annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

Here’s how you can protect your customers, your employees, and yourself



Do you remember the last time you fell, or almost fell, for a phishing email? I do.

I received an email notification while I was checking my phone: “Unlock your Amazon account”, apparently coming from an amazon.com address. Although unexpected, it was feasible, I had made a purchase on Amazon recently and had changed settings that could have locked the account. 

Concerned, I opened the email.

The design matched Amazon’s style, there were no typos, and my phone’s email app interface just showed me the sender’s name rather than their email. I inspected the link and noticed it was fake.

It was one of the best phishing emails I’ve received in recent times. It managed to make me feel concerned while reading it. That’s the key.

Phishing is both simple to implement and effective. A relatively low-effort attack that can have a high reward. According to Verizon’s [2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf), attackers used phishing in 22% of the investigated breaches. The quality of the attacks varies: we can go from the obviously fake, to sophisticated spear phishing campaigns that are fully customized.  

The most effective phishing emails are typically those that tap into strong emotions that drive action. In “[Thinking, Fast and Slow](https://www.amazon.com/dp/B00555X8OA/ref=dp-kindle-redirect?_encoding=UTF8&btkr=1)” Daniel Kahneman, Nobel Prize of Economics, proposed that humans have two modes of thought "System 1" which is fast, instinctive and emotional, and "System 2" which is slower, more deliberative, and more logical. Humans feel before we think. We are emotional beings.   

![phishing-separator-1](https://images.ctfassets.net/23aumh6u8s0i/4fRwjLa60geXQsStXAkFkv/b350326d596f0fdca3a5d650b9e35933/phishing-separator-1)

[Coronavirus presents a wonderful opportunity for cybercriminals to exploit our emotional selves](https://auth0.com/blog/coronavirus-and-cybersecurity-how-your-business-can-stay-safe/), “System 1”, much easier. It’s a situation that’s intrinsically concerning, and that demands a high level of engagement to stay updated with the latest alerts and announcements. Imagine the spectrum of campaigns that would tap into a strong emotion:

* Concern / Fear: Infected near you, new negative effects, tracking apps
* Curiosity: remote work, fake cures or vaccines, meeting requests, refunds, fake package delivery
* Despair / Necessity: Medical equipment, financial aid
* Compassion / Kindness: Charitable contributions

Imagination is the limit. 

## What’s the Landscape as of May 2020?

The [COVID-19 Cyber Threat Coalition](https://www.cyberthreatcoalition.org/about-us/our-mission), a coalition of cybersecurity experts working to protect individuals and organizations from COVID-19-related cyber threats, releases weekly threat advisories. Phishing appears constantly in these posts, as it’s one of the most prominent threats organizations face.

The phishing landscape has changed significantly since the pandemic started. Shortly after COVID-19 was officially declared a pandemic by the [World Health Organization (WHO)](https://www.who.int/) on March 11th, registrars saw a spike in COVID-19 related domain name registrations, with a peak of around 5000 high-risk domains registered per day in the week of March 16th. 

This number has gradually decreased since then, especially after domain registrars were requested to [increase scrutiny around COVID-related sites](https://www.zdnet.com/article/new-york-asks-domain-registrars-to-crack-down-on-sites-used-for-coronavirus-scams/) by the New York Attorney General.

![phishing-graphic](https://images.ctfassets.net/23aumh6u8s0i/3AwdeH8uutY4HUEDiZqn1b/ac8a8ac47f023ab5219a96729b2ae318/phishing-graphic-2)
<p align="center">Source: DomainTools</p>

However, as per the latest [advisory from the Cyber Threat Coalition](https://www.cyberthreatcoalition.org/advisories/2020-05-20-weekly-threat-advisory-domain-trends), it seems that the domain registrations shifted to the latest trend in the pandemic: masks. 

[Google’s threat analysis group reported](https://www.blog.google/technology/safety-security/threat-analysis-group/findings-covid-19-and-online-security-threats/) that they’re detecting 18 million malware and phishing Gmail messages per day related to COVID-19, with health organizations and health agencies becoming targets as a result.

## What Can We Do to Protect Ourselves And/Or Our Companies From This Constant Threat? 

Phishing attacks tend to have one of these three main goals:

1. **Credential Theft**

    Typically involving a link that sends the user to a fake look-alike website that requests credentials to login. 

