Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Get started and ship fast with Auth0 and Netlify

**TL;DR:** [New Auth0 Extension](https://www.netlify.com/integrations/auth0/) for Netlify: Available Now. We’ll go over why we partnered with Netlify and share resources to help you build and deploy an app.

## Why Should I Choose Auth0?

A secure login experience and access management are at the core of any application with users. Auth0 is a comprehensive auth solution built for developers with evolving needs. With Auth0, you can get your app to market fast by quickly turning on core features, enabling a secure experience for your users, and customizing experiences when your app’s needs change. 

## What is Netlify, and Why Did We Choose to Partner Together? 

[Netlify’s](https://www.netlify.com/) platform allows you to build highly performant and dynamic websites, e-commerce stores, and web applications. It also unites an extensive ecosystem of technologies, services, and APIs into one workflow to unlock team productivity. Integrating with a third-party platform like Auth0 allows Netlify users to deploy any modern frontend stack safely and securely. 

We both share a commitment to an excellent developer experience, so this partnership is a great fit. This extension allows you to leverage Netlify to innovate, scale, and ship while relying on Auth0 to enhance security and a great user experience. 

## Let’s Start Building with Auth0 and Netlify

Challenge: You’re looking to add authentication to your Netlify site easily.

Solution: Use this new extension to add authentication to your Netlify site and connect your Auth0 tenants to your Netlify account dashboard. 

This [guide](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/) will include instructions on how to set up the following while using the web framework Astro:

* Authentication flows for login/logout
* An Auth0-protected serverless function for serving user information

> [Let’s dive in here](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/).

Once complete, you will have built a static site and enabled the Auth0 extension. Congrats on successfully authenticating your new website! 🎉

## Have Questions?

If you want to learn more, check out the new [Netlify documentation](https://docs.netlify.com/integrations/auth0/). Share your thoughts on the guide [here](https://developers.netlify.com/guides/getting-started-with-the-new-auth0-extension-on-netlify/#guide-feedback-form).


Happy building!

_This blog may contain hyperlinks to non-Okta websites that are created and maintained by third parties who are solely responsible for the content on such websites._

New Auth0 Extension for Netlify: Available Now

Jax Painter

Director, Product Marketing

To meet innovation, experience, and security requirements, organizations must establish digital Identity strategies and implement them into every product and service.

## The Multifaceted Challenges of Managing Digital Identities

People leading development, technology, security, and product strategies collectively seek to drive innovation and improve customer and employee experiences. Aligning those teams while managing an increasingly complex technology and security threat landscape is easier said than done.

Without a unified digital Identity strategy, developers and product teams often experience problems balancing customer experience, security, and speed. These challenges create delays and slow product development cycles, from planning and coding to maintenance and scale out. Technology and security teams can also struggle to streamline access for employees in ways that don't create vulnerabilities.

The stakes to get Identity correct are so high that fear often creates additional blockers. No one wants to make a mistake that could jeopardize their career or end up being tomorrow’s headline. An organization's reputation is now deeply tied to how well it protects customer data against rapidly evolving threats. So the bottom line is: Security breaches and regulatory compliance issues can result in devastating costs. In 2024, the global average cost of a data breach was [$4.88 million](https://www.ibm.com/reports/data-breach), a 10% increase since 2023.

To meet today's (and tomorrow's) innovation, experience, and security requirements, organizations of all sizes must establish intentional digital Identity strategies and implement them into every product and service from the ground up.  

## Seamless Experiences Are Driven by Digital Identities

Business efficiency and growth depend on seamless experiences for customers and employees. All of these experiences — from customer-facing digital services and AI-driven innovations to employee onboarding and business intelligence — are driven by scalable Identity and data access controls.

Achieving business efficiency and growth is easier when teams can take advantage of automation, no-code solutions, AI, and other technologies to eliminate rote work and focus on what drives the business forward. Along with equipping developers and product teams with intelligent, integrated tools for managing authentication, a unified digital Identity solution also empowers technology and security teams with flexible, scalable tools for managing customer and employee access. By implementing an integrated strategy for digital identities, organizations can:

* Infuse consistent Identity practices into agile development processes
* Implement critical changes like single sign-on and privileged access management faster
* Scale out solutions with less effort
* Help prevent risks associated with cloud usage, shadow IT, and anywhere collaboration
* Keep up with rapidly evolving cybersecurity challenges and regulations

## A Unified Digital Identity Approach Makes It Easier to Drive Innovation with Data

Effective and easy-to-use digital Identity solutions can empower any organization to fearlessly innovate and readily adapt to changing markets and customer demands. With the right authentication and access management tools, teams can safely leverage data to develop differentiating experiences and products using technologies like AI.

Organizations that successfully implement a unified digital Identity strategy realize measurable benefits across multiple fronts through financial savings and by improving productivity throughout the organization. In a research study, IDC found that companies using CIAM solutions [saved $4.3 million](https://www.okta.com/sites/default/files/2022-06/TheBusinessValueofOktaCustomerIdentityandAccessManagement.pdf) through productivity improvements alone, and for every customer-facing application they saw >$166,000 in combined annual benefits. IDC also found team efficiency benefits throughout organizations, with a 33% time savings for IT and infrastructure teams, 23% for developer teams, and 13% for security teams. 

## Identity Is Everyone’s Business 

When leaders spearheading development, technology, security, and product roadmaps understand how important a unified digital Identity strategy is, they can work together on a comprehensive strategy that equips everyone to achieve their goals. 

