brandon-roberts

Brandon is a Developer Advocate at Nrwl, focused on community engagement, content creation, and collaboration around Nx, the open-source build framework. He enjoys learning new things, helping other developers build web applications, sharing knowledge, collaborating with others, and contributing to open source. Brandon is a Google Developer Expert in Angular, a technical writer, and also a maintainer of the NgRx project building libraries for reactive Angular applications.

Developer Advocate

Brandon Roberts

Whether you have a single application or a suite of applications, code reuse, standards around structure, process, and feature development help to ensure your codebase remains healthy in the long term.

[Nx is a build framework for monorepos](https://nx.dev) with first-class React support. It helps accelerate the adoption of proven development practices across projects of many sizes and scopes. Nx provides additional tooling for React projects to help scale and develop features at a faster pace. 

This guide walks through some of the tooling provided by Nx, the creation, and structure of an Nx workspace, with an example to follow along with.

<AmpContent>
<amp-youtube
    data-videoid="IMWk0P6EeRc"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/IMWk0P6EeRc' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## What are Monorepos

A monorepo is a single collection of all your source code that spans multiple applications, libraries, and languages. Everything in the monorepo is not deployed at the same time but is all located in a central repository. Many companies use monorepos for different organizations and projects. Some even use a single monorepo to house all the source code for projects across their entire company.

Here are some of the benefits of a monorepo:

* **Shared code** &mdash; Promotes reuse of validation code, UI components, and types across the code base, including code between the backend and the frontend.
* **Atomic changes** &mdash; Make changes to a server API and modify the clients that consume that API in the same commit. No more coordinating commits across different repositories.
* **Developer mobility** &mdash; Provides consistency between building and testing applications written using different tools and technologies. Developers can confidently contribute to other teams’ applications and verify that their changes are safe.
* **A single set of dependencies** &mdash; Use a single version of third-party dependencies for all your apps. Less frequently used applications don’t get left behind with a 3-year-old version of a framework library or an old version of a build tool. 

There are also a few common misconceptions with monorepos:

* Strictly co-locating your code just by placing all your code in the same repository.
* Running all the builds, tests, and quality checks on all applications for each PR or commit.
* Deploying every application on every commit to the main branch.
* Setting up multiple scripts across applications to handle common tasks.

Just because you have all your code in a monorepo, that does not mean you have run all the tests and checks on your monorepo for every single commit. This doesn't scale well and leads to bottlenecks in your development and Continuous Integration (CI) and Continuous Deployment (CD) pipelines. Nx provides integrated tooling to intelligently determine what needs to be run through code analysis, affected commands, and computation caching. 

### Affected commands

Nx uses code analysis to build a dependency graph of all projects in the workspace. It then uses the dependency graph to determine what projects are impacted based on your changes between your Git branches and the main branch. [Nx’s Affected Commands](https://nx.dev/latest/react/core-concepts/mental-model#affected-commands) use this code analysis to perform the minimum set of tasks based on what's changed. Let’s look at two applications that depend on a library as an example.

![](https://images.ctfassets.net/23aumh6u8s0i/3Msqcbm3M7zreqA7s3Yga/fa9a14ab5dd0970d45ff8603494a2530/Uploaded_from_Streamlining_a_React_Monorepo)

To see what applications are affected, use the **[nx affected:apps command](https://nx.dev/latest/angular/cli/affected-apps)**. Nx analyzes the nature of the changes and determines which projects, including applications and libraries, are impacted. In the example above, changing app1 doesn’t cause app2 to be impacted, so you don’t need to run all the pre-merge steps for app2. Alternatively, changing the lib, or packages that both apps depend on does impact both applications.

### Computation caching

Nx is smart in that it also knows the context in which you ran particular commands, the current hash of the files, and other environmental information. 

![](https://images.ctfassets.net/23aumh6u8s0i/1gsO5lGTZaluzgHVc3H3xr/f931ae116060c2def80962a764b4888b/Uploaded_from_Streamlining_a_React_Monorepo)

The image above displays an example of the information collected to build a unique hash used to identify the computation. With this information, Nx caches and stores these computations and can replay them if it seems the same computation is being run again.

This isn’t done through rebuilding source code. Only the artifacts produced from a given command are stored and replayed when possible. If Nx doesn’t find this computation, Nx runs the task, and after it completes, it takes the outputs and the terminal output and stores it locally (and if configured remotely). All of this happens transparently, so you don’t have to worry about it.

