Aliyah Winfrey

I'm Aliyah Winfrey, a staff design researcher who’s passionate about creating clarity and alignment in complex research spaces. I thrive on asking the right questions and uncovering insights that drive meaningful design. Outside work, I tend to my garden, experiment with new baking recipes, or get lost in a classic PS2 game.

Staff Design Researcher

Exploring the evolving tech/identifier trends, needs, and behaviors of a global audience

As an advocate for developers and a company that trusts the developer community, we are open-sourcing this survey data to foster dialogue, innovation, and shared learning. By making these insights publicly available, we invite researchers, developers, and CIAM leaders to analyze and build upon our findings. Understanding global digital identity trends requires diverse perspectives, and an open-source approach allows for an informed and equitable discussion. 

Digital technologies continue to change human interactions, shaping global attitudes toward identity, security, and new technological innovations in similar and different ways. Our latest End-User Device & Login Sentiment survey highlights key trends in digital identity preferences, authentication methods, and security concerns. This survey and high-level takeaways contribute to the broader discourse of technology, CIAM, and an evolving general population market. Please find details on the purpose, audience, and collection below:

## Purpose

Understand the general population of global users' evolving technology needs and behaviors to identify key trends and shifts. The following Key topics were covered: 

**Device/OS usage**

* Personal vs. Work device usage 
* Device registration preference
* Work application usage

**Attitude towards technology**

* Overall tech familiarity 
* Hardware update motives
* Frequency of technology updates

**Identifier preference**

* Identifier familiarity 
* Identifier registration preference
* Perceived vulnerability and convenience 

**Password management**

* Reuse & Change Password
* Compromised PII
* Fraud Check

![Key Topics](https://images.ctfassets.net/23aumh6u8s0i/34N68QuL8Q9JZBT8ql8wXB/218ff72b8716be2887562adb892c3e28/key_topics.png)

### Research Questions

1. Understand current technology devices and usage patterns 
2. Identifying emerging trends in end-user preference 
3. Discover unmet needs and pain points to capitalize on new opportunities, driving innovation and strategic growth

### Target Audience

Partnered with Qualtrics for a 33-question survey in the following regions/countries: EMEA (France & United Kingdom), NAMR (United States & Canada), LATAM (Mexico & Brazil), and India. 

### Sample

**N=1049**

* Age
 * Age 18-23: 19%
 * Age 24-30 19%
 * Age 35-54: 32%
 * Age 55+: 30%
* Region
 * NAMR 25%
 * EMEA 25%
 * LATAM 25%
 * APAC 25%
* Gender
 * Male:48%
 * Female: 52%
* Community Type
 * 1/3 Rural
 * 1/3 Suburban
 * 1/3 Urban
* Household Income
 * Less than $25,000- 5%
 * $25,001 - $50,000- 10%
 * $50,001 - $75,000- 20%
 * $75,001 - $100,000- 30%
 * $100,001 - $150,000- 20%
 * $150,001 - $200,000- 10%
 * More than $200,000- 5%

### Data Integrity 

No personally identifying information (PII) was collected. All responses shorter than 3 minutes (180 seconds) were removed. The median completion time was 6.08 minutes. Participants were compensated for completing the survey. 

Samplings across regions are representative of age and gender distributions. For example, given the larger youth population, more youth aged 18 to 30 were sampled in India. Given the country's demographics, ages ranging from 45 to 59+ were skewed towards EMEA and NAMR. 

Additionally, LATAM skewed predominantly toward the urban community type, EMEA represented much of the rural community type, and NAMR led heavily toward the Suburban community type.

### Regression analysis

![Regression analysis](https://images.ctfassets.net/23aumh6u8s0i/2cF18Iz0eEWlprYHPlHlFR/f21d36a8cb21cabedd6100f1037f7aba/Regression_analysis.png)
_Logistic Regression on survey data was completed to gauge if any response options forecast an individual's Willingness to Try New Identifiers. No substantial evidence indicates these factors are significant predictors._

 
Six low-level predictors for Willingness to Try New Identifiers were identified. These include the following:

1. Attitude towards New Tech
2. Familiarity with Identifiers other than Email and Username
3. How often do individuals update their devices
4. Age
5. Apple-Only OS Owners
6. APAC/India region 

Data was collected in October of 2024. Data is accessible via a[ CSV. file](https://cdn.auth0.com/blog/blog/End-User-Sentiments-Survey.csv).

#### Citation

1 End-User Device and Login Sentiment, Auth0, 2024. [Link](https://auth0.com/blog/digital-identity-what-users-think-about-devices-and-logins/)

## Insights

### Top 10 Learnings 

1. Android Phone and Windows OS more widely adopted across diverse groups: 
 - Adoption more prevalent in LATAM and APAC
 - Android users tend to be lower to middle-household income 
![Android, Windows OS lead in adoption](https://images.ctfassets.net/23aumh6u8s0i/1cz14tdcdDmqEZI5ZBgD9M/15021e7a00fe7d4967d9255f16f99b7d/Screenshot_2025-03-21_at_12.39.11_PM.png)
2. Younger demographics and higher income are more likely to use Apple OS 
 - Apple OS more pronounced in EMEA and NAMR
3. Younger demographics and higher income are more likely to use Apple OS 
 - Positive attitude toward new technology, higher frequency of device updates, and more open to adopting new identifiers
4. EMEA and NAMR are more cautious about approaching new technologies 
 - Preference could be influenced by cultural differences and regulations
![General comfortability with adopting tech once mainstream](https://images.ctfassets.net/23aumh6u8s0i/6LXzCLV1QzEPUbZk2rh5c9/33bea12287c85db2359d9e8990a5bda4/Screenshot_2025-03-21_at_12.29.28_PM.png)
5. Top upgrade motivators are new features, device damage, battery issues, and limited memory. 
 - India/APAC unique concern for social brand preference and security concerns
![New features and de ice damage lead us upgrade motivators](https://images.ctfassets.net/23aumh6u8s0i/7CbnGFomOPj6PfmU4IfzeD/e92edbcce72f7994c1ca55ac4575dfa8/Screenshot_2025-03-21_at_12.30.33_PM.png)
6. Respondents who are more familiar with alternative identifiers (email and username) show higher readiness to adopt new ones. 
 - Apple OS users less likely to try new identifiers 
7. The most familiar and used identifiers include Email, username, phone/SMS, and biometrics. In contrast, the least used and familiar include Blockchain and hardware security keys. 
 - Social login is slightly more prevalent in LATAM and APAC
![APAC lead in familiarity and use for most methods](https://images.ctfassets.net/23aumh6u8s0i/71S0j1xEeG6isV67O1SwkP/4a7cdda42233bd8cc16c2a6a2f5829cf/Screenshot_2025-03-21_at_12.35.26_PM.png)
8. Username, email, and fingerprint are rated as the most convenient across all regions. 
 - EMEA and NAMR seem to be more sensitive to non-conventional identifiers such as government ID, security key, and voice ID, while even social login is ranked neutral. 
![Username, email, and fingerprint rated as most convenient](https://images.ctfassets.net/23aumh6u8s0i/7JSF843aMWSNsNSTxBBF0d/c1e9723a8b0efd52cc02748b81256bf6/Screenshot_2025-03-21_at_12.36.02_PM.png)
9. In contrast, Social Login is perceived as the most vulnerable to hackers and cyber-attacks. 
 - Our recent article, Demystifying Social Login, dives deeper into the security of leveraging Auth0 social connections for end-users. 
![Social Login seen as most vulnerable to cyberattacks](https://images.ctfassets.net/23aumh6u8s0i/7zuPvErvRjmZo3uflHsRdG/49f35a40cc73261e8d7ad06cffba6f8b/Screenshot_2024-12-17_at_10.27.55_AM.png)
10. Security and Privacy priority for motivations to try new identifiers 
 - NAMR and EMEA rank innovation as one of the lowest drivers
![Security and Privacy priority for motivations to try new identifiers](https://images.ctfassets.net/23aumh6u8s0i/3LpGrqWztktMy8Nw1H2lYJ/550ad822c4f8684ef18c2cea1f751d56/Screenshot_2025-03-21_at_12.34.25_PM.png)

> Download the [.CSV data here](https://cdn.auth0.com/blog/blog/End-User-Sentiments-Survey.csv).

Join the conversation! Share your thoughts, repost, and tag us to discuss the future of digital identity.

Digital Identity: What Users Think About Devices and Logins

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby and Python.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

Verifiable Credentials can be stored on digital devices, and you can use cryptography to verify their data and authorship. Let's learn more about them and why you should care about them.

We often use physical credentials such as our passports or driver's licenses as proof of identity. Until recent years, these types of credentials have usually been used in-person or offline, but nowadays, it's possible to prove your identity through digital credentials on the web in a cryptographically secure, privacy-respecting, and machine-verifiable way. In this blog post, you'll learn about these verifiable credentials, why you should use them, and when. 

## What are Verifiable Credentials?

When you think about a credential, you can often think of a physical credential like a passport, a driver's license, or an employee badge. A credential refers to a [set of one or more claims made by an issuer](https://www.w3.org/TR/vc-data-model/#dfn-credential); in the passport example, the photo, name, or identification number are the claims made by a government to identify a subject. 

When we talk about Verifiable Credentials (VCs), we are referring to a [W3C standard](https://www.w3.org/TR/vc-data-model/) for digital, cryptographically verifiable credentials. These credentials can represent the same information as a physical credential, but they add the use of digital signatures, making them more trustworthy than their physical version. You can store them on your device, which makes them more convenient and available almost everywhere. 

In the verifiable credentials context, there are a few important roles:

- **Holder**: it's the entity that possesses the verifiable credential. Holders could be, for example, students, employees, and customers. 
- **Issuer**: the entity that asserts claims about the subject, creates and transmits the verifiable credential to the holder. For example, governments, corporations, and non-profit organizations can be issuers. 
- **Subject**: the entity about which claims are made. For example, human beings, animals, and things. 
  - Often, the holder of a verifiable credential and subject can be the same, but only sometimes. For example, a parent can be the holder of the verifiable credential of their child (subject)
- **Verifier**: the entity that receives and processes verifiable credentials, such as employers, security personnel, and websites.   
- **Verifiable Data Registry**: the system that creates and verifies verifiable credentials schemas. For example, government ID databases and trusted databases. 

![VCs Roles](https://images.ctfassets.net/23aumh6u8s0i/4Gc0xRKUsczAlJ2w7JEh1/22f16ee9cfe9924b4a23f46638646649/vcs.png)

The image above shows how each entity interacts with each other. The issuer issues credentials to the holder as well as identifies and verifies the verifiable credentials. The holder acquires, stores, and presents VCs to the verifier. The verifier verifies VCs against the Verifiable Data Registry, which maintains identifiers and schemas. 

If we think of an example, let's say you are a citizen of the Asgard country. Asgard's government can issue a verifiable credential so you can prove your identity. 

