unintentionally.

Whether your employees have an iOS or Android device, their devices are targets ripe for data mining with spyware—which could include your private corporate data if that device is connected to your systems.

### How to Protect Against Spyware

Dedicated mobile security apps (like Google’s [Play Protect](https://developers.google.com/android/play-protect)) can help your employees detect and eliminate spyware that might be installed on their devices and be used to access company data. Ensuring your employees keep their device operating systems (and applications) up to date also helps ensure that their devices and your data are protected against the latest spyware threats.

## 7. Poor Password Habits

A [2020 study](https://www.balbix.com/resources/state-of-password-use-report-2020/) by Balbix found that 99% of the people surveyed reused their passwords between work accounts or between work and personal accounts. Unfortunately, the passwords that employees are reusing are often weak as well.

For example, a 2019 study by Google found that 59% of the people they surveyed used a name or a birthday in their password, and 24% admitted to using a password like one of these below:

![Poor Password Habits](https://images.ctfassets.net/23aumh6u8s0i/3f3dzG9WlC6gNqYnCyB9V3/00d5e8990be0124d4b140764ff769ec1/image4.jpg)
<a href="http://www.netimperative.com/2016/01/worst-25-passwords-prove-were-all-idiots/"> Source </a>

These bad password habits present a threat to organizations whose employees use their personal devices to access company systems. Since both personal and work accounts are accessible from the same device with the same password, it simplifies the work a bad actor has to do in order to breach your systems.

However, these behaviors also provide opportunities for credential-based brute force cyberattacks like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) or password spraying because cybercriminals can use weak or stolen credentials to access sensitive data through company mobile apps.

### How to Reduce or Eliminate Mobile Password Threats

The [NIST Password Guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) are widely regarded as the international standard for password best practices. Following these guidelines—and insisting your employees do the same—will help protect you against threats from weak or stolen passwords. Password managers can simplify the work required for your employees to follow these guidelines.

Requiring your employees to use more than one authentication factor (multi-factor authentication or MFA) to access mobile company applications will also help reduce the risk that a bad actor could gain access to your systems since they’d need to verify their identity with additional authentication factors in order to log in.

Finally, implementing [passwordless authentication](https://auth0.com/passwordless/) will help you eliminate password risks altogether. For example, in the event that a mobile device is stolen or accessed illegally, requiring a facial scan as a primary (or secondary) authentication factor could still prevent unauthorized access.

## 8. Lost or Stolen Mobile Devices

Lost and stolen devices aren’t a new threat for organizations. But with more people [working remotely](https://www.businesswire.com/news/home/20201215005287/en/Upwork-Study-Finds-22-of-American-Workforce-Will-Be-Remote-by-2025) in public places like cafes or coffee shops and accessing your systems with a wider range of devices, lost and stolen devices pose a growing risk to your organization.

### How to Protect Against Lost or Stolen Device Threats

First and foremost, you’ll want to ensure employees know what steps to take if they lose their device. Since most devices come with remote access to delete or transfer information, that should include asking employees to make sure those services are activated.

![How to Protect Against Lost or Stolen Device Threats](https://images.ctfassets.net/23aumh6u8s0i/44UaWTSZk2OlrI587JXGw1/1276e73d18bae71b074472dfb1ebd2db/image5.jpg)
<a href="http://www.idownloadblog.com/2014/08/08/how-to-activate-lost-mode-iphone-ipad/"> Source </a>

[Mobile device management](https://auth0.com/blog/what-is-enterprise-mobile-management/) (MDM) tools can also help you secure, encrypt, or wipe sensitive company information from a device that’s lost or stolen, so long as those tools were installed before the device went missing.

## 9. Out of Date Operating Systems

Like other [data security](https://auth0.com/blog/what-is-data-security/) initiatives, mobile security requires continuous work to find and patch vulnerabilities that bad actors use to gain unauthorized access to your systems and data.

> Companies like Apple and Google address a lot of these vulnerabilities with operating system updates. For example, in 2016, Apple realized it had three [zero-day vulnerabilities](https://us.norton.com/internetsecurity-emerging-threats-how-do-zero-day-vulnerabilities-work-30sectech.html) that left its devices open for spyware attacks and released a patch to protect users against these vulnerabilities.


However, these patches only protect your organization if your employees keep their devices up to date at all times. And according to Verizon’s [Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf), operating system updates on 79% of the mobile devices used by enterprises are left in the hands of employees.

### How To Keep Mobile Operating Systems Up To Date

Google and Apple both allow organizations to push updates to managed Android and iOS devices. Third-party MDM tools (for example,[ Jamf](https://www.jamf.com/)) often provide this functionality as well.

## IAM Tools Can Help Secure Company Mobile Applications

Identity and Access Management (IAM) tools can help organizations secure the apps and data that users access from their mobile devices, including:

* **Restricting which devices and users can access enterprise applications and data,** as well as which parts of those applications they’re allowed to access.
* **Tracking user behavior** and securing access in the event that something looks suspicious with security features like [multi-factor authentication](https://auth0.com/blog/multifactor-authentication-mfa/) (MFA),[brute force attack protection](https://auth0.com/docs/attack-protection), and more.

Auth0 simplifies the work required to implement secure authentication for mobile enterprise applications—learn more about Auth0’s IDaaS platform [here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The 9 Most Common Security Threats to Mobile Devices in 2021

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Securing your data against unauthorized access is more important than ever.

What Is Data Security? Top Threats and Best Practices

apollo (1)

Charlotte is an experienced security professional with a long history of successfully and securely leading global brands, including PwC, Hewlett-Packard, and Daimler Trucks North America. She is a Certified Secure Software Life Cycle Professional (CSSLP), Certified Information Systems Security Professional (CISSP), and Certified Ethical Hacker (C|EH), passionate about proactive and defensive security through early lifecycle improvements.

Former Director of Security Engineering

Charlotte Townsley

Focusing security efforts early in the SDLC provides proactive, impactful protection against evolving threats and attacks

## Shifting Left for Improving Security Outcomes

**TL;DR:** Shifting security to the left, or early in the Software Development Life Cycle (SDLC), creates more effective, less costly security controls, promotes developer ownership of security principles and features, and helps reduce risk to our organization.