## Creating an Nx Workspace Using a React Preset

Now that you know how Nx works, let’s try it out by building a small application that lists Star Wars characters.

Start with creating the Nx workspace with a React application using the `react` preset. 

```sh
npx create-nx-workspace sw-org --preset react --appName myapp
```

After running this command, you’ll be asked to select a stylesheet format. You can choose the default for this demo. You also have the option to connect your workspace to [Nx Cloud](https://nx.app/) if you’d like.

After you make your selections, this command does the following:

- Generates a new Nx workspace
- Scaffolds out a new React application with modern tooling, including [Jest for unit tests](https://jestjs.io/), and [Cypress for E2E tests](https://www.cypress.io/).

There are other presets available, such as `next` for [Next.js](https://nextjs.org/) projects, and `react-express` for a workspace with React and Express pre-configured.

Every Nx workspace has a file structure similar to this:

```treeview
myorg/
├── apps/
├── libs/
├── tools/
├── workspace.json
├── nx.json
├── package.json
└── tsconfig.base.json
```

* `/apps/` contains the application projects. This is the main entry point for each runnable application.
* `/libs/` contains the library projects. Each library defines its external API so that boundaries between libraries remain clear. 
* `/tools/` contains scripts that act on your codebase.
* `/workspace.json` contains the configuration for each project in your workspace.
* `/nx.json` adds extra information about projects, including implicit dependencies and tags that can be used to restrict the ways projects are allowed to depend on each other.
* `/tsconfig.base.json` sets up the global TypeScript settings and aliases.

To serve up the application, enter into the `sw-org` directory and run the `serve` command using the Nx CLI:

```sh
nx serve
```

> Note: If you don't want to install Nx globally, you can use `npx nx serve` instead.

The initial application page is displayed.

![](https://images.ctfassets.net/23aumh6u8s0i/2EUaKnrpRkLehJempAp06f/a99c92b3282e79e42b16877c98cac1c9/Uploaded_from_Streamlining_a_React_Monorepo)

## Generating a Feature Library

[Generating libraries](https://nx.dev/latest/react/structure/library-types#feature-libraries) in an Nx workspace is done by using the `generate` command with the Nx CLI. Feature libraries are used to display UI to the user, which could including routing information, and could use other libraries such as shared components.

Create one now by running:

```sh
nx generate lib people
```

**NOTE** [Nx Console](https://nx.dev/latest/angular/getting-started/console) also provides a full l GUI to run Nx CLI commands in your editor with native VSCode and WebStorm support.

## Generating a Data Access Library

A "data access" library is where functionality for fetching and storing data for a feature exists. So any services necessary to manage the quotes are placed in this library. Throughout building applications, there will be data access libraries across multiple features.

Create the data access library by running:

```sh
nx generate lib data-access
```

**NOTE** You can also create your custom generators similar to the `library` generator inside an Nx workspace. This provides more flexibility to create more standards around your development processes and guidelines. Read more about workspace generators in our [Workspace Generators](https://nx.dev/latest/angular/generators/workspace-generators) guide.

Update the data-access library to fetch the characters from the Star Wars API.

Open up `data-access.tsx` and replace it with the following:

```js
import { useEffect, useState } from "react";

export interface IPerson {
 birth_year: string;
 eye_color: string;
 films: string[];
 gender: string;
 hair_color: string;
 height: string;
 homeworld: string;
 mass: string;
 name: string;
 skin_color: string;
 created: Date;
 edited: Date;
 species: string[];
 starships: string[];
 url: string;
 vehicles: string[];
}

export interface Response<T> {
 count: number;
 next: null | string;
 previous: null | string;
 results: T[];
}

export function usePeople(page: number) {
 const [people, setPeople] = useState<IPerson[]>([]);

 useEffect(() => {
   fetch(`https://swapi.dev/api/people/?page=${page}`).then((r) =>
   r.json().then(data => data.results)
 ).then(data => {
     setPeople(data);
   });
 }, []);

 return people;
}
```

Now update the people feature at `people.tsx` to list out the characters:

```js
import { usePeople } from '@sw-org/data-access';
import './people.module.css';

export function People() {
 const people = usePeople(1);
  return (
   <div>
     <h1>Star Wars People</h1>

     <ul>
       {
         people.map(person => (
           <li key={person.name}>
             {person.name}
           </li>
         ))
       }
     </ul>
   </div>
 );
}

export default People;
```

Replace the `App` template with the `People` component

```js
import styles from './app.module.css';

import { People } from '@sw-org/people';

export function App() {
 return (
   <div className={styles.app}>
     <People/>
   </div>
 );
}

export default App;
```

Refreshing the application shows a list of characters.