Developers can quickly and easily build and maintain required authentication flows that don't break and keep customers happy. Security teams can see who has access to what, when, and under whose authorization — on demand and across silos. 

Product teams can get to market faster while helping to ensure customers that their data is safe. Technology leaders can implement unified solutions that scale, lower risk, and ultimately improve the experiences of employees and customers. 

Interested in learning how to implement a collaborative strategy for digital identities? Stay tuned for the next four blogs in the Innovation Ignited series covering Identity responsibilities that development, technology, security, and product leaders face and the outcomes they can realize with a unified digital Identity strategy.

* Create a culture of synergy with digital identities: This piece explains how development leaders can empower teams to overcome authentication complexity and focus on creating differentiating solutions that improve customer experience 
* Ignite innovation with digital Identity: This piece explores how technology leaders can optimize Identity and Access Management and authentication to create a culture of alignment that fuels collaboration and continuous improvement
* How to keep your developers focused on development: Identity management burdens often overwhelm developers and delay product launches, but leaders can streamline authentication through unified digital identity solutions, allowing teams to focus on core innovation
* Accelerate product workflows and adoption: Learn how product leaders can create ambitious and realistic roadmaps that include differentiating authentication capabilities — while accelerating the journey from ideas to market success

## Accelerate Your Organization's Growth

Improve user experience, security, and innovation with a unified digital Identity solution. 

> [Read more from Auth0 thought leaders](https://www.okta.com/blog/)

## Resources

Auth0 equips organizations with an intelligent, integrated digital Identity solution that makes it easier to meet security and business requirements — and drive growth, differentiation, and impact. To learn more about how Auth0 equips businesses of all sizes with the tools they need for unified digital Identity strategies, check out the following resources.

* [Okta Named a Leader in 2023 Gartner® Magic Quadrant™ for Access Management for Seventh Consecutive Year](https://www.okta.com/press-room/press-releases/okta-named-a-leader-in-2023-gartnerr-magic-quadranttm-for-access/)
* [Okta named a Leader in first ever Forrester Wave™️ for Workforce Identity Platforms](https://www.okta.com/resources/analyst-research-okta-named-a-leader-in-first-ever-forrester-wavetm-for-workforce/)
* [Okta Recognized as a Gartner® Peer Insights™ Customers' Choice for Access Management](https://www.okta.com/resources/analyst-research-okta-recognized-as-a-2024-gartner-peer-insights/)

Innovation Ignited: How to Start Your Digital Identity Management Journey

paulo-nascimento

Paulo Nascimento is a Machine Learning Engineer at Okta, spearheading AI development for the Customer Identity Cloud (CIC). He brings expertise from AI startups to create innovative solutions powering the CIC organization. Paulo's work focuses on integrating AI technologies to strengthen enterprise security, enhance user experience, and drive intelligent automation across Okta's identity platform.

Machine Learning Engineer

Paulo Nascimento

Waleed Manzoul

Staff Product Designer

Automate user lifecycle, enhance security and boost IT efficiency across your enterprise

## Introduction

Consider a Fortune 500 company, like a bank with 40,000 employees. A financial analyst at this company will use many SaaS tools to do their job, like Slack, Google Suite for Work, Zoom, Tableau, Workday, and more. In fact, enterprise organizations rely on [an average of 211 apps each](https://www.okta.com/businesses-at-work/) to run their businesses.

So, the bank’s central IT team might be responsible for managing 200+ SaaS apps, and our financial analyst may need access to a quarter of them. Naturally, for an employee to use all of those apps, accounts for each one would need to be provisioned first.

Fortunately, our bank’s IT team is smart. They utilize [Okta Workforce Identity Cloud](https://www.okta.com/workforce-identity/) to maintain [a directory of all their employees](https://www.okta.com/products/universal-directory/) and enable easy account creation and access to those SaaS apps using [Single Sign-On](https://auth0.com/docs/authenticate/single-sign-on). That means they don’t have to manually provision SaaS apps every time a new employee joins the company or an existing employee needs access.

But what about other events in an employee’s time with the company, such as when they change their role, change their name or pronouns, or eventually leave the company? How many times might those events happen over 40,000 employees? And how might each of those changes be reflected in the SaaS apps that they use?

## User Lifecycle Management Using SCIM

Fortunately, if a SaaS app used at the company relies on a workforce provisioning engine that utilizes SCIM ([System for Cross Identity Management](https://scim.cloud/), a standard for automating the exchange of user identity information between identity domains), that app can synchronize its user list to the central employee directory and react to changes that happen in the directory.

For the bank’s central IT team, this means they can make updates to users once in their central employee directory and have those changes reflected in all of the SaaS apps an employee uses, **reducing administrative overhead and toil**.

The power of this “live” connection that SCIM provides becomes critical when an employee leaves the company. Once central IT deletes this employee from their central directory, any user accounts they had with those SCIM-powered SaaS apps will be deactivated within seconds, **eliminating the chance of unauthorized access** through “[zombie accounts](https://www.wsj.com/tech/cybersecurity/unused-online-accounts-data-safety-38fa675e)” and **maintaining compliance with data privacy regulations**, like [GDPR](https://gdpr-info.eu/art-5-gdpr/).

Timely deprovisioning of former employees can have **cost savings** as well. When an employee leaves, the central IT team can quickly release the employee’s SaaS licenses and accurately reflect the reduced spend to the respective vendors.