## What does Shift-Left Mean?

Shift-left refers to a focus on security efforts early in the Software Development Life Cycle (SDLC). These early phases include early developer and technologist awareness efforts, as well as secure design, development, and deployment of software.

![SDLC](https://images.ctfassets.net/23aumh6u8s0i/7irltF8FB74O9aFLUP84Xa/9e0f7fe1f8ee1c5a16a6d03f343b8bda/image1)

Shift-left is a well-known term in the [software development and testing industry](https://dzone.com/articles/software-testing-trends-to-watch-for-in-2019). It refers to both security and non-security specific testing and evaluation of an application early in the development lifecycle. A shift-left mindset helped develop some notable non-security specific techniques such as [Test Driven Development (TDD)](https://www.guru99.com/test-driven-development.html) and [Agile methodologies](https://smartbear.com/learn/automated-testing/shifting-left-in-testing/). 

## What are the Benefits of Shift-Left?

The clear benefit to shift-left is that a focus on the early design and development phases translates to [fewer defects in the later stages](https://www.cigniti.com/blog/successfully-implementing-tdd-bdd-to-enable-shift-left-testing-approach/). Shift-left is well-recognized as an approach that [lowers the cost of defect remediation](https://www.bmc.com/blogs/what-is-shift-left-shift-left-testing-explained/). In fact, the cost of fixing code flaws [increases exponentially with each phase to the right in the SDLC that they are found and remediated](https://deepsource.io/blog/exponential-cost-of-fixing-bugs/). The 2019 Poneman study estimated that vulnerabilities detected in the early [development process cost around ~$80 to remediate. However, the same vulnerabilities can cost ~$7600 to remediate](https://resources.whitesourcesoftware.com/blog-whitesource/shift-left-testing) if detected after deployment to production. This is a _9400% increase in cost_!

It is worth noting that the term shift-left can be a misnomer, as it denotes a linear phased approach, rather than a continuous approach. In actuality, software is developed in an infinite cycle of continuous design, development, remediation, integration, delivery, and monitoring.

![Continuous Development Life Cycle](https://images.ctfassets.net/23aumh6u8s0i/3R7h35zCpEV3jm0snCemXc/b774324a5e660ff997faecf2e241f82f/image2)
Continuous Development Life Cycle

Because each phase in the infinite cycle is discrete and identifiable, the term shift-left is still helpful in understanding the efforts in moving security earlier in the life cycle. As a mindset, shift-left is both a way to train developers, and a way to design, develop, and deploy code more securely and with less cost. So while we refer to shift-left to identify our efforts, we are not promoting the abandonment of a continuous development and deployment cycle.

## What is Auth0 Doing to Shift-Left in Security?

The focus on defensive and preventive controls early in the SDLC encompasses several key initiatives at Auth0. These initiatives include the improvement of **Static Analysis Security Testing (SAST)**, the creation and publication of the **Secure Software Benchmarks (SSB)**, and the development of **Security Champions**.

The security team is improving **Static Analysis Security Tests (SAST)** for all new and existing code bases at Auth0. SAST tools automate security-specific code reviews and help identify and remediate security-relevant coding flaws that directly translate to exploitable flaws in production. Finding these flaws early adds great value to the organization in terms of risk reduction. 

SAST improvements include better traceability of flaws to [OWASP Top 10](https://owasp.org/www-project-top-ten/) and [CWE Top 25](https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html), and improvements in the ease of integration with existing development IDEs, source repositories, and build tools.

These SAST tools support both manual deployment pipelines, and automated pipelines where controls can be integrated into a model known as [DevSecOps](https://www.sumologic.com/insight/devsecops-rugged-devops/). DevSecOps helps incorporate security into all stages of the software development workflow and thus helps to avoid security bottlenecks since [security checks are run continuously along with the phases of the SDLC](https://insight.claranet.co.uk/driven/the-devsecops-mindset) rather than only at the end of the life cycle.

![DevSecOps](https://images.ctfassets.net/23aumh6u8s0i/7l22UtdExJhSxYf40OhyBJ/47553bad506159065c5482c4ac9c453d/image3)
DevSecOps

The **Secure Software Benchmarks (SSB)** comprehensively document the expectations and implementation details for creating secure applications at Auth0. The SSBs can be used as a baseline for teams to assess the security of applications. However, their greatest value will be as an early lifecycle guide to plan, develop, and deploy their applications according to security best practices. 

The SSBs are rich in both breadth and depth and are based on industry best practices, including the [OWASP Top 10 Proactive Controls](https://owasp.org/www-project-proactive-controls/). They include details such as secure coding techniques, SAST tools integration guidance, expectations around protecting data at rest, in-transit, and in-memory, how to securely create production builds, and how to hook into monitoring controls. The SSBs are meant to be an ongoing tool for assessment and creation of secure applications.

The security training and awareness team runs a mentorship program for Auth0 developers with interest in security. The purpose of the program is to help amplify and socialize the security messages within development teams and scale security operations. Security-minded developers serve as **Security Champions** and receive training and guidance in how to implement and interpret **SAST** results. 

Security Champions will also participate in briefings with the security team to help them understand and socialize the **SSBs**. Security champions have a defined path for advancement, including apprentice, intermediate, and advanced champion criteria that define the milestones and maturation of the champions at Auth0.

The security awareness team will combine **SAST**, **SSBs**, and the **Security Champions** program in an internal certification program for Node.js developers. This **Auth0 Node.js Secure Developer Certification** expands upon the current hands-on secure code training. The certification includes general security concept training, Node.js secure coding guidelines defined in the SSBs, threat modeling, best practices for implementing and interpreting SAST, risk assessments, offensive security, secure architecture, hands-on labs, and skills formal assessment. The security team will begin the roll-out of the certification with our Security Champions, receive feedback from these champions, then open the certification to our development community within Auth0.

We are also applying shift-left to expand our machine image scanning capabilities within our infrastructure and cloud security program. Rather than scanning images after deployment, scanning will take place at the time of image creation. Scanning at the time of image creation provides early feedback for service owners as they make decisions about installed packages and versions. The scanning services are accessible via API, and thus can be automated as part of the development life cycle and seamlessly integrated with vulnerability management tools and processes. 