![](https://images.ctfassets.net/23aumh6u8s0i/3wmVIH8Sqz1ejavorzIzsI/99c44e96e4e44149da2e72e5e328baad/Uploaded_from_Streamlining_a_React_Monorepo)

The list of characters is simple. The business and data logic is kept in libraries. As your applications grow, the number of libraries grows along with it, but the applications remain relatively small and are only used for integrating core functionality for the app to run.

## Dependency Graph

Nx knows the dependencies between projects in your workspace and can generate your dependency graph visually at any point in time. 

Run the **nx dep-graph** command to see the current state of the workspace.

```sh
nx dep-graph
```

This displays the application, E2E project, and the two libraries. 

![](https://images.ctfassets.net/23aumh6u8s0i/4oiIpWdF5wIpz6y5qJkGA4/9a8802092e0de9c1a0e5c9e25d9828d7/Uploaded_from_Streamlining_a_React_Monorepo)

**NOTE**: You can also have the dependency graph auto-refresh with the `--watch` flag.

You can also see what projects are impacted by a given change. Make a change to the App.tsx, such as removing the `className`, save, and run the **nx affected:dep-graph** command.

```sh
nx affected:dep-graph
```

This displays the **myapp** and **myapp-e2e** highlighted in red as affected projects.

![](https://images.ctfassets.net/23aumh6u8s0i/2S5DueXJUNdbbguneKUjGJ/cc397167e5dc78a1835ab2db57b6dacb/Uploaded_from_Streamlining_a_React_Monorepo)


**NOTE:** The **myapp-e2e** application is directly tied to mapp, but is implicitly linked through the **nx.json** file. Read more about Nx configuration here.

### Using Affected Commands

Nx provides affected commands to run certain tasks against affected projects. For example, make a change to the `data-access` library, and run **nx affected:build**. 

```sh
nx affected:build
```

Nx finds the affected applications impacted by changing the **data-access **library and runs the **build** target for each one of them. That way, **only** the affected projects are built for the given change, and not every project in the monorepo. The same commands work for **test**, **lint**, and **e2e**, and others.

There is also the **nx affected** command that works with any defined target. The alias for **nx affected:build** is:

```sh
nx affected --target=build
```

This allows you to run any target based on the affected projects.

### Using Computation Caching

Along with affected commands, Nx supports[ computation caching](https://nx.dev/latest/angular/core-extended/computation-caching) to never execute the same computation twice. This computation cache is pluggable and can be distributed. Taking `**myapp`** as an example, run the build for `myapp` twice.

```sh
nx build myapp
```

When running the same command the second time without changes, you immediately get the cached results from the previous computation. The computation cache is done locally, but can also be distributed and extended to the rest of your team and organization. 

[Nx Cloud](https://nx.app) is one such option to distribute your computation cache. It includes a free tier with 5 hours of saved time per month, enterprise options, and is free for open-source projects.

## Summary

Nx provides modern tooling including code analysis, code generation, code analysis, affected commands, and computation caching to scale your application development using a monorepo.

What did we cover?

- Monorepos and why you should use one
- Nx workspace structure and standardization
- Smarter tooling with code analysis, affected commands, dependency visualization, and computation caching.

Find out more with the following resources:

* Documentation at [https://nx.dev](https://nx.dev)
* Free [Egghead course](https://egghead.io/playlists/scale-react-development-with-nx-4038) on Scaling React Development

Streamlining a React Monorepo

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

U.S. Navy veteran and former security leader from Nike joins Auth0 C-Suite



**BELLEVUE, Wash. – March 1, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Jameeka Green Aaron](https://www.linkedin.com/in/jameeka/) has joined the company as Chief Information Security Officer (CISO). Aaron brings more than 20 years of industry experience and will be responsible for the holistic security and compliance of Auth0’s platform, products, and corporate environment. 

Aaron is a recognized industry thought leader and has dedicated two decades to managing and improving information security systems at each of her previous positions, including Nike, Hurley, Lockheed Martin, and the U.S. Navy. She is also committed to advancing women and people of color in Science, Technology, Engineering, and Mathematics (STEM) fields, and she participated in the U.S. State Department’s TechWomen program and the National Urban League of Young Professionals. She currently sits on the board of the California Women Veterans Leadership Council, is an advisor for U.C. Riverside Design Thinking Program, and is a member of Alpha Kappa Alpha Sorority, Inc.