So, you can imagine that the bank’s central IT team would want any new SaaS app it evaluates to leverage SCIM due to its many benefits:

* Saves a lot of manual labor
* Improves their security posture
* Saves their company money

## How Does SCIM Provisioning Work?

SCIM works by providing a defined schema of identity data that represents users and groups, along with a REST API that supports JSON and XML for CRUD operations on those user and group resources. 

Behind the scenes, SCIM is broken down into a few core components:

* SCIM Service Provider
    * This service hosts the identity data and responds to SCIM API requests. It’s also commonly called a SCIM server.
    * _Examples: Cloud applications, identity providers (e.g., Okta)_
* SCIM Client
    * The SCIM Client **initiates SCIM requests to interact with a SCIM server to perform operations that manage identities.**
    * _Examples: Identity management systems, HR systems_
* SCIM Schema
    * The SCIM schema defines the structure of identity data.
    * Core schemas: User, Group, EnterpriseUser (defined in [RFC7643](https://datatracker.ietf.org/doc/html/rfc7643))

The SCIM core components then use an HTTP-based REST API that supports JSON and XML data formats, although JSON is more common. The REST API uses standard HTTP methods like GET, POST, PUT, PATCH, and DELETE to support CRUD operations.

SCIM supports a number of key operations, such as:

* User Provisioning
    * The ”SCIM Client” sends a POST request to create a new user, and the ”SCIM Provider” creates the user and returns a unique identifier (ID).
* User Retrieval
    * The ”SCIM Client” sends a GET request with the user ID or search criteria, and the ”SCIM Provider” returns user data that matches the request, provided the user exists.
* User Update
    * The ”SCIM Client” sends a PUT or PATCH request with the updated user data, and the ”SCIM Provider” applies changes and confirms the update.
* User Deprovisioning
    * The ”SCIM Client” sends a DELETE request, and the ”SCIM Provider” removes or deactivates the user account.

On top of this core functionality, SCIM also provides useful features such as: 

* Bulk Operations
    * Where batch processing can be applied for multiple SCIM operations in a single request
* Filtering and Searching
    * Allows complex queries to find specific users or groups by using a standardized filter syntax

For each request, the SCIM REST API will return with the appropriate HTTP status to indicate success or failure along with detailed error messages for troubleshooting. SCIM typically uses OAuth 2.0 for authorization and supports HTTPS for secure data transmission.

SCIM is also extensible, which means that organizations can extend the standard SCIM schemas to accommodate their specific needs. For example, if an organization wants to include additional information about employees not covered by the standard SCIM schemas, then they can store additional information such as ”department” or ”manager” in their user profiles.

## SCIM vs SAML

Security Assertion Markup Language (SAML) is an XML-based framework for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It’s most commonly used to enable Single Sign-On (SSO) across different web applications and services.

SCIM and SAML are both protocols for identity and access management (IAM). However, they serve different purposes. 

SCIM is used for user provisioning and management across different systems and applications, ensuring that identity data is consistent across. SAML, on the other hand, is used to access multiple applications with a single set of credentials.

> In summary, SCIM is for user management, while SAML is for user authentication.

## SCIM vs. SSO

Single Sign-On (SSO) is an authentication method that allows users to sign in to multiple applications with a single set of credentials.

Although SCIM and SSO are related, SCIM is a protocol used for provisioning appropriate roles and groups to users, whereas SSO authenticates those users into multiple accounts with a single set of login credentials.

## Inbound SCIM with Auth0

If you’ve been reading about SCIM online, you’ve probably found identity providers like Okta Workforce Identity Cloud and Microsoft Entra ID support SCIM in different ways, and that building for each of them can become a substantive effort. We’d advise that you learn about the identity providers your customers use and tailor your SCIM solution to meet the majority of your customers. However, If you think you will need to integrate your development with more than one identity provider, don't despair: there are solutions that allow you to easily connect to multiple identity providers at once. 

In fact, that's one of the things we do at Auth0. Our [Inbound SCIM solution](https://auth0.com/docs/authenticate/protocols/scim) allows you to integrate with Okta Workforce Identity Cloud, Microsoft Entra ID, and other identity providers via both SAML and OpenID Connect, manage attribute mappings on a per connection basis, and more. 

## Conclusion

SCIM is a powerful way to automate user lifecycles and maintain user accounts across platforms that can save companies time, money, and increase their security. Learn more about SCIM by exploring the [Auth0 docs](https://auth0.com/docs/authenticate/protocols/scim). 


Streamline Account Provisioning and Management with SCIM

Mallory Sword Glenn

Mallory Sword Glenn is a Senior Product Marketing Manager for Okta’s Customer Identity products. Her key focus is showcasing how organizations can create secure and seamless digital experiences for their end users using Okta’s identity products. Prior to joining the Product Marketing team, Mallory led the pricing strategy for Customer Identity products on Okta’s Pricing team. Mallory has a breadth of SaaS experience spanning go-to-market, pricing, deal strategy, and operations at companies like Adobe and HPE.

Senior Product Marketing Manager, CIAM

Learn how Identity and Access Management (IAM) helps level the digital playing field for everyone.

Wheelchair ramps, braille, text captions, large print books are all examples of accessibility in the real world. We use these as tools to help ensure everyone has equal access to places and resources. But what about the internet and technology? What tools exist in the digital world to ensure everyone has access to digital resources? 

One of the opportunities we have through the internet and technology is a better chance at leveling the playing field for everyone and ensuring equal access to digital resources and experiences, especially for those experiencing disabilities. 

## The Complexity of Accessibility

Developers are already familiar with many of the complexities of identity and access management (IAM), but one often overlooked complexity is around accessibility. How do you ensure that the steps you’re taking to secure your customers and their accounts aren’t introducing unnecessary friction for some groups? 