    If the account is not properly secured with methods like [Multi-Factor Authentication](https://auth0.com/docs/mfa) (MFA), the credentials obtained could result in an account takeover. The compromised account could then be used to access internal systems, which could cause a data breach that could have compliance-related consequences as per the relevant data privacy laws such as [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA).

2. [**Business Email Compromise**](https://shorturl.at/uFRU4)

    Often involving impersonating an executive to trick someone into transferring funds or buying gift cards. This could have a high financial cost to the organization if it succeeds.

3. **Malware Delivery**

    Usually involving downloading an infected document, or app that can cause a high impact disruption, like what happened with the [WannaCry ransomware attack in 2017](https://www.malwarebytes.com/ransomware/)

These goals can help us categorize the preventive measures we can take: 

![phishing-separator-2](https://images.ctfassets.net/23aumh6u8s0i/7Iis51GXOCFk18pBQBYkAk/dd3f1697da3627feb86af6643a3afc4c/phishing-separator-2)

### Security Awareness 

Empowering users to detect and report phishing attacks helps protect the organization no matter the type of phishing. It also helps the security team react faster thanks to their reports. We’re providing [a free user awareness guide]( https://cdn.auth0.com/blog/phishing/user-awareness-guide.pdf) to help you raise awareness internally, and we’ve released some of our [internal phishing training in our YouTube channel](https://youtu.be/lyF8I-xzZ_k) voiced by someone you would not expect 😉

<iframe width="660" height="315" src="https://www.youtube.com/embed/lyF8I-xzZ_k" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

We wouldn’t recommend doing fake internal phishing campaigns using Coronavirus as bait since it can be too distressing in this situation, and it may hurt trust within your organization. We would recommend rolling out awareness material constantly, explaining what the communication style is in the organization, sending alerts, or sharing examples of real phishing emails transparently, not as a test campaign.

### [Multi-Factor Authentication](https://auth0.com/docs/mfa)(MFA)

MFA protects your employees from an account takeover in the event of credential theft. Implementing it and rolling it out is very easy with Auth0.

### Endpoint Protection

Antivirus solutions can protect your employees in the event of malware. There are plenty of options for the enterprise, so choosing one that fits your organization and culture will boost your defenses with minimal disruption.

### Verification Processes for Payments and Invoices

Establish an internal verification process that requires multiple people to approve a payment or expense before wiring the money, and define specific methods to do so (e.g., no gift cards)

On top of all of this, it’s key to have an easy way for your users to be able to report these attacks to your IT or Security team, such as a dedicated corporate email address, and that the team can [efficiently respond to these reports](https://auth0.com/blog/how-auth0-automates-phishing-response/).

**How can you stay updated on the latest COVID-related phishing trends?**

Here’s where you can more closely monitor the situation as it evolves:

* [FBI alerts](https://www.fbi.gov/coronavirus)
* [Cyber threat coalition](https://www.cyberthreatcoalition.org/): weekly advisory and town hall, IP blocklist, community
* [CISA (US)](https://www.us-cert.gov/ncas/alerts) and [NCSC (UK)](https://www.ncsc.gov.uk/) alerts

Phishing is an ever-evolving threat that’s constantly present for most companies across all industries, and for most end-users alike. Whether it’s a generic bait, or a message adapted to the circumstances of the moment, like COVID-19, tax filing season, or Black Friday, it’s almost guaranteed to be a threat to consider at all times for companies of any size. Rather than being overwhelmed by the challenge, training employees, creating and sharing clear processes, and enabling measures like enforced MFA can be the difference between a bad data breach and creating a resilient organization with the ability to adapt in an evolving threat landscape. 

<include src="asides/AboutAuth0" />


Phishing Goes Viral: COVID-19 Themes in Cybercrime

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

How the economy, kubernetes vulnerabilities, and consumer complacency could equal more regulation.



Some argue that the [_number of reported data breaches in 2018_](https://www.forbes.com/sites/kateoflahertyuk/2018/12/19/breaking-down-five-2018-breaches-and-what-they-mean-for-security-in-2019/#735992841c4f) is the result of [_GDPR_](https://auth0.com/gdpr/)’s requirements. Still, the cascade of recent breach reports suggests that 2019 might be a tough year for cybersecurity. I asked our [_CISO/VP of Operations Joan Pepin_](https://www.linkedin.com/in/joanpepin/) and [_Security & Engineering Operations Director Duncan Godfrey_](https://twitter.com/duncangodfrey) about what we might expect.