“Jameeka is an incredible addition to our executive team, not only for her deep experience and leadership but for her leadership outside of the security industry as well,” said Eugenio Pace, CEO, and co-founder of Auth0. “As a company with a mission of inclusivity and access to technology, we were taken by Jameeka’s stewardship to her causes and looked forward to driving lasting positive change together. Her unmatched security expertise and dedication is an inspiration and invaluable asset to Auth0.”

The web of complexity involved in managing a competitive digital business broadens each day. Auth0 continues to innovate and evolve its identity management platform to make security, privacy, and compliance easier for global enterprises. The company is solving complex and large-scale identity use cases for global companies, and Aaron will help Auth0 and its customers ensure that they meet the highest levels of security and compliance.  

“In addition to the amazing roster of customers that puts their trust in Auth0 and fuels its growth, I was very much struck by the humanity of everyone I met with—a level of empathy that has been a rarity throughout my career,” said Aaron. “Being a CISO is a very unique job and is one that largely centers around accountability. I am approaching this position at Auth0 with a mission to ensure the optimal security of our platform, as well as be a strong collaborator and partner to both customers and employees alike.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />


Auth0 Names Jameeka Green Aaron as Chief Information Security Officer

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Executives are being held to account by regulators and seeking to shape the law


In January 2020, the FTC released a [statement](https://www.ftc.gov/news-events/blogs/business-blog/2020/01/new-improved-ftc-data-security-orders-better-guidance) defining its new position on data security orders, to give companies a clearer understanding of the FTC’s expectations for security practices. The new orders specifically emphasize the role of executives in taking responsibility for overseeing policy, in the hopes that C-Suite and board-level buy-in will improve compliance.

Under the new orders, companies must present their board with an annual report on their security program, and senior officers must directly provide the FTC with certifications of compliance. According to the FTC’s statement, “This will force senior managers to gather detailed information about the company’s information security program, so they can personally corroborate compliance with an order’s key provisions each year.”

The FTC asserts that requiring high-ranking executives to provide certifications under oath has been effective in other sectors, such as securities law since it creates direct accountability for individual executives. They cite two studies that correlate executive involvement in data security with a decrease in breaches, including one that found a 35% decrease in the probability of breaches when a company’s Chief Information Security Officer is in the top management team and has access to the board.

<include src="TweetQuote" quoteText="Find out why the @FTC’s new data security orders will require the C-suite and board to strengthen data security strategies."/>

## Executives Are Influenced by Policy and Are Influencing It

PWC’s [Top Policy Trends 2020](https://www.pwc.com/us/toppolicytrends) report surveyed over 400 CEOs, CFOs, and COOs, and concluded that data is “the unifying thread” across all the major policy areas the C-Suite is concerned within 2020. Specifically, the report highlighted data privacy as a central concern for the C-Suite, with 44% of CEOs listing it as one of the top three policies impacting their business the most.

For the past two years, organizations have been forced to adapt their data policies to a rapidly evolving regulatory landscape, most notably the EU’s [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) and the [California Consumer Protection Act (CCPA)](https://auth0.com/resources/whitepapers/simple-guide-CCPA-compliance). Most executives recognize the need for greater regulation on how businesses collect, store, share, and protect sensitive personal data. However, many are also worried that a global patchwork of contradictory regulations could hamstring their ability to operate their businesses across various jurisdictions and hope to work toward more universal standards for data privacy and security. Indeed, of the C-Suite executives PWC surveyed, close to 70% say their organization is “very actively” seeking to shape data privacy policy.

While it’s healthy for executives to help create laws that are informed by the reality of doing business, business leaders must exercise care in attempting to influence legislation, or risk a backlash. A prime example is CCPA, which in its current form is significantly weaker than the original ballot referendum, which would have granted Californians more rights.