Here, we talk specifically about accessibility as it relates to Customer Identity and Access Management, but many of the same considerations also apply to Identity and Access Management as a whole.

## What Are Some of the Things We Should Think about When It Comes to Identity and Accessibility? 

When we talk about accessibility, we’re not only talking about physical disabilities like impaired hearing or vision. It’s also important to think about different social groups that could be impacted, such as aging populations or those with reduced access to the internet or technology. 

For identity specifically, we need to think about accessibility in a few different contexts: 

* **Sign-up process** - A user's journey often starts with the sign-up process. 
    * Considering populations that might be accessing with a poor internet connection, we need to ask whether the sign-up flow is lightweight enough to allow optimal functionality. Ensure the sign-up flow is accessible across different devices and that it is formatted correctly – the size of the text should be large enough to read on smaller devices. 
    * For users that might not be as familiar with password security, do you guide them through the process to ensure they have a secure password by checking for breached passwords or recommending certain password parameters? 
* **Sign-in process** - Many of the same rules apply to the sign-in process as to the sign-up process. 
    * Is it easy to know where to log in and what information is needed? Make it easy to find where to log in – don’t hide your login button on a busy webpage. Then, once users get to your login box, make it clear what information the customer needs to provide to log in – whether that’s a phone number, email, username, password, etc. 
    * Do you make it easy to recover a forgotten password or perform a self-service password reset? Use clear language and provide step-by-step instructions that help users gain access to their account when they’ve forgotten their credentials.
* **Multi-factor authentication** - Multi-factor authentication is one of the best steps we can take to help users secure their accounts and protect them from account takeover. However, we also need to consider the accessibility of the MFA solution we’re offering. 
    * Do you offer multiple factors that can meet people where they are? While SMS might be a preferred factor for some, it could serve as an impediment to others who might be better suited for voice or biometrics as a second factor. 
    * Is the MFA enrollment process simple for users that might not be technologically savvy? Does it require the user to switch between multiple devices? Does it require the user to have an internet connection? By offering your users options, you can ensure you’re providing your customers with that extra layer of protection while still maintaining a frictionless experience that’s accessible to all. 

## What Steps Can You Take to Ensure You’re Securing Users While Maintaining Accessibility? 

Accessibility is something that varies from person to person and application to application. There’s no one-size-fits-all solution when it comes to web accessibility. The full scope of accessibility generally relies on many different applications, settings, and devices working together. However, you can do your part to make your customer identity more accessible by:

* **Bringing awareness** - You’ve already taken one of the first steps toward making your customer identity more accessible by simply being aware. Going forward, you can put accessibility at the front of your development process, considering the accessibility implications of different solutions as you’re planning and building your application.
* **Reviewing the WCAG guidelines** - [WCAG 2.1](https://www.w3.org/TR/WCAG20/) outlines the best practices for digital accessibility. They also offer tests and techniques you can use to enhance accessibility for your application. Following the guidelines here, you can make your web content more accessible to more audiences. 
* **Allowing more choice in your login flow** -  While you might think it seems easy enough to verify your identity using a OTP from an authenticator, this could be a huge barrier to someone who isn’t technologically savvy, doesn’t have a mobile device, or is visually impaired. Allowing your users to choose from different MFA factors allows them to choose one that works best for them. Similarly, allowing your users to have the ability to recover a lost password or perform self-service password reset means they don’t have to call a help desk if they forget their password. By providing options to your users, they can choose what works best for them. 
* **Use social login or passwordless** - If users have already registered for an account elsewhere, why not allow them to use that account to access your application? Social login is a great place to start and can be as simple as clicking a button. It doesn’t require users to go through a sign-up process or memorize another password. Passwordless login allows users to leverage things like email magic links to log in. 

## How Does Okta Consider Accessibility When Building Features and Products? 

One of the benefits of using an identity solution like Okta is that we provide you with tools to make it easier to deploy accessible solutions to your users. Okta is continuously working to improve the functionality of its products in support of accessibility standards such as Section 508 of the US Rehabilitation Act of 1973 as well as the Web Content Accessibility Guidelines (WCAG). [This page](https://www.okta.com/accessibility/) provides information about our efforts to provide a more accessible experience to your end-users.

If you want to learn more about our journey to a more accessible login, check out our blog post [here](https://auth0.com/blog/auth0s-journey-towards-a-customizable-and-accessible-login-experience/). 

_These materials and any recommendations within are not legal, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current legal and compliance developments nor all relevant issues. You are responsible for obtaining legal, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials.  Information regarding Okta's contractual assurances to its customers can be found at[ okta.com/agreements](http://okta.com/agreements)._


How Can We Make Identity Accessible for Everyone?

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn what username and password authentication is and how to implement it.



Passwords have been used throughout history to verify someone's identity by checking if they possess the knowledge required (i.e., a password) to access something.

In Ancient Rome, a new **watchword** was assigned every day and engraved into a tablet. Roman soldiers had to retrieve the tablets every evening at sunset and share them with their unit so that they would know the watchword for the following day. These watchwords were required for soldiers to identify themselves as Roman soldiers so they could enter certain areas.

Since then, we've been using watchwords, now known as passwords, to verify someone's identity.

But does possessing knowledge of something actually confirm one's identity? In this article, you'll learn what username and password authentication is, some of the challenges that come with it, and one simple solution to address most of these challenges.

## What is Username and Password Authentication

Authentication is the process of verifying who a user claims to be.