## What about Late Life Cycle Efforts at Auth0?

There are several successful late life cycle efforts at Auth0 that we plan to continue and grow with a particular focus on automation. These offensive and detection efforts are crucial in finding security vulnerabilities, detecting and handling incidents, and helping teams assess the security of their applications as the threat landscape continuously changes. We will continue to offer our private bug bounty program, conduct offensive security tests, encourage contributions through our Responsible Disclosure program, and offer threat modeling for secure design. We encourage submission to our [Responsible Disclosure](https://auth0.com/responsible-disclosure-policy/) program and use this disclosure program as an entry point to our private bug bounty program.

The defensive and offensive programs do not exist in vacuums. Instead, offensive programs help to inform our defensive efforts in what the security industry terms a purple and orange team functions, where [_purple_ describes how defenders (such as our Detection and Response team) learn from attackers, and orange describes how builders (our developers) learn from attackers](https://danielmiessler.com/study/red-blue-purple-teams/).

Auth0 Security strives to continuously improve our security posture. By embracing shift-left, we create more effective, less costly security controls, promote developer ownership of security principles and features, and help reduce risk to our organization. This approach results in a more secure solution for our customers at a lower cost.

<include src="asides/AboutAuth0" />

Why Auth0 is 'Shifting-Left' on Security

Use penetration testing and 2FA and educate citizens and employees to better anticipate and avoid cyber threats.

On April 7, 2017, at a quarter to midnight, the city of Dallas was hacked.

The perpetrators accessed the City of Dallas's emergency management system and set off 156 blaring alarms—alarms intended to warn people in case of a tornado or hurricane.

It took over an hour and a half for city administrators to understand what had gone wrong and shut the sirens down.

Amid the ongoing digitization of our urban areas, the Dallas incident highlights one of the main dangers that a smart city—for all the good it can do—brings.

Without the right precautions, and without the right security, our smart cities can be just as vulnerable to hacking as our computers and mobile devices.

What happened in Dallas may have been the first high-profile incident of “city hacking,” but it certainly won't be the last.

## Why Security Is a Problem For Smart Cities

The rise of smart cities is intimately linked to the rise in production of Internet of Things (IoT) devices—as are its inherent security problems.

Your average IoT device is relatively cheaply produced. It's not built with the kind of security features you get on a Mac or Windows laptop or tablet or in a mobile phone. It is, however, connected to the internet.

These three factors have made IoT devices incredibly fertile cybercrime targets over the last decade or so.

In 2015, millions of children's names, genders, ages, photos, and parents' records (including home addresses) were compromised through a device known as the InnoTab—a kind of WiFi-enabled tablet for kids.

IoT devices are often trivially easy to access remotely because they're already connected to the internet and not built with cybersecurity in mind. Hackers don't even need to pull information from them. They can simply sit on the device and wait for it to gather information, or even requisition it for use in a distributed denial of service (DDoS) attack or botnet.

Cybersecurity researchers have found vulnerabilities in IoT devices in smart cities, too. Aside from the Dallas incident, significant issues have occurred in smart traffic signals and smart electricity meters. The number of attacks on infrastructure in the U.S. alone went from not even 200 in 2012 to 300 in 2015.

Today, advocates of smart cities are looking much more closely into the security of smart cities and how to build devices that can ensure our cities stay safe and protected—even as they get smarter. According to Gartner, 2.3 billion connected items were used in U.S cities throughout 2017. That number is only going to get bigger and bigger.

## Ensure Security For Critical Facilities

The most vulnerable locations in any smart city are the centers of utilities and power—power plants, water processing plants, and so on.

In Kiev in 2016, hackers shut down 20% of the city's power by hacking into an electrical substation.

Penetration testing is a common method that cities and municipalities use to test for vulnerabilities with their utilities. A security firm is hired to attempt to break in and gain access to the system. Afterward, they produce a report with their findings and give [recommendations for how to avoid the a real attack](https://www.redteamsecure.com/business-insider-rides-shotgun-as-redteam-security-hacks-the-power-grid/).

![Smart city - crime of person gaining access to a facility](https://images.ctfassets.net/23aumh6u8s0i/1n7pLxG3VH1QfPNkEFt9TX/44b26808a6ffb50c7d924a0e3d40ad18/gaining-physical-access-to-facility)

Pen testing isn't just about lurking around a facility late at night and trying to gain physical access. It might also mean dropping a USB key, loaded with a virus, in the parking lot to see whether an employee happens to pick it up and stick it in their laptop; if they do, the key can be formatted to sit on the device as a keylogger, attempt to gain remote access, or send out phishing emails.

It's about social engineering—still one of the most effective ways of gaining access anywhere.

And it means, of course, more straightforward network and application penetration testing—trying to get in by remotely compromising the system itself.

## Two-Factor Authentication

Facilities that provide critical utilities, such as power and water, need to be made absolutely secure, but so does other essential infrastructure in smart cities—like subway transportation, street lights, and security cameras.

The essential technology of any smart city must employ cryptography to protect data. Otherwise, video feeds of your citizenry can wind up being streamed on the internet, or your street lights can end up flashing on and off for hours on end.

Data should be encrypted both at rest and in transit. Any systems that allow access from any parties must accept a username and a password and should go a step forward and enable two-factor authentication. Two-factor authentication is the easiest and most effective step you can take to prevent unauthorized access because it immediately cuts out the most obvious and available attack vectors.

![Two-factor authentication example using phone device auth to grant access](https://images.ctfassets.net/23aumh6u8s0i/HWYrg3Jdj6NOgoKwz1AgN/69deef407a90c08422882ec34e06392f/two-factor-authentication-using-smartphone)

[Two-factor authentication](https://auth0.com/learn/two-factor-authentication/), at root, is about ensuring that anyone accessing your systems has two methods of proving their identity. That might mean a username, password, and something like a biometric key or a one-time password delivered through an app on their phone, like [Auth0 Guardian](https://auth0.com/docs/multifactor-authentication/guardian) or Google Authenticator.

## Education For Citizens and Leaders

Ultimately, the best way to prevent most cyberattacks (on cities or anything else) from succeeding, or at least to mitigate the damages, is education.

Emails that look like they're from a C-suite executive at your company but have an odd-looking From: address, or USB drives that look like they've been forgotten in your office's parking lot: These are highly visible red flags that indicate that some person or group has gotten access to your systems or is trying to. They're also some of the most commonly successful attacks out there because many people don't recognize the signs for what they are.

