Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

Choosing the right customization strategy can make the difference between success and failure in your next identity project.



Every identity professional is familiar with that vaguely frustrating feeling arising from working on a scenario that is _almost_ perfect. If only that user store could support OpenID Connect… If only that legacy app could be slightly modified… Similar deviations from the canonical scenarios are the true norm, making it hard to provide a solution that only relies on the out of the box features commonly found in identity products.

Businesses, system integrators, and software vendors deal with those challenges following what looks like a disjointed set of different strategies. Some take a brute force approach and code every identity functionality from scratch. Others implement their identity functions deploying installable instances of server products, or rely on operating system features, and take advantage of the degree of control that can be achieved by running your private instance. Yet others rely on IDaaS (Identity-as-a-Service) offerings, leveraging whatever extensibility technology is offered to adapt the defaults to the specific needs of their particular scenarios.

<include src="TweetQuote" quoteText="How do you know if the identity solution you are evaluating will give you the power and flexibility your scenarios require? The answer is in their extensibility features.#taoofextensibility"/>

In that apparent chaos, choosing the strategy that best fits your requirements isn’t easy. To help with that difficult task, we authored a whitepaper that compares and contrasts the main approaches to identity customization. By placing every strategy on a continuum based on the expressive power and ease of implementation dimensions, we expose individual strengths and weaknesses while offering you a logical progression you can use as a reference when considering hybrid approaches. Here’s the chart that summarizes it all:

![IDENTINOMICS](https://images.ctfassets.net/23aumh6u8s0i/2NFqrjWN3ckUWRyfyc0U0H/f1ed9f13daaddd38bb02a5f97415c6cd/IDENTINOMICS)

The strategies considered cluster around two macro approaches, one which favors full control at the price of taking more responsibility in the implementation (lower left quadrant) and one where most functionality is outsourced to a service, with the expressive power bounded by the extensibility choices of the selected service (top right quadrant). You’ll have to download the whitepaper to find out the whole story, but let me give you a spoiler alert here. 

At Auth0 we believe in the power of outsourcing identity concerns to a service run by professionals, but we are also strong believers in the power of code. This is why we deem the IDaaS+code approach to be the one offering the absolute best compromise: identity essentials taken care of by an easy to use service while retaining the ability to address last-mile customizations with code — the same control and power you’d have if you would have coded everything from scratch.

Download the [Identity in the Real Word: the Tao of Extensibility](https://auth0.com/resources/whitepapers/tao-of-extensibility) whitepaper.

Auth0 Principal Architect Vittorio Bertocci’s new whitepaper can help CTOs, architects, and developers understand the trade-offs between the different customization strategies offered by today’s identity solutions, explaining how to pick the right one for each scenario in the “Tao of Extensibility.”

<include src="TweetQuote" quoteText="Today’s identity products approach customization with many different strategies. Auth0 Principal Architect @vibronet evaluates the strengths of each approach. #taoofextensibility"/>

<include src="asides/AboutAuth0" />


New Whitepaper: The Tao of Extensibility

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Today we are releasing a white paper to describe our approach to security so that our subscribers can understand how their data is protected



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

**TL;DR:** Auth0 takes security very seriously. If you want to learn how we handle security and protect your users, [download our security white paper](https://cdn.auth0.com/website/security/auth0s-information-security-wp.pdf).

---


At Auth0, we have built state-of-the-art security into our product so our subscribers can take advantage of cutting edge features designed to protect their users and business. But features aren't enough. We go beyond best practices in our security program, so other businesses can rely on us to help keep the malicious actors out, and simplify letting the right people in. You can find the security white paper that we have just released in [here](https://cdn.auth0.com/website/security/auth0s-information-security-wp.pdf) or at the [Auth0's Security page](https://auth0.com/security).

This white paper is an analysis and explanation of how we handle security. In this document, we have detailed our approach to this subject from many different perspectives. We discuss how we deal with *People and Processes*, how we handle *Disaster Recovery and Backup*, and much more. With this information, our subscribers can better understand how their data is protected and what measures we actively take to guarantee that sensitive data won't fall into the wrong hands.

Below, you can view the table of contents for the white paper. The whole document can be found [here](https://cdn.auth0.com/website/security/auth0s-information-security.pdf).

```bash
- Introduction
- Dedicated Security Team
  |- People and Processes
  |- Background Checks
  |- Security Awareness
  |- Access Requests
  |- Security Policies
  |- Privacy
- Secure Product Development
  |- Specification Compliance
  |- Authentication Experts
  |- Code Review
  |- Development Tools
  |- Secret Management
  |- White Hat Program
  |- OWASP Compliance
  |- Deployment Process
- Third-Party Compliance
  |- SOC II Type 2
  |- External Security Assessments
- Infrastructure and Data Security
  |- Cloud Security
  |- Infrastructure as Code
  |- Network Security
  |- Security Monitoring
  |- Authentication
  |- Data Encryption
  |- Laptop and Mobile Device Security
- Disaster Recovery and Backup
  |- Business Continuity Plan
  |- Backup Strategy
- Vendor security
  |- Security Team Review
  |- Privacy Considerations
- Summary
```

We hope that by releasing the security white paper, we can achieve greater transparency with our subscribers and the whole community of developers, security experts, and partners. We also hope that by making this information publicly available and concise in one document, interested parties will feel more confident about Auth0's practices and processes.

Lastly, we’d really love to encourage interested parties to analyze, question, and comment our approach to security. Please, feel free to ping us if you have any doubts or suggestions.

<include src="asides/AboutAuth0" />


"whitepaper"