There are three *factors of authentication*:

- What you know &mdash; Something you know, such as a password, PIN, personal information like mother's maiden name, etc.
- What you have &mdash; A physical item you have, such as a cell phone or a card.
- What you are &mdash; Biometric data, such as fingerprint, retina scan, etc.

Password authentication falls into the "**what you know**" category and is the most common form of authentication.

Every time you've signed up for a website, you've likely been asked to create a username and password. Because this is such a common process now, it's become almost second-nature for some users to set up their accounts without much thought about the credentials they choose. And unfortunately, there's a lot at stake if a user chooses weak credentials.

## How to Implement Password Authentication

Let's take a look at what goes on behind the scenes during the authentication process.

### Registering with username and password

When a user first signs up for your website, they're asked to choose a username and password to identify themselves.

In an ideal world, the user would always pick a **strong** and **unique** password so that it's harder for an attacker to guess. Unfortunately, we don't live in an ideal world. For this reason, it's up to you as the developer to enforce this.

### Enforcing password rules

When it comes to password safety, the longer and more complex the password is, the better.

It's a good practice to enforce certain minimum requirements when asking users to create a new password. Of course, you have to find a balance between these requirements and user experience. If you make the sign-up process too tedious, you could be driving users away.

To enforce password strength, you should define a set of rules that a password must satisfy and then enforce these with form validation.

**Example password strength rules:**

- Minimum of 8 characters
- At least one uppercase letter
- At least one number
- At least one special character

![Password strength rules](https://images.ctfassets.net/23aumh6u8s0i/5vskkg7xuCI74lUGyFL4FV/4499209de18d829ef21ca625651c963d/password-strength-rules)

### Storing the user's credentials

Once the user chooses their username and password and clicks submit, then the real fun begins: storing the user's credentials.

First, you have to check that the user doesn't already exist in the database. Once that's clear, you should again check that their password matches your minimum requirements, but this time you'll be confirming server side.

Once you decide that the credentials *should* be stored, it's time to save them to your database. However, there's one more step that must occur before you can do this: password hashing.

**Hashing** &mdash; [Password hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) involves using a one-way cryptographic function that takes an input of any size and outputs a different string of a fixed size.

![Hashing algorithm flow](https://images.ctfassets.net/23aumh6u8s0i/ES2U6Gx7w0yVF9Asidr26/75531c3695f09272142b543a94acc0de/hash-flow)

Before you store any passwords in your database, you should **always** hash them. The hashed password will be unrecognizable from the plaintext password, and it will be impossible to regenerate the plaintext password based on the hashed one. If someone gains access to your database, you don't want them to be able to swipe your entire users table and immediately have access to all user login credentials. That's why it's absolutely essential to hash your passwords.

> ℹ️ Make sure you use a secure and vetted hashing algorithm when implementing password hashing.

Most programming languages will have either built-in functionality for password hashing or an external library you can use. [bcrypt](https://auth0.com/blog/hashing-in-action-understanding-bcrypt/#What-is--code-bcrypt--code--) is one popular library that can help you hash passwords. Whatever you do, make sure you don't try to roll out your own hashing algorithm.

✏️ To learn more about bcrypt, check out this excellent article: [Hashing in Action &mdash; Understanding bcrypt](https://auth0.com/blog/hashing-in-action-understanding-bcrypt/).

### Handling returning users

After your users' register, they're hopefully going to want to come back, and when they do, you need to verify that they are who they say they are.

Once they submit their credentials through the login form, you'll search your database for the username they're signing in with. If you get a match, then you check the hashed password that they typed in with the hashed password stored in your database.

Now that your users are able to sign up and log back in, you still have one more case to handle. What do you do if a user forgets their credentials? In this case, let's assume that the username that you required users to sign in with was an email address. You'll need to generate a password reset link, email that to the user, and allow them to set a new password.

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

Because you have the user's hashed password stored in the database, and you used a one-way hashing function, there's no way to let the user know what their old password was. Therefore, they'll have to reset their password.

### Implementing with Auth0

Implementing all of this takes a lot of work. With [Auth0](https://auth0.com), you can add username and password authentication to your application in just *minutes*.

> 🔥 You can <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account </a> now to get started immediately.

Once you have an account, head over to the [Auth0 Quickstarts page](https://auth0.com/docs/quickstarts) for an easy-to-follow guide on implementing authentication using the language or framework of your choice.

In the next section, you'll see some of the challenges of password authentication. Keep in mind, Auth0 has built-in solutions for all of these challenges as well.

## Challenges of Password Authentication

Username and password authentication is a great starting point, but it's **just not enough**. Let's look at some of the challenges that come with password authentication.

The implementation, intuitively, seems pretty bulletproof. You required your users to choose passwords with a certain complexity, and you hashed the passwords before storing them so that in the event your database is breached, the attackers won't have a goldmine of user login credentials. Great, right?

Well, not so fast.

### Password attack methods

Even with these safeguards in place, password authentication is still vulnerable to a multitude of attacks. Let's take a look at some of these.

**Credential stuffing attacks** &mdash; An automated attack where the attacker repeatedly tries to sign in to an application using a list of compromised credentials, usually taken from a breach on a different application.

The credential lists used in [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) come from previously breached data across the web that a bad actor got their hands on. These attacks are extremely prevalent and have become one of the most widely used password attack methods. Even at Auth0, almost [half of the login requests](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/) we receive daily are attempts at credential stuffing.

This begs the question, why would any of these credentials even work if they were stolen from a *different* application? The short answer is, **users reuse their passwords**!