![Asgard country issue VC](https://images.ctfassets.net/23aumh6u8s0i/35vmzFohdAtzKYw0drPXZ7/4a369f5669ef1133b750a9502fe3e8c5/holder-issuer.png)

In this example, the **holder** of the verifiable credential would be you because you are the owner of it and Asgard's government would be the **issuer**. This would be one of those scenarios where the **subject** would be the same as the holder because Asgard's government created claims for you, such as full name, identification number, and so on. 

Later on, let's say the Asgard police stop you and ask you for your ID. You decide to use your VC, and you have it in your wallet, so you **present** it to them. In this case they'd act as the **verifier** and check against Asgard's government database (the **Verifiable Data Registry**) that the VC is legit. 

![Present VC Asgard](https://images.ctfassets.net/23aumh6u8s0i/1SLhpBZvsGcEuJDQypUuqt/ff34ca49671651f75d9b23af70d18885/holder-presenter.png)

## Verifiable Credentials Are Necessary 

Verifiable Credentials have many use cases in our day-to-day life, and as we move more into an online world, [we need to be able to disclose our identity without issuers knowing](https://auth0.com/blog/our-take-on-verifiable-credentials/#The-Reason-We-Believe-VCs-Will-Happen). Because VCs are available in your wallet, you can use them "offline", meaning the issuer doesn't know when and how often you use them. This is what makes VCs so powerful: they are convenient, and having them available in your wallet removes a lot of friction from a user's life. So, let's go ahead and explore some use cases. 

### Legal Identity 

It's essential that you're able to prove your identity in a way that can be quickly verified, and governments are in the position to provide such identification in a verifiable digital form. Some examples are:

- Digital Driver's License
  - You get stopped over a traffic violation; with a digital driver's license, you always have access to it, and you can use it to prove to the officers both your identity and that you can drive. 
- Digital passports 
  - The electronic passport can contain a list of all the places you've visited and visas, so immigration officers can quickly and easily evaluate your suitability when visiting a new country. 
- Proof of Birth
  - Imagine asking for refuge in a country in such desperate conditions that you don't have your physical credentials. Still, you were issued a [self-sovereign](https://en.wikipedia.org/wiki/Self-sovereign_identity) proof of birth, and attached to this is the proof of birth and marriage of your parents; since it's verifiable, you can show this at the border controls of the country you're seeking refuge.

### Finance 

In finance, we can think of banking, brokerage, insurance, etc. Some example use cases are: 

- Money transfers
  - Let's say you want to send money to your family abroad; you can share your identity profile as well as your family member's with the money transfer service. This allows them to verify the source and destination of funds automatically.
- Opening or closing bank accounts 
  - If you want to open an account, you can use your government-issued certificate to prove your identity. Later on, when you want to close the account, the bank needs to revoke the "account owner" claim as part of the closing account process. 

### Healthcare

In the healthcare industry, privacy is extremely important, and with VCs, we can guarantee that the holder of the credential can disclose only the information they need. Let's understand some use cases in this area: 

- Prescribed medicine
  - A pharmacy can receive a prescription for medication for a patient. The pharmacy can automatically verify the doctor's ability to write prescriptions and the patient's insurance coverage. 
- Proving Legal Disability Status 
  - You can have government-issued disability credentials without having to disclose your specific disability to the service or entity you're providing. Issuers can issue verifiable credentials that support [selective disclosure](https://www.w3.org/TR/vc-data-model/#dfn-selective-disclosure) so holders can present proof of claims without revealing the entire verifiable credential. 

### Professional Credentials 

You may need a prove that an entity is who they say they are, and they can do what they say. This allows you to trust universities, doctors, companies, etc. 

- Doctors 
  - Health providers could provide information about the doctors they have on staff, including verifiable credentials about their education, board certification, etc. 
- University Degrees 
  - You could verify someone's obtained degree from a university that has a digital certificate to issue verifiable credentials. 
- Companies 
  - You can have an electronic badge that proves your identity to your company. 


## How Does a VC Look Like?

Let's take a look at what a verifiable credential looks like. Let's think of someone's ID card: 

```json
{
  "@context": [
    "https://www.w3.org/2018/credentials/v1"
  ],
  "type": ["VerifiableCredential", "IDCard"],
  "id": "urn:credential:34502108-4540",
  "issuer": "did:web:asgard-state.auth0lab.com",
  "issuanceDate": "2020-07-20T13:58:53Z",
  "credentialSubject": {
    "id": "urn:id-card:personal:1",
    "personalIdentifier": "34502108",
    "name": "Hanna Herwitz",
    "dateOfBirth": "1984-09-17",
    "placeOfBirth": "Asgard City",
    "currentAddress": "24th Street 210, Asgard City, 1023",
    "gender": "Female"
  },
  "credentialStatus": {
    "id": "https://asgard-state.auth0lab.com/vcs/credential/status/14",
    "type": "CredentialStatusList2017"
  }
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2020-07-20T13:58:53Z",
    "proofPurpose": "assertionMethod",
    "verificationMethod": "https://asgard-state.auth0lab.com/keys/1",
    "proofValue": "z2ty8BNvrKCvAXGqJVXF8aZ1jK5o5uXFvhXJksUXhn61uSwJJmWdcntfqvZTLbWmQHpieyhdcrG43em37Jo8bswvR"
  }
}
```

This JSON represents the digital version of Hanna Herwitz's ID card. Let's take a look at some of the most relevant parts of the VC: 

### Type 
The credential type can be used to determine if a specific credential is appropriate for a particular use case. In the example above, the type value is ` ["VerifiableCredential", "IDCard"]`.

### Issuer 
Represents the issuer of the credential and has to be a URI or an object containing an ID property. The example above is the Asgard government with the value `did:web:asgard-state.auth0lab.com`. Note that the value starts with `did`; this is a [Decentralized Identifier](https://www.w3.org/TR/did-core/), a new identifier enabling verifiable, decentralized digital identity. However, it's not mandatory to use DIDs. 

### Credential Subject 

Refers to the subject of the verifiable credential; it can be a DID or an object containing an id property. In the example above, the subject data is: 

```json
"credentialSubject": {
  "id": "urn:id-card:personal:1",
  "personalIdentifier": "34502108",
  "name": "Hanna Herwitz",
  "dateOfBirth": "1984-09-17",
  "placeOfBirth": "Asgard City",
  "currentAddress": "24th Street 210, Asgard City, 1023",
  "gender": "Female"
}
```

### Cryptographic Proof

It is one of the most essential parts and **what makes this credential verifiable**. Refers to cryptographic proofs (can be an object or an array) that can be used to detect tampering and verify the authorship of a credential or the data derived from the VC. In the example above: 

```json
"proof": {
  "type": "Ed25519Signature2020",
  "created": "2020-07-20T13:58:53Z",
  "proofPurpose": "assertionMethod",
  "verificationMethod": "https://asgard-state.auth0lab.com/keys/1",
  "proofValue": "z2ty8BNvrKCvAXGqJVXF8aZ1jK5o5uXFvhXJksUXhn61uSwJJmWdcntfqvZTLbWmQHpieyhdcrG43em37Jo8bswvR"
}
```

## Verifiable Credentials in Action 

Now that you know what a VC looks like, let's look at them in action. 

We've developed a site, [verifiablecredentials.dev](https://verifiablecredentials.dev), where you can play around and debug verifiable credentials. 


### Issue a VC 

To obtain a new verifiable credential, navigate to [wallet.verifiablecredentials.dev](https://wallet.verifiablecredentials.dev/), where you'll see a demo wallet where you can start by adding your first VC. 

![ID Wallet Add VC](https://images.ctfassets.net/23aumh6u8s0i/5cQaJh6drruR9bx86ZnSAR/3978c6e7e745ac70152a91d00da61f06/Screenshot_2024-01-16_at_13.37.27.png)

Follow the steps, and you'll create your verifiable credential! 🎉

![ID Wallet VC created](https://images.ctfassets.net/23aumh6u8s0i/6S3VrXJpueAeXvqaE3vl05/7042036ccc4d40524cf352a55f224c50/Screenshot_2024-01-17_at_17.30.14.png)

### Present a VC 

You can use the [Presentation Debugger tool](https://verifiablecredentials.dev/presentation) to create a request that defines the characteristics you want a Verifiable Presentation to meet.

You can use ID Wallet to see your verifiable credential data in the Presentation Debugger tool.

![Presentation tool](https://images.ctfassets.net/23aumh6u8s0i/10ykc9VwNiJs2hLDeV6PEI/dfcaac31665344445c3087ff92f7d99b/Screenshot_2024-01-17_at_17.29.27.png) 

## Conclusion 

Verifiable Credentials are digital, cryptographically signed credentials that you can use in many aspects of your life. There are many use cases in healthcare, education, and legal contexts where VCs are extremely useful. 

Users need the means to exercise their identity and disclose their claims without issuers knowing, the same way they do offline. 

If you want to learn more about VCs, go to [verifiablecredentials.dev](https://verifiablecredentials.dev), where you can play around and create and present verifiable credentials.

What are Verifiable Credentials and Why You Should Care About Them

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

"Passkey" is the shorthand for FIDO multi-device credentials, a new technology that makes it convenient to use FIDO's phishing-resistant authentication methods and ceremonies across multiple devices.

Our Take on Passkeys

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Following Apple’s release of Sign in with Apple and iOS13, Auth0 support coming next week



Using third-party or social login services such as Facebook or Google for app login? Apple’s new App Store Developer Guidelines require that if your app exclusively uses a third-party or social login service to setup or authenticate the user’s primary account, the app [must](https://developer.apple.com/news/?id=06032019j) provide Sign in With Apple for your end-users (existing apps and app updates have until April 2020 to be compliant.)

![Sign In with Apple feature landing page mockup screenshot](https://images.ctfassets.net/23aumh6u8s0i/7mvfWW2HPoJ1fAZzJ5wKNc/6d6b119e6ba2723024e5e2875297d56d/hero)

## Smooth Adoption Expected

Once iOS users complete their initial sign-in, they’ll be able to subsequently sign in using the native bio verification mechanisms built into iOS devices like thumbprints and Face ID. When users can do this instead of having to enter a password, we expect this will quickly become the login path of choice.

## Privacy Play

GDPR sparked a [global shift in data privacy](https://auth0.com/explore/data-privacy/). While organizations are thinking harder about the data they store and where it flows, Apple has realized the need to support end-user choices — which is why SIgn In With Apple allows users to obfuscate their real identity from third-parties including app developers.

So if I use Sign in with Apple, and select “Hide my Email”, application developers will not have any personally identifiable information from my login. The application will only recognize me based on a randomly generated email address from Apple that is uniquely identifiable so that Apple can maintain the correct association. 

This causes a slight problem for application developers who rely on email addresses to associate accounts to actual people. Apple has taken a hard stance on this but it is also evolving its identity practices at a rapid pace. Auth0 has kept up with these recent changes and will be releasing a solution that has been beta-tested with actual customers and end-users next week.