When one person falls for a phishing email, it can cause huge ripple effects down the line as their contacts are emailed en masse and compromised as well.

Educating denizens about the common forms of cyberattacks and the ways to prevent falling victim to them is the number one way that cities—if they cannot prevent attacks from happening—can ensure that the effects of malicious acts do not ripple out and cause wider damage.

## The Future of Urban Cybersecurity

The cybersecurity challenges of the future are going to look bigger and much different than many of those we have today.

As smart devices proliferate and security vulnerabilities loom larger and larger, it's on all of us to make sure that the cities we are building—no matter how smart—are secure as well.

<include src="asides/AboutAuth0" />

How Do Smart Cities Tackle Cybersecurity?

956290?s=200

R&D Content Engineer

Luke Oliff

Common threats in web application security, how to protect against them and mitigate their impact

**TL;DR:** In this article we'll attempt to cover a comprehensive security strategy for web applications to protect against common threats in web application security and mitigate their impact.

---

## Introduction

Whether you manage your own infrastructure or not, having robust infrastructure security is great. But it becomes a bit redundant if your client's data is just as exposed through your web applications. Having infrastructure security is important, but there are considerations for front and backend developers that _must be considered_.

In this era of modern web technology, security should not be a band-aid or an after-thought. It should be at the very foundation of planning, managing and building your web applications.

**But it doesn't stop there.**

Web application security is an ongoing and ever-changing climate you **do not** want to be caught short.

You must continuously monitor, and work, to ensure that your company doesn't become [another statistic in the world of security breaches](http://breachlevelindex.com/top-data-breaches). Regardless of programming language or framework, there are plenty of generic security practices you could follow from the very start of any project.

In this article I'll introduce you to my biggest tips for top to bottom (Front end to Back end) security for your web applications.

## HTTP Strict Transport Security (HSTS) header

HSTS is a header you can provide the browser that enforces HTTPS across your entire web application.

There is no excuse these days to land on a website that isn't encrypting the communication between your web browser and their servers. While SSL certificates used to be a marketing tool for corporations to prove how safe they were, these days SSL certificates are both **free** and **easy to get**. Certificate authorities like [Let's Encrypt](https://letsencrypt.org) have the backing of [some of the world's best known companies](https://letsencrypt.org/sponsors/), because **a secure internet is better for everyone!**

<include src="TweetQuote" quoteText="There is no excuse for insecure web traffic these days! With the likes of @letsencrypt, free and easy to use SSL certificates are available to the masses!"/>

Simply owning an SSL certificate will not make your web application secure. You need to tell your application how to force traffic through it. Some websites do this with a HTTP redirect, but providing as HSTS header is just as effective, without that overhead.

Here are some examples of a HSTS header.

```
Strict-Transport-Security: max-age=630720; includeSubDomains; preload
```

*To see if it's set on a site with a CURL request:*

```bash
curl -s -D- https://paypal.com | grep Strict-Transport-Security
```

*And to set it in Node.js response:*

```js
function requestHandler(req, res) {
 res.setHeader('Strict-Transport-Security', 'max-age=630720; includeSubDomains; preload');
}
```

> "If a website accepts a connection through HTTP and redirects to HTTPS, visitors may initially communicate with the non-encrypted version of the site before being redirected, if, for example, the visitor types [http://www.foo.com/](http://www.foo.com/) or even just [foo.com](http://foo.com/). This creates an opportunity for a man-in-the-middle attack. The redirect could be exploited to direct visitors to a malicious site instead of the secure version of the original site." – [developer.mozilla.org](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security)


In this example of a HSTS header, we have three *directives*. `max-age`, `includeSubDomains` and `preload`.

- `max-age=<expire-time>`

 The time, in seconds, that the browser should remember that a site is only to be accessed using HTTPS. This means that the browser will automatically use HTTPS to access the site for as long as `max-age` has not expired.

- `includeSubDomains` _Optional_

 If this optional parameter is specified, this rule applies to all of the site's subdomains as well.

- `preload` _Optional_

 Google maintains [a HSTS preload service](https://hstspreload.appspot.com/). Most modern browsers support (or intend to support) this service and if your site is registered, it will never contact the service through insecure HTTP requests. It will assume the site uses HTTPS before it ever connects.

> **Note:** If you start to use HSTS and your site has not been setup with HTTPS certificates then your site would become unreachable.

![HSTS browser compatibility table](https://images.ctfassets.net/23aumh6u8s0i/7ctRyZtGico1ESYixgULo2/187e0586b202b3124e583175841e9112/strict-transport-security-browser-compatibility-table)

## X-XSS-Protection header

XSS (Cross Site Scripting) is the most common of all web application attacks.

XSS occurs when malicious scripts are injected into otherwise trusted web applications. Most modern browsers come prepared to protect against XSS. We can ensure this is enabled by sending the `X-XSS-Protection` header.

> **Note:** `X-XSS-Protection` header is not available in Firefox and has been rendered entirely redundant by the Content Security Policy header, which we detail below.

Here are some examples of an `X-XSS-Protection` header.

```
X-XSS-Protection: 1; mode=block
```

*And to set it in Node.js response:*

```js
function requestHandler(req, res) {
 res.setHeader('X-XSS-Protection', '1; mode=block');
}
```

In this example of a XSS header, we have three *directives*. `1` and `mode`. Also one missing one,`report`.

- `1`

 This is basically a boolean value that determines whether XSS filtering is enabled. Change it to `0` to disable it. Without the optional `mode` or `report` directives, the browser will just sanitize the page, even removing the affected parts.

- `mode=block` _Optional_

 Enables XSS filtering. Rather than sanitizing the page, the browser will prevent rendering of the page if an attack is detected.

- `report=<report url>`

 Enables XSS filtering. If a cross-site scripting attack is detected, the browser will sanitize the page and report the violation.

![X-XSS-Protection browser compatibility table](https://images.ctfassets.net/23aumh6u8s0i/6Ve3SYs9XmKo95KUQigEnY/6342d28fa7a587791f0a6ba05bee7204/x-xss-protection-browser-compatibility-table)

## X-Frame-Options header

Clickjacking occurs when an attacker injects transparent or opaque objects into your web application. These might be an invisible layer over other functionality or designed to look like part of your application. Similar methods can be used for hijacking text boxes, to make you think you're putting your personal details or payment info (or both) into the application you're using!