Most people have hundreds of online accounts, so it would be virtually impossible to memorize every single login combination without a password manager. According to [some research](https://www.passwordmanager.com/password-manager-trust-survey), less than 25% of people use password managers. For those that don't, there's a pretty good chance they're reusing the same password across multiple accounts, or even worse, *all* accounts.

<include src="ebook-ads/CredentialStuffingAttacksWhitepaper" />

**Rainbow table attacks** &mdash; An attack that attempts to crack a hashed password by comparing it to a database of pre-determined password hashes, known as a rainbow table.

Earlier, you learned about why it's important to always hash passwords before storing them. If an attacker gains access to your database, you don't want them to have immediate access to plaintext passwords, so you hash them. While this does make it more difficult for a bad actor to exploit, it's still not impossible.

A rainbow table will take frequently used passwords, hash them using a common hashing algorithm, and store the hashed password in a table next to the plaintext password. Then, if an attacker gains access to a database that contains hashed passwords, they can compare the stolen hashes to those that are pre-computed in the rainbow table. If any of the hashes match, then they will know the original plaintext password.

**Brute force attacks** &mdash; An attack that uses trial and error to try out every combination of possible passwords until the correct one is found.

This isn't the most efficient way to crack a password, but it can produce results nonetheless. You may be surprised at how fast a computer can brute force a seemingly complicated password. If you're curious, [How Secure is My Password](https://howsecureismypassword.net/) is an awesome tool that you can play around with to see how fast any password can be cracked.

## Wrap Up

As you can see, username and password authentication still has some pitfalls, especially if done incorrectly. Luckily, there's a simple way to combat all of these challenges: **multi-factor authentication**.

Multi-factor authentication involves bringing in an additional factor (what you know, what you have, what you are) on top of the username and password combination to identify a user. In this case, you already have "what you know" covered with the username and password, so the additional factor would have to come from one of the other two categories. This can be something as simple as a text message to the user's phone to verify that they are who they say they are after they sign in with their credentials.

One [analysis by Microsoft](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/your-pa-word-doesn-t-matter/ba-p/731984) has suggested that multi-factor authentication could have stopped up to 99.9% of credential stuffing attacks!

To learn more about multi-factor authentication and how you can enable it on your own application, check out the [Multi-factor Authentication Guide](https://auth0.com/blog/multifactor-authentication-mfa/). 

<include src="asides/AboutAuth0" />


Username and Password Authentication

dean-scontras

Dean Scontras has spent the last two decades in public sector sales roles at high-growth cybersecurity and technology companies, including Duo Security, MobileIron, and Hewlett-Packard. Currently, Dean sits on the advisory board of Advanced Technology Academic Research Center (ATARC) and DiversifyIT. Prior to joining Auth0, he served as the vice president of U.S. Public Sector at Duo Security (acquired by Cisco), leading federal, state, local, and education sales initiatives, alongside securing the company’s successful FedRAMP certification.

VP, State and Local Government and Education, Okta and Auth0

Dean Scontras

Evaluating Identity Management in the Public Sector

Recently, I attended a National Association of State Chief Information Officers (NASCIO)

Committee meeting where one state gave an impressive presentation on how they built their own [Identity-as-a-Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) for all of their citizens. It was a massive undertaking that took the better part of four years and required buy-in from the highest levels of the state government.

Not for the faint of heart, but to this state’s credit, they did it.

Enrollment is up, and applications have been added. However, even by their own admission, if they had to do it again, they may have chosen to buy or consider a hybrid approach (build and buy).

A modern state identity solution like Auth0 provides the option for governments to do both: build and buy.

## The Rise of Citizen Digital Services

Current and potential customers sometimes cite future uncertainty as one reason they choose to keep IDaaS development in-house, but digital citizen services are here to stay. [NASCIO recently affirmed in their 2021 State CIO Top 10 Priorities](https://www.nascio.org/wp-content/uploads/2020/12/NASCIO_CIOTopTenPriorities.pdf) that digital citizen services, Identity and Access Management (IAM), and the shift to cloud are all top priorities.

As a result, [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) solutions and statewide Single Sign On (SSO) for citizens should remain top priorities to work towards for state IT. In fact, as the digital natives age, the demand for digital citizen services will only _continue_ to grow, as will the expectations for competitive customer experiences.

The public expects to interact with the government the way they do with other websites and applications like their bank. There is a growing understanding of this among state governments and other public sector institutions. Subsequently, those who opt to build IDaaS solutions from scratch will be forced to adapt, support, and scale with the speed and agility of private SaaS companies.

But building the solution is just the beginning.

## Customizable CIAM for Custom Applications

Departments that [opt to build their own CIAM](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management) solutions will have to keep up with changes, emerging threats, breaches, and outages, along with emerging compliance and privacy requirements; then there’s the need to keep pace with citizen demand for new features as the internet evolves.

In government administrations that change frequently, CIOs leave. The potential of the solution becoming antiquated or obsolete is real. By having a modern state identity solution as at least part of your solution, you can still private label it as your own while using a pre-built solution that can be quickly picked up by a new development team.

Cloud-based identity solutions like Auth0 provide an elastic identity engine that can expand or recede. It provides a nice hedge against the future, just in case.

Another reservation expressed with the “build” approach is the ‘speed to service’. How quickly can state governments make applications available to the general public by building them versus partnering with custom IDaaS solution companies like Auth0?

Typically, one of the most critical parts of a project is wiring up applications for identity. States can take months, even years developing their own IDaaS solutions and slow the rollout of their applications. This can mean citizens are not getting access to crucial services for long periods of time.