If you need Sign In With Apple to do business and you’re doing it yourself, you’re about to touch code — and then every time Apple makes a change, you’ll need to touch it again to ensure that code is keeping pace. The advantage of Auth0 is that we shield you from every change from Apple or other identity providers. Even adding features like multi-factor authentication can easily be switched on with a toggle.

## What’s Coming Next Week

![Sign-in with Apple Flows](https://images.ctfassets.net/23aumh6u8s0i/4Ir5yzLS6BxzCoIXjg8U1a/95e05a6faf160e091ee3a4afc2981c76/siwa-flows)

The General Availability (GA) of our Sign In With Apple integration will include Native flows and Web flows. Web flows have been in [public beta since June](https://auth0.com/blog/try-sign-in-with-apple-in-your-auth0-apps-today/), enabling customers who want to use Sign In with Apple in web applications to try it out. At Auth0, Sign In With Apple will be an out-of-the-box feature — a simple toggle + minimal code.

![Sign In With Apple Has Been In Public Beta Since June](https://images.ctfassets.net/23aumh6u8s0i/3rMC0k1THr4rYHnQ22y2zx/891a90db2e67aed1b0e233a26713139b/social-connections)

Offloading authentication to Auth0 means touching code when YOU want to make a change, not when your identity provider tells you to. And it means you can quickly comply with Apple’s mandate while leveraging the benefits of Face or Touch ID and eliminate the need for usernames/passwords.

With 1.4 billion iOS devices already in the market and nearly two million apps competing for iOS users’ attention this change could be a big deal — if Auth0 didn’t already have you covered.


Ready for 1.4 Billion iOS Devices?

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Learn how to address the risks that today’s top mobile security threats pose to your organization.

Mobile initiatives are a top priority for many organizations these days because research shows that increases in mobility help enterprises [improve operations](https://cdn2.hubspot.net/hubfs/1789978/Content%20Offers/enterprise-mobility-trends-report-2020.pdf) and [productivity](https://insights.samsung.com/2016/08/03/employees-say-smartphones-boost-productivity-by-34-percent-frost-sullivan-research/).

However, increases in organizational mobility typically result in an increase in the number of mobile devices that are accessing your systems from a remote location. And for your security teams, this means a growing variety of endpoints and threats they need to secure in order to protect your organization from a data breach.

As in the past, the most common threats to mobile security include mobile malware. However, as Verizon’s [2020 Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf) shows, there are new threats organizations need to consider as well in order to ensure they’re protected.

Below are the most common and critical mobile security threats that organizations face in 2021.

## 4 Different Types of Mobile Security Threats

Mobile security threats are commonly thought of as a single, all-encompassing threat. But the truth is, there are four different types of mobile security threats that organizations need to take steps to protect themselves from:

* **Mobile Application Security Threats.** Application-based threats happen when people download apps that look legitimate but actually skim data from their device. Examples are spyware and malware that steal personal and business information without people realizing it’s happening.
* **Web-Based Mobile Security Threats.** Web-based threats are subtle and tend to go unnoticed. They happen when people visit affected sites that seem fine on the front-end but, in reality, automatically download malicious content onto devices.
* **Mobile Network Security Threats.** Network-based threats are especially common and risky because cybercriminals can steal unencrypted data while people use public WiFi networks.
* **Mobile Device Security Threats.** Physical threats to mobile devices most commonly refer to the loss or theft of a device. Because hackers have direct access to the hardware where private data is stored, this threat is especially dangerous to enterprises.

Below are the most common examples of these threats, as well as steps organizations can take to protect themselves from them.

## 1. Social Engineering

Social engineering attacks are when bad actors send fake emails (phishing attacks) or text messages (smishing attacks) to your employees in an effort to trick them into handing over private information like their passwords or downloading malware onto their devices.

Reports by cybersecurity firm [Lookout](https://www.lookout.com/phishing-spotlight-report-lp) and [Verizon](https://enterprise.verizon.com/resources/reports/dbir/2020/results-and-analysis/) show a 37% increase in enterprise mobile phishing attacks and that phishing attacks were the top cause of data breaches globally in 2020.

![Social Engineering](https://images.ctfassets.net/23aumh6u8s0i/1wPMqUJN6nHgmQTVo4poQz/8b4fea1cb9600bcb1bc5b93f8881d49b/image1.jpg)
<a href="https://www.cybersecurityintelligence.com/blog/it-governance-cyber-security-phishing-awareness-course-180.html">Source</a>


### Phishing Attack Countermeasures
The best defense for phishing and other social engineering attacks is to teach employees how to spot phishing emails and SMS messages that look suspicious and avoid falling prey to them altogether. Reducing the number of people who have access to sensitive data or systems can also help protect your organization against social engineering attacks because it reduces the number of access points attackers have to gain access to critical systems or information.

## 2. Data Leakage via Malicious Apps

As Dave Jevans, CEO and CTO of Marble Security, [explains](https://www.esecurityplanet.com/mobile-security/10-trickiest-mobile-security-threats.html), “Enterprises face a far greater threat from the millions of generally available apps on their employees’ devices than from mobile malware.”

That’s because 85% of mobile apps today are largely unsecured. Tom Tovar, CEO of Appdome, [says](https://technologyadvice.com/blog/information-technology/cybersecurity-trends-2020-byod-mobile/), “Today, hackers can easily find an unprotected mobile app and use that unprotected app to design larger attacks or steal data, digital wallets, backend details, and other juicy bits directly from the app.”

For example, when your employees visit Google Play or the App Store to download apps that look innocent enough, the apps ask for a list of permissions before people are allowed to download them. These permissions generally require some kind of access to files or folders on the mobile device, and most people just glance at the list of permissions and agree without reviewing them in great detail.

However, this lack of scrutiny can leave devices and enterprises vulnerable. Even if the app works the way it’s supposed to, it still has the potential to mine corporate data and send it to a third party, like a competitor, and expose sensitive product or business information.

### How to Protect Against Data Leakage

The best way to protect your organization against data leakage through malicious or unsecured applications is by using mobile application management (MAM) tools. These tools allow IT admins to manage corporate apps (wipe or control access permissions) on their employees’ devices without disrupting employees’ personal apps or data.

## 3. Unsecured Public WiFi

Public WiFi networks are generally [less secure](https://www.wired.com/story/public-wifi-safety-tips/) than private networks because there’s no way to know who set the network up, how (or if) it’s secured with encryption, or who is currently accessing it or monitoring it. And as more companies offer remote work options, the public WiFi networks your employees use to access your servers (e.g., from coffee shops or cafes) could present a risk to your organization.

For example, cybercriminals often set up WiFi networks that look authentic but are actually a front to capture data that passes through their system (a “man in the middle” attack). Here's what that looks like:

![Unsecured Public WiFi](https://images.ctfassets.net/23aumh6u8s0i/3Zdz3P9nnZTNTMNPi2UMPZ/af3eb9262d8440b0fc875da00b0e1eaf/image2.png)
<a href="https://www.consumer.ftc.gov/blog/2014/03/how-secure-mobile-app"> Source </a>

If this seems far-fetched, it isn’t. Creating fake WiFi hotspots in public spaces with network names that look completely legit is incredibly simple, and people are very willing to connect, as shown by [experiments](https://hbr.org/2017/05/why-you-really-need-to-stop-using-public-wi-fi) run at the Democratic and Republican conventions in 2016 and by [an experiment](https://hackernoon.com/a-hacker-intercepted-your-wifi-traffic-stole-your-contacts-passwords-financial-data-heres-how-4fc0df9ff152) run by a researcher in 2019 from [Magic](https://magic.co/).

### How to Reduce Risks Posed By Unsecured Public WiFi

The best way for you to protect your organization against threats over public WiFi networks is by requiring employees to use a VPN to access company systems or files. This will ensure that their session stays private and secure, even if they use a public network to access your systems.

## 4. End-to-End Encryption Gaps

An encryption gap is like a water pipe with a hole in it. While the point where the water enters (your users’ mobile devices) and the point where the water exits the pipe (your systems) might be secure, the hole in the middle lets bad actors access the water flow in between.

![End-to-End Encryption Gaps](https://images.ctfassets.net/23aumh6u8s0i/75ICJ2SUKqSGKvX7OQoXxF/423b5c480a4c09939e62d411ba716b1b/image3.png)
<a href="https://heimdalsecurity.com/blog/the-best-encrypted-messaging-apps/"> Source </a>

Unencrypted public WiFi networks are one of the most common examples of an encryption gap (and it’s why they’re a huge risk to organizations). Since the network isn’t secured, it leaves an opening in the connection for cybercriminals to access the information your employees are sharing between their devices and your systems.

However, WiFi networks aren’t the only thing that poses a threat—any application or service that’s unencrypted could potentially provide cybercriminals with access to sensitive company information. For example, any unencrypted mobile messaging apps your employees use to discuss work information could present an access point for a bad actor.

### Solution: Ensure Everything is Encrypted

For any sensitive work information, end-to-end encryption is a must. This includes ensuring any service providers you work with encrypt their services to prevent unauthorized access, as well as ensuring your users’ devices and your systems are encrypted as well.

## 5. Internet of Things (IoT) Devices

The types of mobile devices that access your organization’s systems are branching out from mobile phones and tablets to include wearable tech (like the Apple Watch) and physical devices (like Google Home or Alexa). And since many of the latest IoT mobile devices have IP addresses, it means bad actors can use them to gain access to your organizations’ network over the internet if those devices are connected to your systems.

> Statistically, there are probably more IoT devices connected to your networks than you realize. For example, 78% of IT leaders from four different countries reported in [a study by Infoblox](https://www.infoblox.com/company/news-events/press-releases/shadow-iot-devices-a-major-concern-for-corporate-networks-infoblox-research-finds/) that over 1,000 shadow IoT devices accessed their networks each day.

### How to Combat Shadow IoT Threats

Mobile device management (MDM) tools can help you combat shadow IoT threats, as well as identity and access management (IAM) tools like Auth0. However, IoT/Machine-to-Machine (M2M) security [is still in a bit of a “wild west” phase](https://www.crn.com/news/internet-of-things/as-5g-nears-iot-connectivity-remains-a-wild-west-) at the moment. So it’s up to each organization to put the appropriate technical and policy regulations in place to ensure their systems are secure.

## 6. Spyware

Spyware is used to survey or collect data and is most commonly installed on a mobile device when users click on a malicious advertisement (“malvertisement”) or through scams that trick users into downloading it unintentionally.

Whether your employees have an iOS or Android device, their devices are targets ripe for data mining with spyware—which could include your private corporate data if that device is connected to your systems.

### How to Protect Against Spyware

Dedicated mobile security apps (like Google’s [Play Protect](https://developers.google.com/android/play-protect)) can help your employees detect and eliminate spyware that might be installed on their devices and be used to access company data. Ensuring your employees keep their device operating systems (and applications) up to date also helps ensure that their devices and your data are protected against the latest spyware threats.