<include src="TweetQuote" quoteText=".@auth0’s @CloudCISO_Joan and Security & Ops Eng. Dir. @duncangodfrey share their Top 5 Cybersecurity Predictions for 2019."/>

![Reduced Security Spend Will Lead to Economically Motivated Cybercrime](https://images.ctfassets.net/23aumh6u8s0i/45sm4mVBhnx0sbpZGkzhUg/fd99c7aaa6f3e407989cca122cc6ddd7/reduced-security-spending)

## 1. Reduced Security Spend Will Lead to Economically Motivated Cybercrime

[_Economic indicators in the US and globally do not look good_](https://www.theguardian.com/business/2018/sep/13/recession-2020-financial-crisis-nouriel-roubini), with tech companies having borne the brunt of recent market corrections, says Auth0 CISO/VP of Operations Joan Pepin. “I predict that 2019 will be a difficult year for security funding, and companies across the spectrum will freeze or reduce Information Security spending. An increase in economic hardship and a reduced defensive posture will therefore probably lead to more economically motivated cybercrime in 2019.”

![Information Warfare Around the Globe](https://images.ctfassets.net/23aumh6u8s0i/1Cug9bge9KqWfBDXABTtkq/80a2b903b524834e70397a3a4489972e/information-warfare-around-the-world)

## 2. Information Warfare to Target U.S. Companies, Specifically Defense and Communications

“[_We may be entering a new cold war with China_](https://www.washingtonpost.com/opinions/the-us-and-china-are-on-the-brink-of-cold-war-20-this-is-how-to-avoid-it/2018/11/29/24105fb6-f409-11e8-aeea-b85fd44449f5_story.html), as the trade war continues, now inflamed by actions taken against Huawei by Canada and the US,” says Joan. “I expect this to lead to increased cyber activity by the already rather active Chinese government, which may expand its operations to include more Russian-style disinformation and [_information warfare_](https://auth0.com/blog/information-warfare-offensive/). Look for major U.S. companies, especially large defense and communications providers to be the targets of this activity in 2019.”

![Kubernetes Vulnerabilities Lead to the Year of the Big Container Escape](https://images.ctfassets.net/23aumh6u8s0i/PNPKw8C7NEczARd71Ypg4/e46d0c07b0a306f2093ad3605ee4339e/kubernetes-vulnerabilities)

## 3. Kubernetes Vulnerabilities Lead to the Year of the ‘Big Container Escape’

When [_ZDNet reported a major security vulnerability with Kubernetes containers_](https://www.zdnet.com/article/kubernetes-first-major-security-hole-discovered/) early in December 2018, they noted that “[_Kubernetes_](https://kubernetes.io/) has become the most popular cloud container orchestration system by far, so it was only a matter of time until its first major security hole was discovered.”

That nothing in software is perfect is accepted news for devs and enterprises, but it’s also becoming an accepted thing for consumers (see prediction #4).

The Kubernetes privilege escalation flaw is a big deal, but it’s only the latest in the system’s [_discovered flaws_](https://www.twistlock.com/labs-blog/deep-dive-severe-kubernetes-vulnerability-date-cve-2017-1002101/), says Auth0 Security & Engineering Operations Director Duncan Godfrey. “Continued vulnerabilities to be found in Kubernetes infrastructure and the big one in 2019 is the Year of the Container Escape.”

![Cybercrime Accepted as Cost of Doing Business by Consumers](https://images.ctfassets.net/23aumh6u8s0i/foaom10ipH3jQBufHbbSc/c38ec328a63d0cc4ad50eb0a20639441/cybercrime-accepted-as-cost-of-doing-business)

## 4. Cybercrime Accepted as ‘Cost of Doing Business’ by Consumers

Despite multiple open investigations into [_Facebook’s series of breaches and sharing of personal data with other corporations without users’ permission_](https://www.nytimes.com/2018/12/18/technology/facebook-privacy.html), Joan doesn’t predict a permanent impact for the company — because consumers are reacting more like businesses (and Facebook’s attorneys will do their jobs).

Joan offered an example from her years as an outsourced security provider for an incident response company for Fortune 100 and Fortune 500 companies.

A major investment bank was having a massive issue of being dossed and having public-facing servers being breached. While on a conference call with all their vendors, including Cisco and Checkpoint and 30 bank vice presidents, the bank’s CTO said he had one question: “Is this happening to anybody else?”