While fines under CCPA can still be significant, one of the initiative’s drafters, [Mary Stone Ross](https://www.fastcompany.com/90444501/i-helped-draft-californias-new-privacy-law-heres-why-it-doesnt-go-far-enough), publicly criticized corporate lobbyists for their role in drafting the final legislation.  Ross voiced the hope that new laws at the state and federal level would “learn from California and guard against the relentless efforts of corporations to weaken people’s rights.” In the long-term, this negative perception of corporate influence erodes public trust and makes it more difficult for businesses to wield their influence responsibly. Already, [CCPA 2.0](https://www.barrons.com/articles/california-consumer-privacy-act-alastair-mactaggarts-51576779571), which gives consumers more rights and increased enforcement powers, is set to be a ballot initiative in 2020. 
Policy aside, the public at large is increasingly sensitive to businesses whose actions don’t live up to their professed values. When Facebook’s stock tumbled 7% in January, despite strong quarterly revenue, [_The Guardian_](https://www.theguardian.com/technology/2020/jan/29/facebook-fourth-quarter-earnings-stock) suggested that “continuing scandals and regulatory roadblocks may finally be catching up with the social media giant.”

## Strategies for the C-Suite to Lead on Data Privacy
In the second edition of [_Navigating the Digital Age_](http://securityroundtable.org/ndte/ndte2.pdf), published by Palo Alto Networks and the NYSE, experts and executives from across various tech sectors joined together in a clarion call for greater innovation, collaboration, and leadership on issues of privacy and security. Their advice ranges from big picture ideas (the word “moonshot” appears 28 times) to small but crucial suggestions for improvement.

In his chapter, security advisory Marc Goodman advises leaders to pay attention to the UX of cybersecurity, since the design of many legacy security programs is “abysmal and painful.” The design of a pop-up security warning window might seem insignificant, but if it’s all that’s standing between your employee and a catastrophic security mistake, it’s a big deal. Says Goodman: “It’s not enough that our security protocols work in theory; they have to work where the rubber meets the road at the end of a keyboard... And that requires a good understanding of human behavior—something infrequently accounted for in organizational cybersecurity strategies.”

<include src="TweetQuote" quoteText="@FTC ordered the C-Suite and board to get more involved with data security. Why IAM is a strong place to start."/>

One subject that many experts mention as a lynchpin in transforming cybersecurity is authentication. Ann Johnson, Microsoft’s Corporate Vice President of Cybersecurity Solutions, writes that one of the most encouraging current developments in cybersecurity is “the imminent demise of passwords.” This outdated and breach-prone form of authentication is “giving way to biometrics and other steps in multi-factor authentication, making it harder for bad actors to penetrate our firewalls and grab our personally identifiable information, intellectual property, and digital assets of every format.” Of course, experts have been predicting the demise of passwords for ages, but until that day actually comes, it’s crucial to do a better job of securing usernames and passwords.

There’s a growing consensus that sophisticated Identity and Authentication Management (IAM) platforms offer executives a fast and comprehensive way to get control of data and step up security. That consensus is largely responsible for [Auth0’s explosive](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) growth in recent years. As [Auth0 customer Rolf Bekkstrand](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) attested, “As a CTO, I really don't want to be responsible for a data leak that showed passwords and user logins and those kinds of things. I'm 100% sure that Auth0, a company that is built around this, will have better ability to take care of the security than I'm able to do — your entire business depends on it.”

## To Get Involved With Data Privacy, Start by Getting Educated
For the C-Suite, taking the lead on issues of data privacy and cybersecurity begins with listening. Executives must listen to their users’ concerns, and they must also seek out opportunities for expert education so that they can make informed decisions for their companies.

At Auth0, we pride ourselves on providing not just a cutting-edge IAM platform, but also advice for leaders (whether they’re our customers or not) who are interested in stepping up their approach to security. If you’d like to explore strategies to get your C-Suite up to speed, [reach out to an Auth0 resource](mailto:sales@auth0.com).


The FTC Orders the C-Suite to Get Involved in Data Security

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Pace honored at Washington’s most acclaimed C-Suite executive leadership awards


**BELLEVUE, Wash. – January 30, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced its CEO and Co-founder, Eugenio Pace, was honored at Seattle Business magazine’s [Executive Excellence Awards](http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards), one of the Pacific Northwest’s most prestigious business leadership events, for his exceptional leadership practices and successes in the business community. 

[Pace](http://seattlebusinessmag.com/executive-profiles/2020-executive-excellence-awards-eugenio-pace-co-founder-chief-executive-officer), one of 16 award recipients – along with some of the state’s most respected business leaders from corporations and nonprofits including Zillow Group Inc., Rosetta Stone Inc., Textio, and Washington Women’s Foundation – was honored for his principled leadership practices, and commitment to his team and business community. 