## Offloading CIAM to Expedite Secure Application Deployment

With a buyable solution like Auth0, state administrations are able to roll out digital services in days versus years for a custom-built in-house solution. The back-end of Auth0’s solutions are pre-built, allowing teams to customize quickly with low to no-code inputs from a development team to get a new release deployed faster.

This is Auth0’s sweet spot: our extensibility. The right buyable CIAM solution is customizable and designed to offload the burden of custom configuration for developers. This enables government organizations to move faster and get citizen technology shipped sooner without compromising on the security of critical information.

Buyable CIAM solutions like Auth0 will produce the seamlessly secure customer experience that citizens have come to expect from digital portals while offering developers and IT teams the customization and extensibility they need to get projects out the door sooner.

To learn more about CIAM for government, [start with our whitepaper](https://auth0.com/resources/whitepapers/how-identity-forms-a-foundation-for-digital-govenrment) then get in touch with our identity specialists to continue the conversation.

Finally, it is our opinion there is a vast difference between those who build IT identity solutions meant for the workforce and those who build them for customers and citizens. CIAM solutions often require a great amount of extensibility and flexibility, whereas off-the-shelf third-party applications for the workforce are plug and play.

Perhaps the answer is not build or buy, but both. Use Auth0 as part of your build scenario, if only as a hedge against the future.

State Identity Solutions: Build? Buy? Or Both?

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

IAM starts at the login box but impacts security, analytics, and user experience

Identity and Access Management (IAM) is the branch of IT concerned with verifying users' identity and controlling their access to digital resources. Or, as [Gartner defines it](https://www.gartner.com/en/information-technology/glossary/identity-and-access-management-iam): "IAM is the discipline that enables the right individuals to access the right resources at the right times for the right reasons."

<iframe width="560" height="315" src="https://www.youtube.com/embed/IKxigcbhsGk" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## IAM Key Concepts: Authentication vs. Authorization

As the name indicates, IAM concerns both verifying users' identity (authentication) and granting them access to data based on that identity (authorization). These concepts are interrelated but not interchangeable, and understanding each is critical to grasp the larger meaning of IAM.

**Authentication refers to the methods you use to determine that someone is who they claim to be.** The classic authentication method is the username-password combination. However, using passwords alone for authentication is increasingly regarded as insecure since passwords are easy for hackers to guess or steal via [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/).

Today's gold standard for verifying identity is [multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication), which supplements passwords with authentication methods that are harder to fake, such as a biometric scan or a code sent to a user's personal device.

![MFA](https://images.ctfassets.net/23aumh6u8s0i/7ujWt3YR4Lc2D6MlbcibdZ/a5a02d1d95abd9014ab6d30d86dc5bb9/mfa-iam)

For a real-world metaphor, imagine going to a nightclub where you're on the list. The bouncer checks your ID to make sure you're really you (authentication). Then the bouncer lets you in and tells you that there's an asterisk next to your name, which means you're allowed into the VIP section (authorization).

**Authorization is the allocation or delegation of permissions to a particular individual or type of user.** For example, in the nightclub, a regular patron has access to the dance floor, a VIP is allowed behind the velvet ropes, but only the owner can get into the back office with the safe.

A modern IAM platform lets admins control authorization from a central user dashboard and via APIs, saving time and preventing security incidents. For instance, you could log into your IAM dashboard and grant a specific freelancer the ability to edit their own pieces. Likewise, if an administrator leaves the company, you can revoke access, so they don't walk away with valuable intellectual property.

![Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7BQhEA3AimOi3dxgnAJv2h/2b4b1d707578bbb9f4fbf6e3160f610d/dashboard-iam)

## Types of IAM

Most organizations have multiple classes of users with different identity needs: their workforce, their business partners, and their customers. Even if you're using the same IAM platform for all three, you'll need to take a different approach for each.

### Workforce identity

The average business makes use of a wide variety of applications. Say you buy and provision to your employees (like Slack or WordPress) and some you build in-house. In either case, you need a [workforce IAM approach](https://auth0.com/b2e-identity-management-for-employees/) that integrates with all these disparate apps. As in our earlier example of the library, you use this to allocate permissions based on roles or individual identities.

### Customer Identity (CIAM)

[Customer identity and access management (CIAM)](https://auth0.com/b2c-customer-identity-management/) is its own branch of IAM and is used to control access to your external applications. You're most likely to use social logins here and generally focus on reducing friction (while still implementing appropriate security). [CIAM](https://auth0.com/blog/what-is-ciam/) is rapidly expanding as people log in on more devices, like smart TVs and wearables. 

A CIAM platform is concerned not just with the end user's login experience, but with gathering information about them into a data-rich identity profile. The greater your understanding of your users, the greater your ability to provide value for them. 

With this valuable data comes a huge responsibility: of obeying data privacy laws regarding data collection and storage, and sensitive data against breaches. Given that, a major (though often invisible) element of CIAM is controlling access to customer data by your own employees and third parties.

### B2B identity

IAM for enterprise customers might be the most specialized branch of identity management. It's also one of the most complex since large enterprises operate on different back-end technology stacks. 

Custom-made identity solutions often falter here and struggle to scale when onboarding multiple large customers. That's why startups often switch to third-party IAM platforms when they begin to move upmarket, so they can quickly federate identity using any provider and on any technology stack.

## IAM Tools

An old-fashioned approach to IAM might be as simple as a login box and some basic, role-based permissions. For instance, a public library with a digital card catalog just needs to let patrons log in and ensure they can't access functions reserved for the librarians.