Before Joan answered, she asked if he was going to divert the team to answer the question and if the answer was “yes,” what did he plan to do differently? He said if the answer was “yes,” he would “feel better” — a prime example of an enterprise settling into the cost of doing business online (although whether or not he needed to accept that particular cost could be debated).

“Having your identity stolen is horrifying for the individual, but my observation is that it’s perceived differently when lots of people are affected. After a breach, people don’t change their habits. People still shop at Target, stay at Marriott, and share information on Facebook. I’m not a psychologist or neuroscientist, but these facts lead me to believe that the trend of consumers accepting cybercrime as a cost of being online will continue into 2019.”

Because companies are not economically motivated to change and consumers may not feel empowered (let’s face it, [_the tiny payout from a class-action lawsuit_](https://www.consumerreports.org/data-theft/class-action-lawsuits-against-marriott-data-breach/) won’t pay for the damage and heartache of having your identity stolen), Joan expects regulators to step in, which leads us to Prediction #5.

![Expect More Data Privacy Regulation in 2019](https://images.ctfassets.net/23aumh6u8s0i/3rJMQ4kQiwVdRbwXuyouCj/dac8b3d32b2c2c2e3cba383fd02dba10/more-data-privacy-regulation)

## 5. Expect More Data Privacy Regulation

Shortly after the [_Marriott Mega Breach_](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/), the [_UK, the FBI, and three U.S. states opened investigations_](https://www.forbes.com/sites/thomasbrewster/2018/12/03/revealed-marriotts-500-million-hack-came-after-a-string-of-security-breaches/#13788844546f). The Marriott stock dip identified in many news stories, parallels that of the U.S. stock market, says Joan. Fines can function as a partial deterrent, but investigation and regulation move at a much slower pace than the agile tech lifecycle — the business consequence often lags far behind the technological changes needed.

GDPR is delivering an increase in reported breaches, but not clearly within the regulation’s [_72-hour breach-reporting requirements_](https://www.cnbc.com/2018/10/02/facebooks-muddy-account-breach-response-could-be-the-new-norm.html) and recent regulation in Australia demonstrates more than a sync problem — the way that [_Australia’s new backdoor requirements_](https://www.wired.com/story/australia-encryption-law-global-impact/) are written cripple tech’s ability to function securely, says Joan. [_Recent U.S. Senate hearings_](https://thehill.com/policy/technology/420838-google-ceo-responds-to-steve-king-concerns-about-granddaughters-iphone) demonstrate that many of the legislators in charge of regulating tech require greater understanding and education.

The answer, says Joan, would be for the tech industry to have greater input into educating those in charge of the regulations, followed by rational debate, and empowered law enforcement.

Regardless of whether or not the tech industry can influence these ideal conditions, [_all signs suggest we should expect greater regulation in the U.S. in 2019_](https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/12/03/the-cybersecurity-202-senators-call-for-data-breach-penalties-tougher-privacy-laws-after-marriott-hack/5c0436431b326b60d12800d2/?utm_term=.e0c757791fde).

<include src="TweetQuote" quoteText="The economy, kubernetes vulnerabilities, and consumer complacency could equal more regulation in 2019 says CloudCISO_Joan and Security & Ops Eng. Dir. @duncangodfrey."/>

<include src="asides/AboutAuth0" />


Top 5 Cybersecurity Predictions for 2019

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Invest in cybersecurity insurance, steer clear of email money transfers, and improve your data and identity management.




In June 2018, the Memphis-based real estate company Crye-Leike found itself embroiled in an international online fraud scheme. Eight people were caught stealing nearly $15 million from the firm. Evidence later emerged linking them to phishing scams.

Crye-Leike is not alone. In 2017, the FBI warned of a large spike in cyberattacks specifically targeting real estate companies. They noted that fraudulent real estate transactions jumped 5,000%, from [$19 million](https://www.cyren.com/blog/articles/cybercriminals-see-real-estate-firms-as-profitable) in 2016 to nearly $1 billion (US $969M) in 2017. 

The FBI also saw inbound complaints of cyberattacks related to real estate jump [480%](https://www.cyren.com/blog/articles/cybercriminals-see-real-estate-firms-as-profitable) between 2016 and 2017. 

What makes real estate so alluring and easy to hack? 

In 2017 Zillow valued the U.S. real estate market at [$31.8 trillion](https://www.housingwire.com/articles/42176-value-of-us-housing-market-climbs-to-record-318-trillion) (1.5x the value of the nation's GDP). Real estate tech is also one of the fastest growing tech sectors. High-value areas often draw criminals.