One of the most famous examples of Clickjacking was against [the Adobe Flash plugin settings page](http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager06.html). The infected application was loaded into an invisible window and tricked the user into relaxing their security settings, like allowing the web application to use your camera or microphone!

To prevent click jacking, there is another header!

Servers offer Browsers a Header Protocol named `X-Frame-Options`. This protocol allows us to specify domains to accept iFrames from. It also allows us to state which sites our web application can be embedded on.

Here are some examples of an `X-Frame-Options` header.

```
X-Frame-Options: SAMEORIGIN
```

*And to set it in Node.js response:*

```js
function requestHandler(req, res) {
 res.setHeader('X-Frame-Options', 'SAMEORIGIN');
}
```

With this header, we get three possible *directives*. `DENY`, `ALLOW-FROM`, and `SAMEORIGIN`.

- `DENY`

 This blocks all framing.

- `ALLOW-FROM`

 This allows you to provide a list of domains to allow framing within.

- `SAMEORIGIN`

 This means framing is only allowed within the current domain.

![X-Frame-Options browser compatibility table](https://images.ctfassets.net/23aumh6u8s0i/XvOBRzI1E9IxZ8mtpp9Lj/58f859bccf6a08b6de3b77d53baab84a/x-frame-options-browser-compatibility-table)

## Content Security Policy (CSP) header

CSP is a more modern layer of security that helps detect and mitigate more than one kind of attack, including XSS and data injection attacks.

Designed to be fully backwards compatible, browsers that don't support it will still work with servers using it, by ignoring it and defaulting to the standard same-origin policy for web content.

It works by telling the browser exactly which URLs content on your site should be loaded from.

To include a CSP header that allows only internal and *Google Analytics*, in an Express.js server, you could do the following:

```js
const express = require('express');
const app = express();

app.use(function(req, res, next) {
 res.setHeader("Content-Security-Policy", "script-src 'self' https://analytics.google.com");
 return next();
});

app.use(express.static(__dirname + '/'));

app.listen(process.env.PORT || 3000);
```

However, if we do not wish to allow *any* external sites to execute scripts on our web application, we could simply include the following:

```js
function requestHandler(req, res) {
	res.setHeader( 'Content-Security-Policy', "script-src 'self'" );
}
```

Note the `script-src` directive here, that we have set to `self`, therefore only allowing scripts from within our own domain. Content Security Policies are both excellent and very powerful, but must be used cautiously. Just as with HSTS, incorrect configuration could cause unforeseen issues or missing content. This will also disable inline JavaScript unless it's provided `unsafe-inline` keyword, a hash like ('sha256-OsJINy4ZgkXN5pDjr32TfT/PBETcXuD9koo2t1mYDzg='), or a nonce ('nonce-...'), which is great for security!

![CSP browser compatibility table](https://images.ctfassets.net/23aumh6u8s0i/6zaBGXDe3oDEx2jShp6nyJ/a55443a478358ceda77f90e3634a503b/content-security-policy-browser-compatibility-table)

## Cross Site Request Forgery (CSRF)

Cross Site Request Forgery is an attack where by the attacker impersonates an authorized user and makes requests on their behalf, like resetting a password, or updating an email address.

We've been mitigating CSRF requests for years by checking HTTP headers such as the `Origin` and `Referer`. Whilst these do work, we have a new defence against CSRF. The `SameSite` cookie directive. `SameSite` is relatively new and has only been around for a year or so. But it's still widely unknown. Once applied, prevents the browser from sending this cookie along with cross-site requests

An example of the SameSite `directive`:

```
Set-Cookie: sess=sessionid123; path=/; SameSite
```

![Cookie SameSite browser compatibility table](https://images.ctfassets.net/23aumh6u8s0i/RE6Tta4NG5iOqv2zWw2m4/63240e10e054bf74c6196871fc7cace3/cookie-samesite-browser-compatibility-table)

## Cookies

Cookies are an important feature of web applications, usually carrying our users session identification, so the server knows you're you on each request. The `SameSite` directive might be a good way to protect your session information, but **Cookie Prefixing** is a new and under utilized method to ensure a cookie is absolutely secure.

Some user agent implementations support the following cookie prefixes:

- `__Secure` - Tells the browser that it should only include the cookie in requests that are sent over secure channel.
- `__Host` - Tells the browser not only that it should only include the cookie in requests that are sent over secure channel, this will also tell the browser to only use the cookie from a secure origin and the scope is limited to a path attribute passed down by the server. If the server omits the path attribute the "directory" of the request URI is used. It also signals that the domain attribute must not be present, which prevents the cookie from being sent to other domains.

Effectively a `__Host` cookie is very specific to where it was intended to be used and therefore should be considered the most secure way to define one.

![Cookie prefix browser compatibility table](https://images.ctfassets.net/23aumh6u8s0i/4IsohfFqjKzFKA3KU1Ky7J/2b8e5883a47bc10d91dfedb16f25e3fc/cookie-prefixes-browser-compatibility-table)

## Conclusion

The most effective method for maintaining the security of your web applications is keeping up-to-date with vulnerabilities. They're a dynamic topic in a dynamic environment and the attacker is always one step ahead.

Complacency is the enemy. The moment you relax and think you're safe, you're going to miss an opportunity to improve security on your web application.

By following the advice in this article, staying up-to-date with announcements, and having an in-depth knowledge of your systems, you can rest assured that you're doing what you can to mitigate attacks.

Many developers and organizations ignore security altogether. It does not take an entire development team to implement the changes in this article, but it does take a certain investment in time and culture to know you're working towards protecting your data.

So, from enforcing HTTPS with Strict Transport Security, to securing our web application with a Content Security Policy header, we're well on our way to ensuring the security of our web applications.

<include src="asides/JavascriptAtAuth0" />

Common Threats in Web Application Security

The threats you might be exposed to this holiday season and what to do about them to stay safe online.

With the end of the year, the volume of internet sales increases drastically due to Black Friday, Cyber Monday, Christmas, and New Year's Eve. Cyber criminals also increase their activity on these dates, as they want to go unnoticed in the high number of transactions.