## 7. Poor Password Habits

A [2020 study](https://www.balbix.com/resources/state-of-password-use-report-2020/) by Balbix found that 99% of the people surveyed reused their passwords between work accounts or between work and personal accounts. Unfortunately, the passwords that employees are reusing are often weak as well.

For example, a 2019 study by Google found that 59% of the people they surveyed used a name or a birthday in their password, and 24% admitted to using a password like one of these below:

![Poor Password Habits](https://images.ctfassets.net/23aumh6u8s0i/3f3dzG9WlC6gNqYnCyB9V3/00d5e8990be0124d4b140764ff769ec1/image4.jpg)
<a href="http://www.netimperative.com/2016/01/worst-25-passwords-prove-were-all-idiots/"> Source </a>

These bad password habits present a threat to organizations whose employees use their personal devices to access company systems. Since both personal and work accounts are accessible from the same device with the same password, it simplifies the work a bad actor has to do in order to breach your systems.

However, these behaviors also provide opportunities for credential-based brute force cyberattacks like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) or password spraying because cybercriminals can use weak or stolen credentials to access sensitive data through company mobile apps.

### How to Reduce or Eliminate Mobile Password Threats

The [NIST Password Guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) are widely regarded as the international standard for password best practices. Following these guidelines—and insisting your employees do the same—will help protect you against threats from weak or stolen passwords. Password managers can simplify the work required for your employees to follow these guidelines.

Requiring your employees to use more than one authentication factor (multi-factor authentication or MFA) to access mobile company applications will also help reduce the risk that a bad actor could gain access to your systems since they’d need to verify their identity with additional authentication factors in order to log in.

Finally, implementing [passwordless authentication](https://auth0.com/passwordless/) will help you eliminate password risks altogether. For example, in the event that a mobile device is stolen or accessed illegally, requiring a facial scan as a primary (or secondary) authentication factor could still prevent unauthorized access.

## 8. Lost or Stolen Mobile Devices

Lost and stolen devices aren’t a new threat for organizations. But with more people [working remotely](https://www.businesswire.com/news/home/20201215005287/en/Upwork-Study-Finds-22-of-American-Workforce-Will-Be-Remote-by-2025) in public places like cafes or coffee shops and accessing your systems with a wider range of devices, lost and stolen devices pose a growing risk to your organization.

### How to Protect Against Lost or Stolen Device Threats

First and foremost, you’ll want to ensure employees know what steps to take if they lose their device. Since most devices come with remote access to delete or transfer information, that should include asking employees to make sure those services are activated.

![How to Protect Against Lost or Stolen Device Threats](https://images.ctfassets.net/23aumh6u8s0i/44UaWTSZk2OlrI587JXGw1/1276e73d18bae71b074472dfb1ebd2db/image5.jpg)
<a href="http://www.idownloadblog.com/2014/08/08/how-to-activate-lost-mode-iphone-ipad/"> Source </a>

[Mobile device management](https://auth0.com/blog/what-is-enterprise-mobile-management/) (MDM) tools can also help you secure, encrypt, or wipe sensitive company information from a device that’s lost or stolen, so long as those tools were installed before the device went missing.

## 9. Out of Date Operating Systems

Like other [data security](https://auth0.com/blog/what-is-data-security/) initiatives, mobile security requires continuous work to find and patch vulnerabilities that bad actors use to gain unauthorized access to your systems and data.

> Companies like Apple and Google address a lot of these vulnerabilities with operating system updates. For example, in 2016, Apple realized it had three [zero-day vulnerabilities](https://us.norton.com/internetsecurity-emerging-threats-how-do-zero-day-vulnerabilities-work-30sectech.html) that left its devices open for spyware attacks and released a patch to protect users against these vulnerabilities.


However, these patches only protect your organization if your employees keep their devices up to date at all times. And according to Verizon’s [Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf), operating system updates on 79% of the mobile devices used by enterprises are left in the hands of employees.

### How To Keep Mobile Operating Systems Up To Date

Google and Apple both allow organizations to push updates to managed Android and iOS devices. Third-party MDM tools (for example,[ Jamf](https://www.jamf.com/)) often provide this functionality as well.

## IAM Tools Can Help Secure Company Mobile Applications

Identity and Access Management (IAM) tools can help organizations secure the apps and data that users access from their mobile devices, including:

* **Restricting which devices and users can access enterprise applications and data,** as well as which parts of those applications they’re allowed to access.
* **Tracking user behavior** and securing access in the event that something looks suspicious with security features like [multi-factor authentication](https://auth0.com/blog/multifactor-authentication-mfa/) (MFA),[brute force attack protection](https://auth0.com/docs/attack-protection), and more.

Auth0 simplifies the work required to implement secure authentication for mobile enterprise applications—learn more about Auth0’s IDaaS platform [here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The 9 Most Common Security Threats to Mobile Devices in 2021

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

To stay competitive, media companies have to deliver seamless experiences built around customer identity. The race starts at login.

Today’s media consumers enjoy an incredible array of content and have an unprecedented number of choices for how, when, and where to consume it. In this saturated environment, media heads of product are engaged in a war for consumer attention. The winners are the companies that curate the most relevant content for each user, with simple, intuitive platforms that keep them coming back for more.

The media companies that are most successful at keeping consumer attention are those with the most intensive surgical focus on creating a personalized user experience. Netflix, for instance, doesn’t merely use its insights to recommend shows; they even tailor the [thumbnail images](https://www.vox.com/2018/11/21/18106394/why-your-netflix-thumbnail-coverart-changes) of those shows to different demographics and what they find most irresistible. Achieving this level of personalization requires media outlets to possess a deep and holistic understanding of each customer, not one that is fragmented across channels or devices.

In this piece, we’ll explore how uniting customer identity in a single view will enable UX that caters directly to your customers’ preferences. Building UX around identity is crucial for heads of production who want to make their platforms stand out rather than be one more dish in the endless media smorgasbord.

## Simplify Authentication Across Devices

The era of the internet of things (IoT) presents exciting possibilities for both media producers and consumers as more smart devices become capable of delivering content. But the promise of seamless, nearly effortless device usage is often stymied at the login screen.

As anyone who has tried to type their email address with a TV remote can attest, there are few UX experiences more painful than attempting to log in with a device that was never intended for entering credentials. This frustration and its cost to UX are avoidable if you implement [single sign-on (SSO)](https://auth0.com/blog/implementing-single-sign-on-in-b2c-applications/). With SSO, when users log in to an application with one set of credentials, they are automatically signed into other applications. The primary UX benefit of this is that it simplifies authentication across devices and accelerates the time to first login.

<include src="TweetQuote" quoteText="The era of the internet of things (IoT) presents exciting possibilities for both media producers and consumers as more smart devices become capable of delivering content."/>

With a sophisticated customer identity and access management (CIAM) solution like Auth0, you can use SSO to shift the login process to other devices, which are more user-friendly and are already associated with user profiles.

![Login Process](https://images.ctfassets.net/23aumh6u8s0i/01aER9PsXDQQNimIMoPUdF/4b03aa9398019f303bd1a13e1955ec2f/login-process)

Using [OAuth Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/), a user trying to log in to your app via their smart TV won’t have to fiddle with their remote. Instead, they’ll be directed to visit a URL on their computer or smartphone, enter a short code, and complete the authentication process with far less friction. Aside from ease of use, shifting authentication to a browser also improves security, since users don’t have to directly expose their credentials to their smart devices.

## Reduce the Number of Required Logins

The login box is your first impression with a customer. At best, a time-consuming login means that customers begin their session with an unpleasant experience. At worst, it means they browse without logging in, robbing you of the chance to present them with personalized content. The solutions to this issue hinge on using your view of the customer to minimize the number of times they have to re-enter their credentials.

For multi-brand media companies, a seamless customer experience starts with SSO. For example, we’re all familiar with SSO when we log in to Google and are automatically logged in to YouTube. That feature is critical in enabling YouTube to recognize users and recommend videos tailored to their interests.

<include src="TweetQuote" quoteText="The login box is your first impression with a customer. At best, a time-consuming login means that customers begin their session with an unpleasant experience."/>

Another effective tactic to reduce tedious logins is implementing [long-lived sessions](https://auth0.com/blog/when-ux-equals-keeping-or-losing-the-customer/) for users. Long-lived sessions let developers extend the login period before idle time-outs, in which users are automatically logged out after a certain period of inactivity. Whereas maintaining a brief window for idle time-outs makes sense for apps that handle highly sensitive information, it often hurts media companies. If you have a user who typically logs on once a month to read new content, forcing them to log in each time harms UX without providing any real benefit.

![Long-Lived Sessions Diagram](https://images.ctfassets.net/23aumh6u8s0i/7mEOMklyIKITdeeLKYnAYw/c6c49224407e2e7fb40afe1595e156c9/long-lived-sessions)

If you choose to explore long-lived sessions, it’s crucial to have a CIAM provider like Auth0 that lets you tailor the system to your business. Auth0 lets you customize session limits of up to 100 days, which you can adjust based on the level of risk your business is comfortable with. You can also apply rules that require users to authenticate when engaging in activities such as changing payment details. It’s crucial to maintain this level of customization with long-lived sessions; otherwise, your short-term UX gains can be erased by compromised security.

## Create a Consistent Experience with an Identity Directory

In a media ecosystem that is often overwhelming to users, the ideal UX is a place where one’s needs are understood and catered to the moment one logs in. To achieve this uniform, curated experience across platforms, consider storing user profiles on a centralized directory.

It’s vital to have rich, holistic profiles that function as the authoritative source of truth about your customer. That way, even if a user logs in via social media at one point, and email the next, both logins still feed into a single profile. With this approach, profiles and content recommendations stay relevant even as login behaviors evolve.

Having a single profile — as opposed to duplicates across login methods or devices — ensures that your company’s advertising and marketing efforts are appropriate rather than intrusive. Lacking this alignment can have a negative effect on UX; [a recent study](https://www.marketingcharts.com/customer-centric/privacy-and-security-107946) found that 66% of consumers disliked being targeted too many times, and 44% were annoyed if targeted for too long.

Auth0 offers customers the ability to host their directories on their own servers or on the secure Auth0 server. If your needs change, you can [move your directory to Auth0](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) without requiring that customers undergo a disruptive password reset. This model lets you scale, which results in consistent delivery of good UX even as you grow.

## Use Identity to Become a Content Concierge

In this crowded media landscape, compelling content is no longer enough to attract and retain customers. Consumers increasingly demand that companies not only select the most relevant and valuable content for them but also deliver it across all their devices with minimal effort.

Understanding your users’ identity is at the core of great UX. That’s why attaining a single vision of the customer is such an effective digital initiative for media heads of product. To do this project justice, be sure to partner with a CIAM that can provide an experience as simple, yet as customizable, as the one you offer your customers. If you’d like to learn more about how Auth0 can help you quickly create a CIAM solution that suits your needs, please reach out to an [Auth0 resource](mailto: sales@auth0.com).