![Ocean’s 8 Film Steals $4 Million at Theater's Box Offices](https://images.ctfassets.net/23aumh6u8s0i/2xuXCFmyUEund3YONGKwNe/ee9ad7f1260a160cf125eb615dd57a33/oceans-8)

([Source](https://www.thewrap.com/oceans-8-steals-4-million-at-thursday-box-office/))

With real estate in particular, no federal law mandates that businesses have to implement information-security programs (like banks and hospitals do). This has resulted in companies with exceptionally vulnerable systems. 

A recent survey showed that [50 percent](https://www.nreionline.com/technology/top-five-cybersecurity-threats-real-estate-businesses) of real estate companies do not have sufficient resources to prevent or even mitigate a cyberattack. The industry has fallen behind.

This piece will break down ways that real estate firms can come up the curve and protect their sensitive information.

## 3 Ways To Brace Your Team Against Cybercrime

### 1.) Invest in cybersecurity insurance.

The average cost of a data breach topped [$3.8 million](https://www.forbes.com/sites/niallmccarthy/2018/07/13/the-average-cost-of-a-data-breach-is-highest-in-the-u-s-infographic/#5b3d9ea72f37) in 2018—and [small businesses remain particularly vulnerable](http://blog.idonethis.com/security-ringcaptcha/). While many real estate companies are large corporations, others are still local and family-run and have been working with the same systems for generations. 

Costs to recover from a breach (e.g., additional PR for damage control, IT spending, and nonfinancial damages like decreased brand reputation or having to fire an executive) are often more than companies can handle.

Real estate teams have insurance for natural disasters — why not for cyber disasters? 

Cybersecurity insurance (or cyber liability insurance) is stand-alone coverage that helps mitigate loss from a security incident. With the number of breaches and the volume of exposed personal records escalating every year, no organization is safe.

With cybersecurity insurance, many major providers, like AIG and Chubb, can help reduce the effects of the following:

* Damaged or stolen data and software
* First-party costs, such as event management, data restoration, and network interruption
* Lost business opportunities
* Extortion (in the event a hacker holds data for ransom)
* Money stolen through false requests or other methods

Nearly all insurance plans are customizable and offer options to further insure the customers or vendors whose information was exposed or taken. 

A data breach never looks good, but being able to reimburse your customers will go a long way toward maintaining their trust and retaining them going forward.

### 2.) Never conduct and confirm wire transfers by email.

Business email compromise (what Crye-Leike sustained in 2018) is a common method for hackers targeting realtors. 

In 2017, one couple in Washington, DC, [lost $1.5 million](https://wamu.org/story/17/08/08/hackers-allegedly-steal-1-5-million-d-c-couple-home-buying-phishing-scheme/) in such a scam. They received a request to wire the title company money for their home at a different address. After re-directing the funds, the couple learned that the company didn't even know about this new request. It was a false organization.

Business email compromise in the form of a bucket brigade attack, also known as man-in-the-middle (MITM) attack, is often very difficult to detect. If they're well designed, they're nearly indistinguishable from routine forms:

![DocuSign Phishing Scam Example](https://images.ctfassets.net/23aumh6u8s0i/73bcOarUqgNmdCPFBAGynZ/6dcb94787e351fb420d9ec22049f581d/docusign)

([Source](https://activerain.com/blogsview/5056521/docusign-scam))

This DocuSign spam email is formatted to look legitimate and includes correct names and dates for context. If an employee is in a rush, it's easy to simply sign without careful scrutiny. 

Recently, hackers have been gaining illegal access to real estate professionals’ email accounts to get information about impending transactions, according to reporting from [WAMU](https://wamu.org/story/17/08/08/hackers-allegedly-steal-1-5-million-d-c-couple-home-buying-phishing-scheme/). If a deal has closed, the hackers often reach out to the buyers while impersonating the real estate company and request that they wire funds to a new address—a similar pattern to what the couple in DC suffered. Buyers end up sending down payments to fraudulent accounts. 

To stay safe from phishing scams, tell your customers that they should never wire funds through email. If they have questions, have them reach out to you directly. 

### 3.) Use a cloud security platform.

While a subset of the real estate industry (tech firms like [Homespotter](http://blog.homespotter.com/), Redfin, and Cadre) is already digital, many traditional shops still rely on printed paper, physical filing systems, and outdated hard drives. This leaves critical data ripe for theft or vulnerable to simply being lost or damaged.