For that reason, you must be aware of the threats you are exposed to in order to avoid an unwanted gift -- more than your grandma's socks.

According to [Allianz Risk Barometer for 2015](http://www.agcs.allianz.com/assets/PDFs/Reports/Allianz-Risk-Barometer-2015_EN.pdf) **Cyber Crime** rose three positions from 2014 to become the fifth top global business risk of 2015. It is a big threat that continues to expand; you have to be informed about it and take action to avoid it.

Let’s take a look at the biggest threats that you should be aware of.

## Malvertising: A growing threat

Malicious ads are online advertisements on legitimate websites created to deliver and spread spyware, ransomware, and other malware to end-user systems. They are usually shown as targeted pop-up advertisements or as banner ads on online shopping sites, news portals, social media sites, and gaming and adult platforms.

Unlike other malware delivery mechanisms which require user action (clicking a link or opening an email attachment), malvertisements often require no user interaction to work, which makes them quite dangerous.

Sometimes, just visiting a webpage with malicious ads on it is enough to infect a system. In other cases, users have to click fake Flash or Java updates, or fake anti-virus alerts, to get infected.


Typically, larger websites receive ads through multiple ad brokers and networks automatically, with little action margin to filter them. As advertisements are tailored to the user's demographics, location, and browsing history, attackers can deliver the malware to their desired victims.

Security vendor [RiskIQ](https://www.riskiq.com/resources/press-releases/260-percent-spike-in-malicious-advertisements-2015) reported a shocking 260 percent increase in the number of detected malvertisements in the first half of 2015, compared to the same period last year.

Unfortunately, there isn't much you can do to avoid malvertising, but make sure you have antivirus software installed so that if you do stumble upon a bad ad, you will have an extra layer of protection.

![Malvertising](https://images.ctfassets.net/23aumh6u8s0i/TjxI1lRP0AArzjdXJgqSE/89ec0f6fcd0cb560a0a84d0558fe57a8/malvertising)

## Phishing

One of the most dangerous threats this season is **Phishing**. Phishing occurs when cyber criminals attempt to get your usernames, passwords, and credit card details by creating a fake version of a real and well-known site. Users get tricked into entering their sensitive information, thinking that the site is the real one. You may arrive at one of these sites by misspelling the site address or by following links on forged emails, ads, or posts.

This time of year we always see several fake stores emerge. They are there for a couple of weeks, then disappear with your sensitive data and your money.

The [Anti-Phishing Working Group](http://www.antiphishing.org/) reports that in the last quarter of 2014, there was an increase of 18 percent in the number of unique phishing reports compared to the previous quarter, and that **Retail/Service** was the most-targeted industry sector, with **Payment Services** close behind.

Getting lured to a phishing site or a fake store is a common mistake, and easy to make. It's very hard to tell if a site is legitimate without checking its registration records to see how long it's been online.

To confirm that you are on a real, legitimate site, look for the **https** protocol at the beginning of the URL and check that there is a padlock icon, indicating that the identity of the site is confirmed by a third-party security firm.
![When you are browsing a site look for https and the padlock icon to ensure its authenticity](https://images.ctfassets.net/23aumh6u8s0i/5Ic9cdFQxjnVli9VuK17Hz/ee6987ff210d40d7330c51d775d5822c/avoiding-pishing)

_When you are browsing a site look for **https** and the padlock icon to ensure its authenticity and that your information will be transmitted securely._

# Weak Passwords

Big sites have strong security measures in place, but independent of all that security, the weakest link is probably your _password_.

Nowadays, several sites enforce the use of secure passwords, but for those that don't, you should be proactive.

Here are some suggestions for creating passwords:

- Don't use common passwords.

- Don't use passwords related to your personal information.

- Do use a combination of lowercase characters, uppercase characters, numbers, and symbols.

- Do use long passwords: 10+ characters.

- Change your passwords periodically.

- If you use a phrase, using random words is preferred.

- Use multifactor authentication wherever available. Multifactor authentication adds one or more security layers to accessing accounts, making them almost impossible to compromise, even if the attacker gets your password.

<include src="TweetQuote" quoteText="Multifactor authentication adds one or more security layers to accessing accounts, making them almost impossible to compromise"/>

![Weak Passwords](https://images.ctfassets.net/23aumh6u8s0i/66bqIfE5R43vV3m91EWTyu/fb2cf7ea0f3dbd6fa20210f2b2808675/Weak-Password)

## Using debit cards for online purchases

As debit cards are a direct link to your bank account, you should avoid using them for online purchases. If they get compromised, a cyber criminal can empty your bank or savings account.

Credit cards offer better protection against identity fraud, and allow you to dispute any fraudulent charges. Even better if you have a low-limit credit card that you use only for online purchases.

Remember also to frequently check your card statements, especially during the holidays, and immediately refute any suspicious charges.

## Security holes due to outdated software

Update your software frequently on all your devices, including smartphones and tablets, as it will keep you safer. Cyber criminals are constantly working to discover security flaws that will grant them access to your sensitive information.

Nowadays, people know the importance of keeping their operating systems up-to-date to be protected against viruses and malware. But they do not know that hackers have moved to targeting browsers, which everyone uses to interact with the Web. They are looking for vulnerabilities in the browser, specially in the browser's plugins, such as _Flash Player_ or _Java_.

To prevent these flaws from being exploited, make a habit of frequently updating both your operating system and any third-party applications, including browser plugins.

## Not having anti-virus and anti-malware software

Whether you're using a Windows or a Mac computer, **run anti-virus and anti-malware software**. Macs are just as prone to getting viruses as Windows computers, contrary to what most people believe. These software don't degrade your computer performance, specially on new devices. Lastly, schedule periodic - at least once a month - full malware scans on your computers.

## Unencrypted devices

Your personal devices - laptops, tablets, and mobile phones - typically contain a lot of sensitive information about you.

What if they end up in the wrong hands? **Encrypt your devices**. Encrypting scrambles the information so it is not easy to read. If any of your devices are lost or stolen, your sensitive data will be safe.