<include src="asides/AboutAuth0" />

---

How To Improve CX/UX Through A Single Vision Of The Customer

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Learn how the OAuth 2.0 Device Flow offers smooth authentication and authorization to limited-input devices.

Tired of wrestling with remote controls and on-screen TV keyboards to enter credentials on your smart TV? You’ve dealt with it too many times, and you can bet your customers have to. What if you could help them get logged in with just a few taps on their cell phone?

![Image of person using TV remote control to enter credentials](https://images.ctfassets.net/23aumh6u8s0i/40YgdeQssI4jVCDkuUFBhK/84a3c8111f80e7c8f1e0c45c0366f7ac/do-not-use-remote-controls-to-enter-credentials)

Hi, Dan from Auth0 here bringing you the [**OAuth 2.0 Device Flow**](https://auth0.com/device-flow/): a fast, easy, and safe way to log into apps on your Smart TV and other input-constrained devices. No keyboard? No browser? No problem!

Ordinary login can be tedious and error-heavy. The OAuth 2.0 Device Flow is lightweight, authenticates you in seconds and not only works with TVs, but also with game consoles, CLIs, printers, and much more!

Auth0 offers developers a fully compliant implementation of the OAuth 2.0 Device Flow to tackle this user experience pain point easily. Let’s learn more about what input-constrained devices are, how this authorization grant works, and how Auth0 can help.

## What Are Internet-Connected, Input-Constrained Devices?

Do you have an internet-connected device that either (1) has no browser or (2) offers impractical ways for you to input text?

If you answered yes, then you have an input-constrained device! What type of devices came to your mind? I am thinking...

- All-in-One printers
- Fitness trackers
- Streaming devices
- Toothbrushes
- Game consoles
- Fridges
- Teddy bears
- Car infotainment systems
- Smart TVs
- Really, anything with the word “smart” in front of it

![Smart TVs, printers, gaming consoles, and other typical input-constrained devices](https://images.ctfassets.net/23aumh6u8s0i/2f4VYWXdICGOnMhmtm0u1G/d847718b30d453a63bd3f4d21c9d0e89/typical-input-constrained-devices)

The Internet of Things (IoT) frenzy has put a lot of devices online. Today or in the future, the software running on these devices may talk to your service APIs to get the data needed to offer your customers a rich user experience across devices and platforms. However, that user experience may not be so rich or secure if a device doesn’t offer a convenient way to authorize external services.

<include src="TweetQuote" quoteText="Granting authorization on input-constrained devices is challenging. But what are input-constrained devices anyway? Learn more in this blog post!"/>

As a competitive business, you don’t want to limit the devices that can use your services by not being able to provide browserless authentication. But, if the device does offer a browser or user interface, you wouldn’t want your customers to enter credentials using the arrows of a TV remote control to select keys from a giant on-screen keyboard. Their credentials could be compromised by someone recording their screen as they slowly input them, for example.

Furthermore, you’ll want to ensure that user credentials are not entered on systems that you don’t control and that may store them for future access, like smart displays that sometimes leverage proprietary systems or third-party clients that access your APIs.

What you do want is a way to authorize third-party applications with controlled access to your APIs on a variety of devices. The OAuth 2.0 Device Flow lets you do exactly that! Even on devices without a browser, you can take advantage of the security and user experience benefits of a standard delegated authorization protocol.

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziro/julian-lywood-mulcock-mini.png" name="Julian Lywood-Mulcock" title="Customer Success Architect" team="Customer Success" location="London, United Kingdom" body="With Device Flow, we reduce end-user frustration and we ensure the log-in action is as secure as it can be. By decoupling the log-in experience from input-constrained devices, end-users can benefit from a secure method of authentication while having a frictionless user experience they will tell their friends about."/>

To understand how to go with the Device Flow, it’s better for you to see it at play using a video streaming app as an example.

## OAuth 2.0 Device Flow In Action

Say that you want to watch AuthU TV, _a fictional video platform for techies_, on your television. You start by downloading the AuthU TV app to your smart TV. When you open the app for the first time, you’ll be welcomed by a login screen.

To kick things off, you’ll be asked to visit a URL on another device (like a smartphone or laptop), enter a short code, and then log in to your AuthU account to authenticate yourself.

Completing this process gives the software on your TV access to your AuthU account and lets you use your remote control to navigate AuthU content &mdash; not enter credentials.

![Illustration of OAuth 2.0 Device Flow that connects your devices](https://images.ctfassets.net/23aumh6u8s0i/2fc4mgnGc7TLVmFSyFCEmq/a1a849dbf53cc82ec7c30e6f6ff63b31/device-flow-banner-2)

At a high level, this process is very similar to how YouTube redirects to accounts.google.com to process a user login. With the OAuth 2.0 Device Flow, you manage the authentication process on a centralized login page, using a secondary device to make the input of credentials faster and more secure. By moving authentication off the device and into a browser, you are able to take advantage of more advanced identity and security features, such as MFA, SSO, and Social Login.

But talk is cheap: let’s see the Device Flow in action! Our engineers at Auth0 created an interactive demo that lets you simulate the authorization of the AuthU smart TV app right from your browser.

Start by visiting the [_Device Flow Playground_](https://auth0.github.io/device-flow-playground/). Once there, you can either try the playground with our default demo settings or configure with your Auth0 account settings to try in your own applications.

> Need an Auth0 account? <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get started for free today</a>. You’ll be saying “Wow!” while using everything that Auth0’s free trial has to offer!

You can also select the desired scopes you want to have. Once that’s done, click on “Get Started”.

![Image showing dashboard for how to get started with Auth0 Device Flow](https://images.ctfassets.net/23aumh6u8s0i/2kEgfhvZh84ty2XsEfjDS4/282e39d53d32deef8e381d012bbce385/getting-started)

Next, to stream content from the mock AuthU TV app, you are prompted to authorize the app by clicking on the “Authorize” button.

![Auth0 Device Flow: authorization request](https://images.ctfassets.net/23aumh6u8s0i/YYQyy8IRjr6yMu5bZ2CVK/a1d955489836849e35411d38da360a2e/authorization-request)

Now you are prompted to authorize the device by navigating to the activation URL, [_acme-demo.auth0.com/activate_](https://acme-demo.auth0.com/activate), using another device and entering the code displayed on your smart TV. You can also scan the QR code, which would automatically input the user code. The TV app will be waiting for you to complete the process on your secondary device which would trigger an authorization response it can use to get access to the AuthU TV service.

![Auth0 Device Flow: token request](https://images.ctfassets.net/23aumh6u8s0i/1kbV5mJIgdzqj1zKttXvhx/edefed4de2bfd100c411b0e4192c6892/token-request-2)

Visit the provided link, enter the one-time code, and click “Continue”. You can do this using another browser tab or your smartphone mobile browser.

![Auth0 Device Flow: device activation](https://images.ctfassets.net/23aumh6u8s0i/2DyardhZGZL9dsFkyv1ntI/eeee2eee9563b6c32066c3b5df3223c2/device-activation-enter-code)

![Auth0 Device Flow: device activation code](https://images.ctfassets.net/23aumh6u8s0i/5PUMsCJHIxEqQuqBhec3oC/6b3a2704a91bfd070ac57ad87983d7c9/device-activation-code-entered)

Confirm that the code displayed on the site matches the one shown on the smart TV and click “Continue”.

![Auth0 Device Flow: device confirmation](https://images.ctfassets.net/23aumh6u8s0i/7c5GzgdHLuYt2iPuqDzBhd/c5cd28ea0e35deee1a8648a757fd18d6/device-confirmation)

Next, sign up for an account or log in with an existing one.

![Auth0 Device Flow: user authentication](https://images.ctfassets.net/23aumh6u8s0i/1s4Z8pZ2FknPYkMD3BtcNr/0e46e566969ef95f364bb30afd12bb5e/authentication)

A message will show up on the site confirming that the device is now connected.

![Auth0 Device Flow: device connection](https://images.ctfassets.net/23aumh6u8s0i/6rJnFfbuz2vv0gn5Du3ivY/3df5ee90405b34ebe7816149d8777d7f/your-device-is-now-connected)

Back on the smart TV, the AuthU app is ready to start streaming content. The TV app has the authorization to fetch additional information about you to customize the UI.

![Auth0 Device Flow: activation completion](https://images.ctfassets.net/23aumh6u8s0i/01qheEW2pvdEikaQlCUq2l/12338b0c904089d2d86eace3f955cff7/activation-complete)

That’s it for a high-level technical overview of the OAuth 2.0 Device Flow. Let’s peek under the hood at how using Auth0 as your identity platform facilitates this process.

## OAuth 2.0 Device Flow Made Easy with Auth0

When your input-constrained device needs to fetch user data from your API, the following process takes place:

![Overview of OAuth 2.0 Device Flow with API calls](https://images.ctfassets.net/23aumh6u8s0i/2Ykjsm2pB8MBDiqWLTq6RQ/e80d6aa8ab913d990107e81b2aa41dbc/overview-flow-call-api-device-app)

1. If the device application is not already authorized, your device application calls your Auth0 Authorization Server to retrieve a device code.

2. Auth0 responds with a URL and user code. Your device app asks the user to visit a specific URL on a secondary device (like a laptop or smartphone) and provide the activation code.

3. Your device app begins to poll your Auth0 Authorization Server for an Access Token and a Refresh Token.

4. The user authenticates with Auth0 on the secondary device using one of your already configured authentication methods. Auth0 is an identity hub that supports many [_Identity Providers using various protocols_](https://auth0.com/docs/identityproviders) (like OpenID Connect, SAML, WS-Federation, and more).

5. Once authentication is complete, Auth0 responds to your device app with an Access Token and a Refresh Token, which lets you refresh the Access Token without having to request permission from the user again.

6. The Access Token can be used to call your API and retrieve requested data.

<include src="TweetQuote" quoteText="With access tokens and refresh tokens, you make authentication fast and make it last! Learn more about how tokens work in the OAuth 2.0 Device Flow."/>

## Recap

Today, you learned what internet-connected, input-constrained devices are, the challenges that these devices present to developers and customers alike, and how Auth0 along with OAuth 2.0 let you tackle those challenges through the implementation of the Device Flow.

The best part of the OAuth 2.0 Device Flow is that it lets you extend your existing authentication solutions to smart device platforms. This authorization grants simply lets your customers authenticate and authorize applications running on one device through another.