“I am truly humbled to receive this prestigious award and be recognized alongside such a distinguished lineup of professionals, who I look up to for their exemplary leadership,” said Pace. “This award is truly the accomplishment of my entire team – a team that pushes me to be a better leader day in and day out, and never stops pushing boundaries to innovate and deliver only the best to our valued team, customers, and communities.” 

The eighth annual awards ceremony held on January 23, 2020, received nearly 100 applicants this year, a record-breaking year for entries. After a lengthy review process, only 16 individuals were selected by a judging panel based on which leaders have shown outstanding leadership in guiding their companies to success.

“Regardless of industry, successful executives share several traits,” said Seattle Business magazine Editor in Chief Rob Smith. “According to ghSMART's 10-year study of 17,000 C-suite executives, called the CEO Genome Project – featured in Harvard Business Review – top-level leaders excel at four behaviors: the ability to make quick decisions with conviction; achieving buy-in from employees and stakeholders; the ability to adjust to a rapidly changing environment; and producing results.”

The 2020 Executive Excellence Awards are featured in the magazine’s February print issue and online: [http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards](http://seattlebusinessmag.com/executive-profiles/winners-2020-executive-excellence-awards).

## About the Executive Excellence Awards 

The Executive Excellence Awards is considered to be one of the Pacific Northwest’s most prestigious business leadership events of the year. Over the years, this awards program has hosted C-suite executives from companies and organizations such as Starbucks, Amazon, Alaska Airlines, Expedia, Seattle Seahawks, Seattle Symphony, Ste. Michelle Wine Estates, the Bill & Melinda Gates Foundation, and many more.

<include src="asides/AboutAuth0" />

### Media Contacts:
Kaycie East<br>
Auth0 Communications<br>
[press@auth0.com](mailto:press@auth0.com)
 
Alexandria Plew<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)


Eugenio Pace of Auth0 Honored for Executive Excellence by Seattle Business Magazine

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. <br /><br />Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. <br /><br />She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Auth0 CISO Joan D. Pepin on how we can still apply the security principles that helped Alexander the Great conquer the world



**TL;DR:**
InfoSec hasn't changed in 3,000 years.

## Battle Scene

Imagine an ancient battlefield. One side's general stands on a hill and observes the flow of battle below. He decides he needs one of his chariot commanders to flank around to the west to pin the enemy against a cavalry group coming in from the south.

He takes out his [scytale](https://en.wikipedia.org/wiki/Scytale) (basically an ancient secret encoder/decoder ring) and encodes a message to the commander on a piece of papyrus. He then rolls it up and seals it with his personal seal and a mixture of wax and bitumen and hands it to a trusted messenger.

The messenger runs down the hill, finds the chariot commander and hands him the scroll. The commander checks the seal to authenticate the message and verify it has not been intercepted and then uses his scytale to decrypt it, which also serves as a secondary means of authentication. He then sets fire to the papyrus, and finally, before executing his orders, stabs the messenger, tearing down the session.

And 3,000 years later, that’s still what we care about.

What we saw in the battlefield example was **confidentiality** and **integrity** — the two fundamental principles of security that we care about today. The cipher (or code) helps ensure confidentiality and the wax seal provided integrity.

My point about security is that it's actually very simple in theory. People forget that. The fundamentals of integrity and confidentiality are very straightforward. Viewed through that lens, > 99.999% of infosec is an execution and OpSec problem. We've known the basics for millennia, and we tend to overcomplicate it.

## Modern Examples

Let’s look at two more modern examples, one from the 1980s, which would get us up to the time period of the hit TV show [Stranger Things](https://www.netflix.com/title/80057281) and the other from present day.

![InfoSec Separator 1](https://images.ctfassets.net/23aumh6u8s0i/V1aXIVNxxxsI3quOD96ko/bdeb0616ec5e90edf3cb71eadca0b9fb/infosec-separator-1)

### Stranger Things Era

Back in the 1980s, a kid (Alice) is sick with mononucleosis (mono), so she can’t head to her neighbor Bobby’s house to play chess. Instead, she gets a ball of string from the kitchen junk drawer, ties one end around her bedpost and throws the rest through her neighbor’s screenless (and open) window. Based on past behavior this is a clear invitation for communication. Each kid already has a tin can with a hole in the bottom so they can [create their own telephone.](https://www.wikihow.com/Make-a-Play-Telephone)

The first kid threads her end of the string through the hole and ties a knot. The other kid does the same and then, they each reset their chess boards. Using their tin can phone system, they’ll share moves. Each kid moves their pieces on their board, but only Alice keeps a written log of what gets said. And, because her mom has told her she’s supposed to be resting in bed, she’s going to use a special coder ring, not unlike the one used in Alexander’s time, to make sure her mom can’t read her notes. 