<div class="" style="text-align: center;"><img style="margin: 0; max-width: 200px;" src="https://images.ctfassets.net/23aumh6u8s0i/3ZZ0BGYXePEYGQyg2dhKZJ/f325f3447666944c075659d0ccd70216/encrypted-devices" alt="Encrypt your devices" />
</div>

_Encrypted devices protect your information if your device is stolen_

## Public WiFi

Never, ever send your sensitive information when on a public Wi-Fi network, especially if you want to buy online or enter in your bank account. Most public Wi-Fi services are not secure. Cyber criminals may be watching the network, waiting for you to enter your personal information.

-------

## Recommendations to be safe from cyber criminals

<div class="" style="text-align: center;"><img style="margin: 0; max-width: 250px;" src="https://images.ctfassets.net/23aumh6u8s0i/0dRIaEpjhU5VZa1v3w941/f4a58b68a638442cfcf179d9d6ccffb5/recommendations" alt="Recommendations to be safe from cyber criminals" />
</div>

Based on all the aforementioned threats, we created the following list of recommendations that you should consider to stay protected this season.

- One easy way to confirm that you are on a legitimate site is to look for **https://** at the beginning of the URL, and look for the padlock icon, identifying that the site has been approved by a third-party certification authority.

- It doesn't matter how convincing a site might look - a deal that seems too good to be true probably is. Try to stick to stores you recognize, if possible.

- Be careful against scams that spoof major retailers by always verifying the URL.

- Do not click on any links you do not recognize, especially if they come from an unknown source.

- Use credit cards for online purchases; if you have low-limit cards, even better. Credit cards have better protection against identity fraud, should you be victimized.

- Periodically review your credit card statements, and report suspicious transactions immediately.

- Never disclose your credit card information, either online or over the phone, unless you know who you are doing business with.

- Use strong passwords for your accounts.

- Passwords you use on shopping sites should never match passwords you use for more sensitive sites, such as your bank, social media networks, or cloud storage accounts.

- Password management software is a very good idea, so you can have different strong passwords for each site you use without memorizing them. You just have to remember the password to unlock the password manager. Password management software helps you create complex passwords for your accounts and automatically submits this information when you need to log into them. There are even excellent free alternatives, such as [Last Pass](https://lastpass.com/).

- Use multifactor authentication wherever available. Multifactor authentication adds one or more security layers to accessing accounts, making them almost impossible to compromise, even if the attacker has your password. For example, **Amazon** added this option a few days ago.

- If you use your smartphone to shop online or use online banking, make sure your mobile devices are protected using a password or your fingerprint. This reduces the chance of losing confidential data if your phone is stolen.

- Equip your devices with security software (anti-virus and anti-malware) and encrypt them if possible.

## Aside: Protecting your users is easy with Auth0

If you are a developer and want to protect your application, you can use Auth0 to authenticate and authorize your users.

Auth0's lock component requires users to input their credentials using **https** protocol to guarantee that information is transmitted securely.

Additionally, you can define **password policies** to customize the level of complexity of the passwords a user enters during sign-up. Auth0 offers five levels of security, matching the [OWASP password recommendations](https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls):

- **None (default)**: The password must exist and be at least one character long.
- **Low**: The password must be at least six characters long.
- **Fair**: The password must be at least eight characters long and must contain a lower case letter, an upper case letter, and a number.
- **Good**: The password must be at least eight characters long and must contain at least three of the following four characters: a lower case letter, an upper case letter, a number, or a special character (e.g. !@#$%^&*)
- **Excellent**: The password must be at least 10 characters long. It must contain no more than two identical characters in a row (e.g., "aaa" is not allowed). It must contain at least three of the following four types of characters: a lower case letter, an upper case letter, a number, and a special character (e.g. !@#$%^&*).

![Setting the required password Strenght in Auth0](https://images.ctfassets.net/23aumh6u8s0i/4Fi0J601exBxy5EBXti6jD/2840507af25ad497fd94a665ab872627/password-strenght)

Lastly, you can also enable [multifactor authentication](https://auth0.com/learn/get-started-with-mfa) in a few steps for extra security for your critical applications.

## Closing Comments

Cyber criminals are always lurking to steal information from vulnerable devices and incautious customers, especially this season.

<include src="TweetQuote" quoteText="Cyber criminals are always lurking to steal information from vulnerable devices and incautious customers"/>

The best defense against cyber crime is prevention - knowing the threats and taking action to minimize the risk of being an easy target. We have given you the knowledge - use it to your advantage and shop safely.

'Tis the Season for Cyber Criminals

Five tips that will help you to shop safely from your home during the sale season

With **Cyber Monday** just around the corner, many people still wonder if it is safe to buy online during end-of-the-year sales events. Of course it is safe in the sense that you won't be pushed, hit, or crushed by other customers who also want to get their hands on the big deals. But is your credit or debit card information safe when you shop online? If you take a few basic precautions, you can enjoy the big discounts and not worry about getting into trouble.

Historically, November and December are the months with the most online transactions, and are therefore the months in which cyber-criminals are the most active.

We will enumerate the top five security threats you may encounter when shopping online and give you hints about how to shop safely on these dates.

## 1. Phishing
![Phishing](https://images.ctfassets.net/23aumh6u8s0i/6oUZ40jndT2KjmMQ7mkefW/9193a67ac6cbfb154870a6748cb7c8a5/Phishing)

The [Anti-Phishing Working Group](http://www.antiphishing.org/) reports that in the last quarter of 2014, there was an **18 percent increase in the number of unique phishing reports** compared to the previous quarter, and that **Retail/Service** was the most targeted industry sector in the fourth quarter of 2014, with **Payment Services** close behind.

**Phishing** is possibly the most dangerous threat this season. Phishing occurs when cyber criminals attempt to get your usernames, passwords, and credit card details by creating a fake version of a real and well-known site. Users get tricked into entering their sensitive information, thinking that the site is the real one. You may enter one of these sites by misspelling the site address, or by following links on forged emails, ads, or posts.

Here are some tips to follow to make sure you don't log into a phishing site:

- Double check the URL of the page you are on, making sure it has no typos before entering sensitive data. Forged sites may look exactly the same as the original ones.
- Look for the padlock. Whenever you are going to enter your information, be it your username, passwords, or your credit card data, verify that the site has a secure connection. The URL should start with **https** instead of **http**.