You may be curious about how you or your development team can implement this through code. We'll provide you with a detailed tutorial on Device Flow soon. Stay tuned! In the meantime, check the following resources for more information:

- [Introducing Device Flow](https://auth0.com/device-flow/)

- [Auth0 Device Authorization Flow Documentation](https://auth0.com/docs/flows/concepts/device-auth)

- [Calling an API Using the Device Authorization Flow](https://auth0.com/docs/flows/guides/device-auth/call-api-device-auth)

- [OAuth 2.0 Device Authorization Grant, Draft 15](https://tools.ietf.org/html/draft-ietf-oauth-device-flow-15)

<include src="TweetQuote" quoteText="The OAuth 2.0 Device Flow is designed for applications executed on internet-connected devices that either don’t have a browser or are input-constrained. It enables end-users to authorize device applications to access service APIs."/>

<include src="asides/AboutAuth0" />

OAuth 2.0 Device Flow, No Hassle Authentication - As Seen On TV

A proliferation of devices brings new security concerns near the holidays

Home security used to be as simple as locking your doors and windows, but the proliferation of smart home devices and home automation has given each house many more digital doors to check. The [use of these _devices in botnets_](https://auth0.com/blog/security-risk-20-plus-billion-iot-devices-by-2020/) has stirred anxiety about smart home device security. Users are trying to determine how best to ensure the privacy of their data and the sanctity of their homes in this challenging environment.

End users want to map the functionalities of their homes onto phone taps and voice commands. Even if they’re miles away, they still want to monitor their heat, lock their doors, and check for intruders, all while balancing [_security and convenience_](https://auth0.com/blog/security-vs-convenience/).

## Users Want Smart Homes, but Smart Home Device Security Isn’t Inviting

As a consumer, it’s a challenge to know if a smart home device will be a good investment. With so many hyped products, it’s hard to know where to begin. *We at Auth0 firmly believe security should be the key differentiator.*

According to a recent [_*Consumer Reports* study_](https://www.consumerreports.org/privacy/d-link-camera-poses-data-security-risk--consumer-reports-finds/), 87% of Americans worry about smart home device security issues. Meanwhile, Gartner believes security is the biggest [_impediment to IoT success_](https://www.gartner.com/newsroom/id/3869181). Vendors with tight security are the ones you should stick with, particularly at a time of escalating risk.

To help get started, we’ve outlined the major categories and brands of smart home devices below, including their security successes and flaws.

## A New Leader in Top-Selling Smart Home Systems

A smart home system, as opposed to a smart home device, is a product that offers end users an interface to control and orchestrate the rest of their devices. The three leaders in this space are Google’s Assistant, Amazon’s Alexa, and Apple’s Siri — all of which offer voice-controlled integration with a variety of smart home devices.

Each of these companies offers a hub that centralizes end-user interactions, primarily through voice. Google offers Google Home and Google Home Mini; Amazon offers Echo, Echo Show, Echo Spot, and Echo Dot; and Apple offers HomePod.

Smart home systems and hubs are important from a security perspective because if any of them are compromised, the rest of the interfaced devices may face similar compromise.

In 2018, [_Google beat Amazon_](https://www.canalys.com/newsroom/google-beats-amazon-to-first-place-in-smart-speaker-market) in smart speaker adoption, shipping 3.2 million Google Home and Home Mini devices versus Amazon’s 2.5 million Echo devices. One study found that Google Assistant is [_five times more accurate than Alexa_](http://blog.360i.com/reports/alexa-siri-google-how-do-we-know-what-they-know), which may have contributed to Google’s present and, potentially, future success.

![Amazon Echo smart devices and speaker images](https://images.ctfassets.net/23aumh6u8s0i/4PUZ2qDR6gw269rhZEYjcv/c744a3ad48b9df17d672722a3e2f3111/echo-buttons)

[Echo Image Source: [Amazon](https://press.aboutamazon.com/images-videos/devices-accessories/product-images-amazon-echo-buttons?c=176060&p=irol-accessories1)]

Amazon’s devices have also suffered more prominent security failures than other devices. This year, researchers created an applet, or “skill,” that appeared to be a calculator but in fact forced the mic to continue listening after an initial command and then [_transmit the transcribed audio_](https://www.wired.com/story/amazon-echo-alexa-skill-spying/).

Outside of research, Amazon also endured a [_viral eavesdropping story_](https://www.businessinsider.com/amazon-echo-eavesdropping-incident-undermining-smart-speaker-market-2018-5) this year when the Amazon Echo misunderstood a family’s unrelated conversation as a series of commands, started listening and recording, and then sent the audio to someone in the owner’s contact list. Amazon confirmed the narrative but deemed it unlikely. This is cold comfort to the user, who said she’d never plug it in again —as might many others who heard about the story.

The Apple HomePod, a relative latecomer to the smart speaker market, offers similar features differentiated by a higher-fidelity speaker. Apple, the rare company with a [_reputation for privacy protection_](https://www.computerworld.com/article/3253957/apple-ios/why-apple-needs-homepod-to-be-as-safe-as-houses.html), promises the HomePod will share only as much personal information — all of which is encrypted-as necessary to fulfill a user’s request.

## Smart Security Cameras

One of the top-selling smart home devices in the security camera category is Amazon’s Cloud Cam. The Cloud Cam promises users the ability to monitor the inside of their homes 24/7 and two-way audio. Amazon stores the footage from the Cloud Cam in its corporate servers, and videos travel through [_secure, encrypted connections_](https://www.consumerreports.org/privacy/d-link-camera-poses-data-security-risk--consumer-reports-finds/). End users can [watch videos on an app](https://www.voicesage.com/blog/digital-customer-experience-how-api-technology-enhances-cx-strategy/) or access them through a password-protected web page.

![Amazon’s Cloud Cam home automation Smart Security Camera](https://images.ctfassets.net/23aumh6u8s0i/4m7VunACcZIo86a74kk4IE/0ef23235491f0d1c87b06d1a9d7b2fea/smart-security-cameras)

Source: [_CNET_](https://www.cnet.com/pictures/amazons-cloud-cam-makes-diy-home-security-so-simple/4/)

Another popular line of smart secure cameras comes from Netgear. The Arlo Q Plus, which focuses on business contexts, features night vision, local backups, and integrations with Google Assistant and Amazon Alexa and offers enough cloud storage to keep seven days of recordings.

Netgear acknowledged that, in specific circumstances, users can expose their devices with weak passwords generated by factory resets, but it fixed this gap with a [_firmware update_](https://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-Vulnerability).

Log-in issues [_afflicted other Arlo users this year_](https://www.theverge.com/2018/5/30/17408650/netgear-arlo-security-camera-app), some of which kept users locked out of their accounts while the app displayed a variety of connectivity and authentication errors. For some devices, this might be a minor blip, but it’s debilitating for a device that promises continuous security. Companies have much to risk if they convince users their devices offer security and then pull that security away without notice.

## Smart Lighting

Philips Hue is a leading device in smart bulbs and smart lighting systems. Hue offers a variety of kits that enable users to control and automate lights remotely. In 2018, Hue added further Siri integration to make this even more efficient for iPhone users.

![Smart Lighting home automation Siri keynote with iPhone](https://images.ctfassets.net/23aumh6u8s0i/4TwYLZjo3pJp4SHvXLvEku/e181c685a62b5a6b14ca2bc90d84fccb/smart-lighting)

Source: [_Ry Crist_](https://twitter.com/rycrist/status/1035122403557498886/photo/1?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1035122403557498886&ref_url=https%3A%2F%2Fwww.cnet.com%2Fnews%2Fphilips-hue-smart-lights-will-work-with-siri-shorcuts-this-fall%2F)

In terms of smart home device security, it’s easy to assume Philips Hue might be the safest purely because access doesn’t appear as valuable to intruders as other devices. Smart home device security, however, is as much about comfort as protection.

Security researchers have demonstrated the ability to remotely hack Hue smart bulbs from hundreds of feet away by forcing a malicious firmware update. The [_researchers warned_](https://www.cnet.com/news/new-study-details-a-security-flaw-with-philips-hue-smart-bulbs) that beyond the single home context, such technology could damage a city’s power grid if the hack operated at larger scales. Philips Hue quietly and efficiently patched this flaw once they became aware of it.

In 2017, other testers encountered communication and authentication issues that left local communication between the app and the Hue bridge [_unsecured and unencrypted_](https://www.iot-tests.org/2017/06/hue-let-there-be-light). Smart home device security is often based on the assumption that local networks are secure, but that’s not always true.

These issues worsen when users don’t have the ability to verify and boot users, which [_one blogger learned in 2018_](https://char.gd/blog/2018/how-secure-are-your-light-bulbs). He found that without the technical API knowledge he had, the average user would be unable to figure out who had the authority to control the Hue system.

## Smart Locks and Doorbells

Smart home device and home automation security can’t be a more obvious issue when it comes to smart locks.

The August Smart Lock offers a continuous activity feed as well as the ability to lock and unlock doors remotely.

August also offers users the convenience of automatic guest access that users can distribute through temporary, digital keys. One hacker showed how an intruder could [_leverage guest access_](https://www.cnet.com/news/august-smart-lock-hacked/) to create new keys and control the August Smart Lock even after a user removed guest access. August eventually patched the issue, but some users were left concerned about August’s lack of transparency.

Ring, the smart doorbell company Amazon acquired this year, features instant alerts when guests press the doorbell and streams video that enables users to see visitors as well as communicate via two-way audio.

In May, Ring [_disclosed a security flaw_](https://www.marketwatch.com/story/people-are-using-this-smart-doorbell-to-spy-on-each-other-2018-05-18) that allowed people who had once had access to Ring maintain that access after the password was changed. In a nightmare scenario many smart home device manufacturers likely fear, a user discovered this after an ex-boyfriend used the Ring app to spy on him. Ring claimed it had fixed the flaw months previously but eventually admitted it hadn’t. As of this writing, the flaw remains unfixed. 

## The Future of Smart Home Device Security Requires Trust

It's likely that smart home device vulnerabilities will always exist, and enterprising hackers will always discover new ways to find them. Smart home device vendors will need to prove their willingness to be transparent and responsive when threats and breaches arise. 

Consumers should also do their research on a vendor’s security commitment before deciding to buy. In particular, they should focus on devices that have [strong _authentication procedures_](https://auth0.com/blog/go-beyond-username-password-with-modern-auth/). Authentication is the primary protective measure in the [UK’s literature review for IoT principles and best practices](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686090/PETRAS_Literature_Review_of_Industry_Recommendations_and_International_Developments_on_IoT_Security.pdf). Ensuring that a vendor doesn't lean on unencrypted credentials will go a long way towards keeping its users safe from a botnet like Mirai. In addition, companies that support [multifactor authentication](https://auth0.com/multifactor-authentication) (MFA) will add an extra layer of protection against weak passwords.

Smart home devices are as much interfaces as they are tools. As such, some of the worst vulnerabilities lie in the connections between them and the networks they integrate with. Organizations that hope to create lasting success in the smart home market must, as a baseline, be able to establish security through [_capable authentication procedures_](https://auth0.com/blog/go-beyond-username-password-with-modern-auth/).