[Moving your data to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/) brings numerous advantages, such as the following:

* Distribution (no single point of potential failure)
* A more stable back end, with multiple backups
* Greater capacity for insight into irregular behaviors

Teams across the board, whether in real estate or other sectors, like [retail](https://auth0.com/retail), [media](https://auth0.com/media-publishing), and [finance](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), are dealing with larger volumes of customer information. Names, email and physical addresses, phone numbers, genders, locations, devices, and even race and religion are valuable in creating more-targeted marketing materials and personalized communications. As teams collect and process more of this data, their repositories are ripe for theft if they don't have the proper security.

Some digital security teams deliver robust identity management solutions that make sure you know who's working within your system at any time. [Auth0](https://auth0.com/), for example, provides a dashboard that allows users to monitor customers logged into their accounts, consultants authorized by a company, and even its own employees. You never know when a hacker is impersonating a user you know and attempting to access sensitive data.

![Auth0 Dashboard and How to Implement MFA and Other Security Features](https://images.ctfassets.net/23aumh6u8s0i/5kLCr8wuGuyrW6HiP8xpzs/06121d1e514fa5fbe6e59df8995f73b8/auth0-dashboard)

Even teams that operate digitally can be scattered, with data in many different locations—not to mention a [mobile workforce](https://www.teampay.co/insights/tools-for-managing-a-remote-workforce/) logging in from all over the world on various devices. The dashboard allows admins a centralized view to better understand what's happening across the board. You can view current and new active users, compare their current and historical behaviors, and even use the tool to quickly block or communicate with users you think are out of line.

Shifting to a cloud security platform will open up a range of new possibilities for organization and security.  

## There's No Better Time to Improve Real Estate Security 

You can't control hackers' behavior. Even the largest corporations with the most robust security systems are vulnerable. But you can control your own security plan. Investing in cybersecurity insurance, educating your employees about email scams, and bolstering your digital and identity-management infrastructure are all important steps you can take to ensure that you and your customers will be able to recover if a breach occurs.

<include src="asides/AboutAuth0" />


Real Estate Security is More Important Than Ever: 3 Ways To Brace Your Team Against Cybercrime

Our IAM Platform Noted as an Innovative Defense Against Rising Tide of Cybercrime


We believe that fighting cybercrime can begin with your IAM solution.

Looks like Cyber Defense Magazine agrees.

<p align="center">
<img src="https://images.ctfassets.net/23aumh6u8s0i/63ziNMNUXpt5DsNRF5MetE/5c72a79756dd2e7e6b0c74971112017d/winner-logo.png"
  alt="Auth0 Wins InfoSec 2018 Editor's Choice Award">
</p>

Today they announced the winners of their [2018 InfoSec Awards](http://www.cyberdefensemagazine.com/infosec-awards-2018-winners/), naming Auth0 as “Editor’s Choice” for Identity and Access Management. Reaching a growing audience of more than 1.2+ million, Cyber Defense is considered a premier source of IT Security Information.

“With Cybercrime continuing to gain momentum, surpassing global drug crime last year and reaching over $600B in theft and damages, we are proud to see Auth0 as an award-winning innovator, offering a new approach to defeat these criminals,” said Pierlugi Paganini, Editor-in-Chief, Cyber Defense Magazine.

Nearly 3,000 companies globally competed for InfoSec recognition in categories ranging from _Advanced Persistent Threat to Wireless, Mobile, or Portable Device security_. To narrow the selection to just 200 winners, Cyber Defense looked for innovation, as well as ability and drive to help customers “get ahead of the next data breach.”

_“Auth0 takes security and identity and access management seriously,”_ said Auth0 CISO Joan Pepin. _“In this evolving cyber crime environment, we will continue to keep our focus on innovating to address the latest attacks. Our main concern is producing secure, high-quality products for our customers and their customers.”_

You can find more cutting-edge knowledge, real-world stories and awards on the best ideas, products, and services in the information technology industry, from Cyber Defense’s [free online magazine](http://www.cyberdefensemagazine.com/) or pick up a limited print edition exclusively for the RSA conferences and paid subscribers.

If you’d like to know more about how Auth0 can help safeguard you and your customers with our secure Identity-as-a-Service platform, please reach out to [sales@auth0.com](mailto:sales@auth0.com).


"cybercrime"