Additionally, you can get phishing filters as an additional measure to keep yourself protected against this threat. Modern browsers, such as *Chrome*, *Opera*, *Internet Explorer*, *Microsoft Edge*, and *Safari* offer built-in anti-phishing features. Furthermore, you can get specific anti-phishing software from the top antivirus and security companies, such as **Avast**, **Avira**, **ESET**, **Kapersky**, and others.

## 2. Having a weak password

![Weak Passwords](https://images.ctfassets.net/23aumh6u8s0i/66bqIfE5R43vV3m91EWTyu/fb2cf7ea0f3dbd6fa20210f2b2808675/Weak-Password)

Big sites typically have strong security measures, but security is only as strong as its weakest link. Don't let your password be your weakest link, especially if your password is for a site that contains sensitive information, such as your credit card information. Nowadays, several sites enforce the usage of secure passwords, but for those that don't, you should be proactive.

<include src="TweetQuote" quoteText="Big sites typically have strong security measures, but security is only as strong as its weakest link."/>

Here are some tips to help you create a secure password:

- Don't use information related to yourself that can be obtained easily, such as ID numbers, your nickname, your pet's name, and so on.
- Use a long password (10+ characters) with lower and uppercase letters, numbers, and symbols. An easy way to get a secure password is to start with a phrase you know, or better yet, some random words, and replace some characters with numbers and symbols. For example: "I love donuts" can be converted to: **Il0v3D0nuts**, which is quite a strong password.

Some sites have features to alert you (through email or text) when suspicious activity in your account occurs, such as failed login attempts, logins from a different country, or logins at unusual hours. If you have the choice, always enable this option.

## 3. Malware and social network scams

![Malware & Scams](https://images.ctfassets.net/23aumh6u8s0i/5b7bSb5ZzzBFfWIEeXXgye/eca254c9097f11fe86e47d1bfeb9a8c7/Malware-2)

Malware and social networks scams are a latent threat, which is expected to increase during this season. Don't trust unbelievable deals if they come from unreliable sources, such as an email or social media, as they are probably not true. Fake deals will redirect you to phishing sites or trick you to download malware. With the uprise of social media, attackers are focusing on its users. Social media provides attackers a high propagation rate, as affected users will share posts and links to all their friends/followers without even knowing the danger they pose.

Here are some hints to help you avoid malware and scams.

- If you see a suspicious post from a friend, don't open the link. Tell your friend about it, ensure that your friend really published the post, and take action immediately.
- Keep your operating system up to date, as some security holes are patched as soon as they are detected.
- If you are using a retail store's application, make sure you have the latest version, be it a mobile or desktop app. Just as with operating systems, application updates may fix detected security holes and improve stability.
- Install antivirus and malware protection software.

## 4. Using public terminals and networks

![Using Public terminals and Networks](https://images.ctfassets.net/23aumh6u8s0i/PJ0f2zQwwtdWNoYNUUqBk/8eee7ebe1040714ebef9e122e9cb67e2/Public-Networks)

Never, ever enter your credit card number on a public Wifi network or terminal. Really, we cannot stress enough how bad an idea this is. Anyone can be in public networks, including attackers listening to the network traffic, and public networks offer no security. It doesn't matter whether the site you are trying to access is secure, if the way you get there is not. Private networks, or even 3G/4G mobile networks, are safer.


## 5. Shopping at unsecure sites

![Phishing](https://images.ctfassets.net/23aumh6u8s0i/7wJqzJ0zgyqqCbHlvqpjdw/cfb8474d9a636d4c621c4c78ec5ea306/Unsecure-Sites)

Maybe you want to buy something from a small site, or a new site. Maybe that little-known site is the only one that has that precious item you want. Well, you can do it if you trust the company, but you will be safest if you check to see that the site meets the following security measures:

- Ensure that the site protects the security of your information during transmission by using Secure Sockets Layer (SSL) software, which encrypts the information you input. You can verify this by checking to see that the URL of the website starts with *https*, and that the browser shows the **padlock icon** to indicate the use of SSL certificates.
- Read the privacy and security information for the site to find out how it handles privacy and security. From this document, you can also learn whether the site takes security seriously. For example, you can find out whether it implements Brute Force Protection and IP logging, among other measures.
- Some sites outsource their payment platforms to online payment services such as **[Paypal](http://www.paypal.com)**; in this way, these well-known services handle all the user's data and typically have strong security measures in place.
- Share only as much information as is necessary to make your purchase. For example, if a site asks you for your social security number, employer, relative's information, and such, do not trust that site.
- If you log in using a social provider, always verify the information that the site asks for. Often you will find that sites ask for information that they do not need, such as your friends list.


## Aside: Protecting your users is easy with Auth0
If you are a developer and want to protect your application, you can use Auth0 to authenticate and authorize your users.

Auth0's lock component requires users to input their credentials using **https** protocol to guarantee that information is transmitted securely.

Additionally, you can define **password policies** to customize the level of complexity of the passwords a user enters during sign-ups. Auth0 offers five levels of security matching the [OWASP password recommendations](https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls):

- **None (default)**: The password must exist and be at least one character long.
- **Low**: The password must be at least six characters long.
- **Fair**: The password must be at least eight characters long and must contain a lower case letter, an upper case letter, and a number.
- **Good**: The password must be at least eight characters long and must contain at least three of the following four characters: a lower case letter, an upper case letter, a number, or a special character (e.g. !@#$%^&*)
- **Excellent**: The password must be at least 10 characters long. It must contain no more than two identical characters in a row (e.g., "aaa" is not allowed). It must contain at least three of the following four types of characters: a lower case letter, an upper case letter, a number, and a special character (e.g. !@#$%^&*).

![](https://images.ctfassets.net/23aumh6u8s0i/4Fi0J601exBxy5EBXti6jD/2840507af25ad497fd94a665ab872627/password-strenght)


## Final words

Finally, we would like to give you a word of advice to complement these tips. **Use a low-limit credit card to buy online**; that way, even if it does get compromised, attackers won't do much damage. And, more importantly, **check your credit card statement periodically**; if you detect unknown or suspicious charges, you will be able to contact your bank and reject the transactions.

Keep these things in mind, and we promise you will be buying from the comfort of your couch, getting Cyber Monday deals safely and securely.


Happy shopping!

"threats"