<include src="asides/AboutAuth0" />

Security for Smart Home Devices

Unprotected IoT devices can make it easy for malicious actors to cause global damage. Botnets increased 140% last year. Auth0 can help safeguard your IoT devices.

## Is the UK’s ‘Secure By Design’ the Answer?

If 2017 was the year of the cyberattack, 2018 could be the year when IoT attacks make you feel like you’re living through a personal version of [Taken](https://www.youtube.com/watch?v=uPJVJBm9TPA&feature=youtu.be).

<include src="TweetQuote" quoteText="Unprotected IoT devices can make it easy malicious actors to cause global damage — botnets increased 140% last year. Auth0 can help safeguard your IoT devices"/>

Accessing vulnerable IoT devices, cybercriminals can grab photos of your kid; drain your bank account; alter your health records; hold your coffee maker, thermostat or vehicle hostage; and stop your heart (if you have a pacemaker).

On the business side, they can attack virtually every industry where rapid adoption of low-cost, easily-installed IoT devices has led Gartner analysts to predict that [more than 20 billion connected things](https://www.gartner.com/newsroom/id/3598917) will be in use by 2020.

## Yes, Your Wearable Could be Involved in a Global Threat

In addition to personal and business vulnerability where devices can be held hostage for ransom or more directly nefarious intent, unprotected IoT devices can provide easy ways for malicious actors to cause global damage, as can the apps that support them.

Just this week, [Under Armour announced that a data breach had affected 150 million users](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) of its fitness and nutrition site, MyFitnessPal, which can sync with wearables like Fitbit, Misfit, and LumoLift, as well as IoT-linked scales and cardio machines.

![MyFitnessPal Data Breach](https://images.ctfassets.net/23aumh6u8s0i/3jjLYQZLu72oDrX2RYAkgy/e720f072cde3386f0605923dedf7c15f/myfitnesspall-breach)

Using malware, they can gain control of the IoT devices and group them together to create a botnet with the IoT devices acting as “zombies” tasked with fulfilling the hackers’ desires. Dark Reading reported that [botnet controllers increased by 140% in 2017](https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924).

What’s especially shocking about that rise is how fast these troubles can spread.

## How Minecraft Accidentally Inspired Network Takedowns

Starting in 2016, three guys in a dorm room created Mirai, an IoT botnet targeting devices with one of [60 popular default passwords](https://www.grahamcluley.com/mirai-botnet-password/), hijacking them without the owner’s knowledge.

Their exploits targeted French cloud computing company OVH, internet services company Dyn, and knocked out major platforms like Netflix, Amazon, Twitter, and Github.

While the FBI lay honeypot traps and worried Mirai was a sign of potential U.S. presidential election interference from Russia or China, Mirai’s creators realized they could also run a click-fraud scheme in addition to the original goal of [getting an advantage in the online game Minecraft](https://www.wired.com/story/mirai-botnet-minecraft-scam-brought-down-the-internet/).

Eventually, all three guys plead guilty, facing up to five years in prison, $250,000 each in fines, and five years of supervised release.

When Netlab 360 stopped tracking Mirai last summer, [2.7 million devices had been influenced in less than a year](https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924?image_number=5).

## Billions of Devices at Risk

If you’re still calmly sipping your coffee, you’re not paying attention.

Satori, the IoT botnet that infected more than a quarter million devices within 12 hours of being spotted, [now has a version that can run on ARC processors](https://www.darkreading.com/vulnerabilities---threats/satori-botnet-malware-now-can-infect-even-more-iot-devices/d/d-id/1330875?). Why does that matter? More than [1.9 billion](https://www.synopsys.com/designware-ip/processor-solutions/arc-processors.html) ARC-based systems ship annually, making things run smoother in cars, industrial settings, homes, mobile, and IoT, including hearing aids and fitness bands.

Reaper, an IoT botnet built from Mirai’s code, had already [infected a million networks](https://www.wired.com/story/reaper-iot-botnet-infected-million-networks/) by October of 2017. Rather than exploit a single vulnerability, Reaper is a multi-vector opportunist. Written for on-the-fly updates, the malware can run fresh attacks as soon as they become available. As of the first week of March, The Hindu reports that WiFi cameras have proven most vulnerable to Reaper, with a [nearly four-fold increase in attacks over a three-month period](http://www.thehindu.com/todays-paper/tp-miscellaneous/tp-others/iot-botnets-attack-multiple-vulnerabilities/article22938435.ece).

Meanwhile, attacks are growing in complexity and sophistication, with one of the most recent botnets, Hide N Seek, developing the ability to have devices communicate directly with each other in peer-to-peer communication, which means it can spread via web and internal networks.

Botnets are rapidly becoming more mature and automated. With [400K-device botnets available for rent online](https://www.bleepingcomputer.com/news/security/you-can-now-rent-a-mirai-botnet-of-400-000-bots/) and others being [given away as Christmas gifts](http://www.zdnet.com/article/satori-malware-code-given-away-for-christmas/), IT departments are feeling the heat.

## What’s A Breach Going to Cost your Organization?

So how likely is it that your company is going to get hit with an IoT breach?
In the U.S., a 2017 [Altman Vilandrie & Company survey](http://www.altvil.com/wp-content/uploads/2017/06/AVCo.-IoT-Security-White-Paper-June-2017.pdf) of 397 U.S. executives across 19 industries revealed that 48% of businesses had already suffered an IoT breach.

Okay, so you’re breached. What’s the impact?

Breaches in that survey were found to cost 13.4% of the total revenues for companies with revenues of under $5 million annually. Of larger companies with revenues of $5 billion or more, 44% reported losses of more than 20 million.

For a more global perspective, Cisco’s [2018 Annual Cybersecurity Report](https://www.cisco.com/c/dam/m/digital/elq-cmcglobal/witb/acr2018/acr2018final.pdf?dtid=odicdc000016&ccid=cc000160&oid=anrsc005679&ecid=8196&elqTrackId=686210143d34494fa27ff73da9690a5b&elqaid=9452&elqat=2) found that by the time victims added up lost revenues, customers, opportunities, and out-of-pocket costs more than
50% of attacks results in damages of $500,000 or more. Nearly 40% of surveyed companies reported that attacks resulted in costs of more than a million.

When [GDPR](https://auth0.com/gdpr) comes into force in May, breached companies serving EU customers could also find themselves faced with additional fines, as well as greater public outcry that they should have been prepared.

## Why the World is Not Ready

If we know all of this is happening why aren’t we better prepared?

The answer is two-part. One having to deal with corner-cutting that happens when technologies are rushed to market. The other has to do with clear gaps in cybersecurity readiness which caused Cisco’s report to label IoT a “serious threat vector.”

IT teams are strained with burgeoning cloud responsibilities while also managing the proliferation of IT devices. After surveying 3,600 international security officers and security operations managers and conducting tech partner research, Cisco’s report also concluded that:

* 83% of devices in their partner sample displayed vulnerabilities
* IoT devices are called into action without security planning
* Organizations are unaware of the total the number of devices on their network
* Patching, a prime defense, happens slowly, if at all
* When patching does occur, the prior best-practice of patching within 30 days now only leaves you open to additional attacks.

Even when organizations do actively patch, they can run into troubles created by device design.

After [WannaCry](https://www.helpnetsecurity.com/2017/05/17/wannacry-iot/), spread globally via a combination of infected computers and IoT zombies to take down everything from hospitals in England and a telecom provider in Spain to computers in the Russian Ministry of Internal Affairs, IT departmartments all over the world were spurred into action. Patching did work for many of the Microsoft computers affected, but not for legacy IoT products that can’t be patched.

In a world where neither hackers nor botnets respect borders, no country offers safe haven, which is why the UK is suggesting a more global solution.

## UK Drafts Code of Best Practices, Calls for Input

“IoT security is a global challenge requiring global collaboration.”
—UK Government’s [Secure by Design Report](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686089/Secure_by_Design_Report_.pdf)

After researching serious global threats for several days, encountering the UK’s hope to create a “free, open, peaceful and secure cyberspace” proved remarkably soothing. Part of the conception of this cyberspace means that we’re all participating in a global digital economy. This is part of why the UK reached out to the public and private sectors and academia, and “like-minded countries” for ways to fight this IoT-driven threat.

The UK government’s recent examinations and explorations of best practices could allow us to better protect ourselves. The [Secure by Design Report](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686089/Secure_by_Design_Report_.pdf) makes it clear that no one country, organization, or individual can fix this situation by themselves. We’re going to have to do this together.

For businesses creating IoT devices and supporting apps, this will mean re-addressing the entire product life cycle with an emphasis on security. For organizations employing IoT devices, it will mean having a methodical approach to their security. Consumers, who are showing interest in purchasing an ever-increasing number of IoT devices, will be protected by security being built in into products from conception — “secure by design.”
The UK government is hoping the market will right itself, but given the urgency of the situation, they’ve also warned that they will consider regulatory action if change doesn’t happen naturally, noting that they will continue monitoring through the remainder of 2018.

In addition to outlining the gravity of mounting threats and suggesting best practices, the report also cites 5 key principles to help shift IoT thinking: Reducing burden (on consumers and others in the supply chain), Transparency, Measurability, Facilitating Dialogue, and Resilience.
With an emphasis on sharing best practices and encouraging dialogue, the UK government is seeking input from all areas of interest. To contribute to the conversation, send comments to [securebydesign@culture.gov.uk](mailto:securebydesign@culture.gov.uk) by the 25th April 2018.

## How Auth0 Can Help You Immediately Secure IoT

Justice from captured hackers is notoriously thin. Organizations and individuals currently receive little compensation for their losses and/or harm to their reputation. Remember those three guys that created Mirai? Together they paid only $750,000 in fines — and that money didn’t go to the victims.

<include src="TweetQuote" quoteText="Will the UK’s call for IoT standards help protect organizations from the rapid rise of botnets?"/>

Government efforts like the UK’s or even the one of multiple U.S. bills to secure the Internet of Things could lead to real change, but they’re going to take time. Meanwhile, the hackers are evolving their attacks at frightening rates. What can you do to protect yourself right now?

In the [UK’s literature review for IoT principles and best practices](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686090/PETRAS_Literature_Review_of_Industry_Recommendations_and_International_Developments_on_IoT_Security.pdf), authentication was the first protective measure listed. Reliance on common credentials without encryption is part of what made it so easy for Mirai to sweep through all those IoT devices. Securing the devices you have now and devices coming online with well-encrypted (hashed and salted) passwords can provide a strong line of defense. [Multifactor authentication](https://auth0.com/multifactor-authentication) (MFA) also offers the possibility of securing devices with other factors like geographic location or time.

Auth0 can help you put all of these things into use quickly and efficiently. We support IoT authentication with the most advanced password hashing algorithms. Our code is regularly submitted to independent penetration and black box testing and we also perform continuous vulnerability assessments. And because hackers are always evolving, we have a team of 12 engineers dedicated to full-time work on security, lead by Auth0 CISO Joan Pepin, former CISO for both Nike and Sumo Logic.