### The Present Day

If that same kid wanted to play chess now, she’d probably grab her smartphone and engage with a friend on the other side of the world via an app — and she could encrypt herself, using the app, or just rely on the phone’s passcode that she’s changed since the LAST time her mother tried to get into her phone.

But either scenario is just like Alexander’s time. 

Confidential and integrity still matter.

In the Stranger Things Era, the chess moves travel from tin can to tin can along a string. If the girl’s mother, Eve, were to tie another string to the middle, maybe she could intercept the conversation, but she’d still have to crack the code.

In the present day, chess moves travel from phone to phone through an app that uses an internet connection. The moves can be discovered if not encrypted or the entire phone could be breached if Alice’s mother discovers the right passcode (say if she had used something easily known, like her own birthday). 

What Alice and Bobby care about is keeping the game secret from Eve — they want confidentiality and they want integrity, just like Alexander. We’ll come back to both examples throughout the series.

![InfoSec Separator 2](https://images.ctfassets.net/23aumh6u8s0i/10fK6PRBFsiPJ1VStd7sKB/7d4db42a36c6aa67290ca15e9f3c7f9b/infosec-separator-2)

## The Pizza Approach to InfoSec Decisions — Next Post

Now once that we’ve secured the information, we can get into who needs to use it, who has a right to use it, and why. And for that, we’ll take a look at “Please Do Not Throw Sausage Pizza Away” and why this is the phrase that tells you all you need to make effective InfoSec decisions, but that’s for the next post.

<include src="asides/AboutAuth0" />


The Alexander the Great Guide to InfoSec for the C-Suite

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to protect customer data from internal and external attacks



On September 30, [American Express sent letters](https://media.dojmt.gov/wp-content/uploads/Consumer.pdf) to some of its cardholders, informing them that their personal information had been improperly accessed by a former employee, who apparently tried to use that data to open fraudulent accounts at other financial institutions. Amex has not disclosed how many accounts were compromised but told victims that their account numbers, addresses, dates of birth, and Social Security numbers had been stolen.

While the full scope of this crime is not yet clear, the implications are potentially serious, and not just for Amex. Incidents of data theft and mismanagement are on the rise—just days after the Amex story broke, [Twitter found itself](https://www.forbes.com/sites/emmawoollacott/2019/10/09/twitter-inadvertently-gives-user-security-data-to-advertisers/#29e3e2ea5f63) embroiled in its own user data scandal—and the costs are mounting.

These costs can take the form of lost revenue, lost customer trust, fines issued under new data privacy laws, and the increasing potential for credentials stolen in one attack to be used against other businesses.

Corporate titans such as American Express can weather the storm of a data breach, but SMBs can ill-afford the cost of a breach on their revenue and reputation. Yet despite the risks, many SMBs drastically underestimate the cost of a breach. [According to AppRiver's Q3 Cyberthreat Index for Business Survey](https://www.appriver.com/cyberthreatindexforbusiness/), 67% of respondents estimated a breach would cost less than $25,000. In reality, the average cost is $149,000.

Executives in every industry should take note of this breach and use it as an opportunity to examine their own data security. With that in mind, let’s take a look at what we know about the American Express data theft, how businesses can protect themselves from employee malfeasance, and the potential for stolen data to lead to further breaches

![Image of a credit card secured by a lock](https://images.ctfassets.net/23aumh6u8s0i/3dRPHqHpQRLsWibR1AWvgd/f67cb7415472656e0b9206f5bc071249/credit_lock)

## The Facts (So Far) about the Amex Breach

According to American Express, the employee accused of using cardholder data for identity theft no longer works for the company and is under investigation by law enforcement.

In its letter, Amex assured victims that they won’t be liable for fraudulent charges and offered two years of free Experian identity monitoring. (Ironically, to use that service, victims must disclose their SSNs and addresses to Experian, and some customers may feel uncomfortable trusting that information to credit monitoring services in the wake of the [Equifax breach](https://www.teampay.co/insights/b2b-fraud-schemes/).)

It bears mentioning that this [isn’t the first time](https://www.theregister.co.uk/2016/03/17/american_express_cardholder_data_breach/) American Express customers have had their personal information compromised. However, this breach is somewhat unusual in that it isn’t the result of [accidentally exposed data](https://www.pymnts.com/news/security-and-risk/2018/american-express-india-database-data-breach/) or a malicious intruder posing as a trusted third party but of an actual employee improperly accessing sensitive information.

## How Businesses Can Protect Themselves from Employee Fraud

American Express hasn’t revealed whether the employee responsible for this breach had the appropriate credentials to access unencrypted customer data or how they copied that data for their personal use. Whatever the specific circumstances, identity professionals know the most effective tactics for deterring employee fraud are carefully controlling and monitoring access to sensitive data.

![An image of a consumer using his credit card to buy online](https://images.ctfassets.net/23aumh6u8s0i/5qKdbPEP8YnwRPYcXwTE0x/a5f28025bbad3b6efd01988f2ef393da/creditcard)

[Cloud Identity and Access Management (IAM)](https://auth0.com/learn/cloud-identity-access-management/) is an effective way for cloud-based enterprises to manage access to resources. A good cloud IAM solution functions as a single, centralized resource for admins to grant access to data. With the flip of a switch, you can assign permissions based on what an employee needs for their current task and then revoke it when that task is completed, so valuable information is exposed as little as possible.

All cloud IAM solutions aren’t created equally, however, and you should look at one that lets you proactively keep an eye on employees and identify suspicious behavior. In its report on MFA for e-commerce, [NIST specifically recommends](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that businesses “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.”

[Auth0’s dashboard](https://auth0.com/docs/dashboard) gives you a comprehensive, bird’s-eye view of user behavior, including customers, third parties, and employees.

[Using Auth0’s Rules](https://auth0.com/docs/rules), you can configure your dashboard to alert admins in the event of suspicious behavior, which you can define according to your needs. For example, you might want to be alerted if an employee continually tries to access sensitive resources unrelated to their work or logs in from a new device or at an unusual time of day.

## Guarding against the Ripple Effects of Data Breaches

The American Express data breach is unlikely to be the last scandal involving credit card companies since they are such high-value targets for thieves. But executives across every industry should understand that breaches such as this don’t just harm the individual company involved; they threaten the entire e-commerce landscape.

Data breaches like this have a spillover effect since hackers often use data stolen in one breach to impersonate users on other sites, a type of attack known as [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). The best protection against this is [multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication). MFA requires users to prove their identity via means that are more difficult to fake than simple data, such as a fingerprint scan or a one-time code sent to a personal device.

Auth0’s MFA comes with the added security of [breached password detection](https://auth0.com/breached-passwords). Auth0 keeps a constantly updated collection of breached credentials and alerts users if their login information may have been compromised.  

## Don’t Be the Next Casualty of an Amex-Style Breach

For executives, there are already valuable lessons to be learned from the American Express data breach. However, those lessons are unlikely to comfort the victims of this breach or restore their faith in their credit card company. So for now, one truth about this attack is already abundantly clear: when it comes to customer data, it’s better to invest in vigilance than damage control.

<include src="asides/AboutAuth0" />


What the American Express Data Breach Should Teach the C-Suite

Chief Financial Officer and Chief Product Officer join company to support hypergrowth


**BELLEVUE, Wash., Sept. 17, 2019 —** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced Barry Plaga as chief financial officer (CFO) and Shiven Ramji as chief product officer (CPO), two key appointments to the senior leadership team.

[Plaga](https://www.linkedin.com/in/barry-plaga-97204b14/) joins Auth0 as a seasoned CFO with more than two decades of experience overseeing financial and operational functions. Previously, Plaga served as the CFO and COO of Guidance Software, where he oversaw the financial planning, accounting, and treasury functions of the company worldwide, as well as managing investor relations, IT, legal, and operations.

As CPO, [Ramji](https://www.linkedin.com/in/shivenramji) will guide Auth0's product vision, innovation, design, and strategy, and brings more than 15 years of experience in B2B and B2C product management, and business development. Before joining Auth0, Ramji served as the SVP of Product at DigitalOcean, where he led the strategy of DigitalOcean's products, pricing, and partnerships.

"Barry and Shiven bring incredibly deep experience and a proven history of taking fast-growing technology companies to the next level," said Auth0 CEO and co-founder Eugenio Pace. "We are very excited to welcome them to the team, and will leverage their collective expertise to propel Auth0 through its next phase of growth."

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Meghan Gardner<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)


"c suite"