If you’d like to learn more about how Auth0 can help you secure your IoT devices and streamline your identity solution, reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />

Security Risk: 20+ Billion IoT Devices by 2020

Learn how enterprises are taking back control of managing, tracking and securing their employee's mobile devices.

**TL;DR:** Learn how enterprises are taking back control of managing, tracking and securing their employee's mobile devices.

You probably don't realize it, but your colleagues and you have been leading a technology revolution against your company's IT department. The day you handed in your corporate-issued Blackberry and started using your personal devices to conduct business was the day you inadvertently declared war on IT.

![Source](https://images.ctfassets.net/23aumh6u8s0i/pUmIPSCGzHyj26w3bhH6d/56aa08eb4144b70aea29f61649d41f86/it-war)

Before this revolt, IT enjoyed complete control your organization's devices, applications, and data, which made it easy to keep information secure and the systems working within the requirements of the enterprise. This all changed when employees took IT into their own hands, otherwise known as [Shadow IT](https://www.informationweek.com/cloud/shadow-it-its-much-worse-than-you-think/a/d-id/1321637?).

Your consumer-focused mobile applications were so easy to use and enhanced your productivity to a point where it made sense to start using these same applications for work. You set up Dropbox to share your team's confidential documents, you started collaborating in Google Docs, and you built presentations on Prezi.

![Source](https://images.ctfassets.net/23aumh6u8s0i/6J2aXnEp5NJjxHAZnTVBYN/ace0c9ba4fa8ce22716e9797a79a12bd/Shadow-it-happens)

While you didn't think twice about using these apps, IT had a big problem on its hands. Workers started using [hundreds](http://www.itmanagerdaily.com/study-a-majority-of-workplace-apps-are-shadow-it/) of unsanctioned apps and accessing them outside of the office on their mobile devices. This blitz on the enterprise grew into a major security liability. Something had to be done.

## The Rise of Enterprise Mobility Management (EMM)

IT had a unique challenge to solve: how could they secure and track the confidential information living on their employee's mobile devices without impeding on the flexibility and productivity that employees now relied on to conduct business?

Enterprise mobility management (EMM) emerged as the solution, with the idea of helping IT take back control of the business-related applications and data living on employee devices without actually interfering with their personal apps.

<include src="TweetQuote" quoteText="Simply put, it is a set of services and technologies that work together to secure company-owned applications and data on your employees’ mobile devices."/>

EMM is still in its infancy. Simply put, it is a set of services and technologies that work together to secure company-owned applications and data on your employees’ mobile devices. While the concept is straightforward, the complexities to achieve this goal require completely new technological approaches that continue to evolve.

![Source](https://images.ctfassets.net/23aumh6u8s0i/1uyDEbLJKZv251Igzkp6Mk/fc042c1a9e98865303e3605890c8b4d7/emm-technical-challenges)

The volume and variety of mobile applications, operating systems and device types that need to be considered create the challenge for building EMM solutions. David Johnson, a principal analyst at Forrester Research, [upped the ante ](https://www.computerworld.com/article/3230510/mobile-wireless/what-is-enterprise-mobility-management-emm.html) extending EMM beyond mobile management:

> *EMM used to be mainly about mobile device and application management, but now it’s more about enabling mobility more broadly – extending to Windows 10 and MacOS devices, identity and access management strategy, and how to design mobile engaging and productive mobile experiences for employees.*

With so many moving pieces, the definitions and expectations of EMM continue to evolve. In order to get a solid grasp on where EMM is and where it's heading, it's helpful to look at the four areas currently driving the EMM strategy.

## 4 Components of EMM

We apologize in advance for the onslaught of [acronyms](http://thecontextofthings.com/2014/02/06/whats-up-with-the-over-use-and-obsession-on-acronyms-in-american-business-and-professional-culture/), but the best way to define EMM is by explaining its core components: MDM, MAM, MCM, and MIM.

While EMM can manifest itself in different ways depending on your requirements, the technology suite is primarily focused on managing four important aspects of mobile:

1. **Device: **Mobile device management (MDM)
2. **Applications: **Mobile application management (MAM)
3. **Content: **Mobile content management (MCM)
4. **Identity: **Mobile identity management (MIM)

![emm-platform](https://images.ctfassets.net/23aumh6u8s0i/23grw37EUvrZ85A5y7akCj/7b0c4cbdcb0ef2f324e322e63c56c772/emm-platform.png)

EMM is the comprehensive method of remotely managing devices, which is accomplished by incorporating the aforementioned four tools and strategies.

### 1. What is Mobile Device Management?

MDM is mistakenly used interchangeably with EMM. While MDM focuses on the device being secured, EMM encompasses both the device and the information which isn’t always stored in the device.

With MDM software, IT administrators can oversee mobile devices in the same way they manage your desktop computers in the office. They can remotely enroll the device and then track it, manage it and secure it based on the employee's profile and tasks.

![Source](https://images.ctfassets.net/23aumh6u8s0i/6L0odS5xyll40kQKpVouhz/f932ccd48d85281fc34031d5e7b9ca21/Mobile-Device-Management2)

The company can access your device to provision and configure Wi-Fi access, install and update apps, and fix any problems on the device. IT can also enforce security measures on the device such as locking out a device and wiping data.

### 2. What is Mobile Application Management?

MAM refers to the delivery and administration of the enterprise's software to the employee's device. While MDM focuses on device activation, provisioning, and troubleshooting, MAM tools deliver and manage all aspects of the mobile software (applications).

An important feature of MAM is providing the ability for IT to wipe company-owned apps and data remotely, without affecting the user's personal items.

![Source](https://images.ctfassets.net/23aumh6u8s0i/54eQbaZlFEfona8O2g2Yps/aa6be9ce02315c81dbd84f4e66dd48ec/mam-diagram-app-level_desktop)

The admin can also blacklist or whitelist applications and control their access permissions, which helps combat sensitive data flowing through unsanctioned applications.

When combined with MDM, MAM solutions can help IT better understand employee usage of the enterprise applications with behavioral analytics.

### 3. What is Mobile Content Management?

MCM uses a set of technology tools that secure access and storage of confidential content by implementing an encrypted, managed container.

Instead of storing important, company-owned content on personal apps like Dropbox or Google Drive, employees must adhere to the MCM policies for accessing and storing content and use the enterprise's preferred application. This not only keeps corporate content separate from personal but also gives IT the power to delete content from the device at will.

![Source](https://images.ctfassets.net/23aumh6u8s0i/64TMnRdcG4VDeutP1l7tNA/12aadff09555d571eb3deb51bbff5e9f/mobile-content-mgmt)

MCM is most effective when incorporated with MAM and MDM to ensure management of each level of the mobile enterprise. Identity management becomes the final component to keeping each level secure as it gives IT control over end-user access to specific apps, content, and sets of data.

### 4. What is Mobile Identity Management?

MIM is designed to ensure that only trusted devices and users can access enterprise data or applications. By authenticating the user’s identity and then tracking their activity, MIM gives IT the tools to manage access across devices and applications beyond the firewall.

Tools like [Auth0](https://auth0.com/), give administrators the ability to implement access security through:

* **Two-factor authentication:** [2FA](https://auth0.com/learn/two-factor-authentication/) provides an extra layer of security if a mobile device is lost or stolen. By asking for a second form of identification such as an SMS code; if credentials are ever compromised, the data is still secure.
* **Behavioral Alerts:** Auth0 provides [custom tools](https://auth0.com/docs/anomaly-detection) to detect anomalies and stop unauthorized access. By tracking behavior and geography, MIM tools will alert IT of suspicious activity and attempts to log in.
* **SSO (single sign-on):** [SSO](https://auth0.com/docs/sso/current) allows users to use one set of credentials to access multiple applications. When enterprises use dozens of apps, SSO gives employees the convenience of access without tedious logins for every app.

![Source](https://images.ctfassets.net/23aumh6u8s0i/27ARow6G5c3pb78x2Aq8H5/de558db7492ffb25b10c820fa9ddaba2/identity-mgmt)

Identity management is the glue that keeps MDM, MAM, and MCM secure. Each of these components serves a specific purpose within the EMM framework, but as they are incorporated into a cohesive system, enterprises are able to gain back control of their digital assets.

## How to Choose an EMM Provider

The technology suite of tools and services needed to deliver a complete EMM solution currently does not exist within one single vendor.

EMM is rapidly evolving, and there is a lack of industry standards and best practices. Like most IT initiatives, start your EMM vendor search by developing a set of objectives and requirements. Define your needs and research vendors based on individual capabilities.

Here are 4 questions to get you started:

1. **Do you offer application, content and identity management?** While most EMM products focus on device management, not all of them cover other aspects of mobile management.
2. **Do you support the platforms and technologies that we use?** Some EMM providers only support certain operating systems and devices. Don't assume they cover everything you need.
3. **What is your security approach for device and data?** Ensure your vendors are using the most advanced encryption and [identity tools](https://auth0.com/security) that comply with your security policies. 
4. **Does the technology integrate with the current infrastructure?** If you have a complex infrastructure, you will want to make sure the EMM solution integrates with your system. 

Choosing the right vendors comes down to analyzing their capabilities within the core competencies of EMM. Take each component and evaluate providers on their capabilities to deliver on these elements.

According to Gartner's Magic Quadrant [report](https://www.air-watch.com/resources/analyst-reports) on EMM:

> There are diverse vendor approaches to managing the mobile lifecycle, with many focusing on identity and access, content security, and containment. To be classified as an EMM suite, Gartner requires inclusion of MDM, MAM and at least one of the following: MIM, MCM or containment technologies. The most advanced suites will include all five technologies.

![gartner-quadrant-report](https://images.ctfassets.net/23aumh6u8s0i/52uhtpHVlYtii773TRiqA3/fcf0154e5fc23e244bc6307a843fd46d/gartner-quadrant-report.png)

While Gartner highlights vendors that try to incorporate several components, finding experts in each area might be a better way to go during the early stages of EMM. Niche providers that focus on one aspect of EMM often develop an expertise and can adapt quickly to the changing market.

Whether you choose an all-encompassing solution or create a suite of niche tools, partner with companies that have a vision for EMM and a roadmap for how their solutions will adapt as mobile matures.

## EMM Solutions Beyond Your Phone or Tablet

<include src="TweetQuote" quoteText="Enterprise mobility management is IT's answer to the employee revolution that forced companies to rethink their technology and data policies."/>

Enterprise mobility management is IT's answer to the employee revolution that forced companies to rethink their technology and data policies. EMM is not retaliation against employee mobility; it is actually the opposite. Companies want to keep their employees mobile and productive.

The future of EMM is going to be exciting as the definition of 'mobile device' expands to other connected devices, such as wearables and personal assistants. When [Alexa](https://en.wikipedia.org/wiki/Amazon_Alexa) starts helping people do their job, EMM will need to be ready.

"devices"