But that limited understanding of IAM is ill-suited to a post-digitization world. These days, most organizations utilize a vast number of applications, and personal data can be both a valuable asset and a dangerous legal liability. If that same public library wants to let patrons log into all nearby branches with the same credentials, interface with local school software to connect students with books, and simultaneously protect those students' data, they'll need a much broader set of tools than a simple login box.

Today, most IAM platforms provide some combination of the following tools and features, albeit with varying levels of customizability and extensibility.

### Single Sign-On (SSO)

[SSO](https://auth0.com/docs/sso/current) is an IAM tool that enables a user to log into one of an organization's properties and automatically be logged into a designated set of other properties. For example, when you log into Google, you're automatically logged into your Gmail and YouTube accounts. For users, SSO reduces friction since they don't have to keep track of different credentials for every application. For organizations, SSO helps in collecting valuable insights about user behavior and preferences since it tracks them as they move from one application to another, connected by a single login.

### Federated Identity

While SSO lets users log into different properties or brands owned by a single organization, federated identity does the same thing across multiple organizations.

Most people are familiar with federated identity through [social login](https://auth0.com/learn/social-login/), in which you can use your Google, Facebook, or Apple ID to log into a wide range of apps. Federation is built on trust, so when you order from a food delivery app with your Apple ID, you're not ordering from Apple but indicating that the app trusts Apple enough to take their word that you are who you claim to be.

For [B2B federation](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/), there are a different set of enterprise connections, such as Active Directory, Azure, SAML, LDAP, and ADFS.

![B2B Federation](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation is often a challenge because different organizations use different technology stacks and enterprise connections. But a robust IAM solution such as Auth0 integrates across numerous providers, saving companies from having to code complex workarounds to make different back ends communicate with one another.

### Multi-factor authentication (MFA)

As we mentioned earlier, implementing MFA is crucial to protect your organization's data from malicious intrusions, and virtually every IAM platform offers some form of MFA. However, it's equally crucial to customize MFA with the appropriate level of security. IN B2C contexts, you need to consider UX and try not to create unnecessary friction for users who don't want to be subjected to heightened scrutiny every time they log in. For workforce IAM, you may want more stringent MFA, since the consequences of an unauthorized party gaining access to your private network can be so devastating.

A modern IAM solution will allow you to implement MFA only when it's needed. This can be accomplished through [step-up authentication or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) in which users only trigger MFA if they're trying to access sensitive data or their behavior is flagged as risky.

### Anomaly detection

In the past few years, identity has become the preferred gateway for hackers to break into systems. Brute force attacks, credential stuffing attacks, and even highly targeted phishing campaigns are all attempts by hackers to break in through a company's front door: the login box. 

These attacks [can be devastating](https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/), leading to stolen data, legal fallout, and huge spikes in traffic that crash applications. A cutting-edge IAM solution is designed to get in front of those issues through anomaly detection.

There are multiple ways IAM systems can help detect and mitigate malicious attacks. IAM solutions detect attacks by monitoring signals such as the velocity of traffic, detection of login patterns that differ from a user's routine (such as location and browser), use of a breached password, or use of devices and IP addresses with a poor reputation.

In Auth0's case, we use two primary tools for anomaly detection: [brute-force protection and breached password detection](https://auth0.com/docs/anomaly-detection).

Brute-force protection stops users from logging in from the same IP address after a certain number of failed attempts, preventing botnet attacks from causing outages.

Breached password protection is designed to monitor data breaches in which credentials have been compromised and warn both companies and individuals. Auth0's breached password protection lets users customize how they respond to such an event. Customers can notify users when their passwords have been stolen, and if they choose, prevent users from logging in until they change passwords.

## The Benefits of Third-Party IAM

For users, the most visible element of IAM is the login box, but IAM's relationship to security and data management goes far beyond just usernames and passwords. Because of this, developers and IT teams are faced with a choice: build IAM functions in-house or outsource to third-party IAM platforms. 

While there are advantages to each approach, a sophisticated IAM platform links identity across applications, guards against data breaches, and is a valuable source of analytics. Think of it like the circulatory system for all of an organization's digital resources &mdash; just beneath the surface, interwoven through every application.

Many companies chose to build their IAM solution in-house in years past, but these days, more and more are outsourcing their identity and access management needs to third parties. A [2020 Auth0 survey](https://auth0.com/resources/whitepapers/state-app-assembly-2020) of IT professionals found that 58% currently outsource authentication when building applications. This trend has given rise to a new subset of Software as a Service (SaaS), known as [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/).

The reasons organizations increasingly choose to buy an IAM platform, rather than attempt to build it, are complex and vary depending on a company's size and needs.

### Cost and time savings

Building and maintaining an in-house identity solution is a challenge for companies of any size and particularly for startups with limited resources. Auth0 customers frequently report that custom IAM solutions can quickly become full-time jobs for multiple developers, representing a fundamental distraction from their core business proposition.

### Adaptability and extensibility

Large enterprises often transition to an external IAM provider because their in-house solution is riddled with legacy code and doesn't integrate with a wide range of applications. In-house solutions are static and closed to outsiders, and repairing one may be more of a headache than it's worth. Instead, enterprises may find more value outsourcing to a platform designed to interface with other systems and add new capabilities.

This confers major business advantages. For instance, an extensible IAM solution is crucial in [post-merger integration](https://auth0.com/resources/whitepapers/Managing-Identitity-10-steps-PMI), helping migrate user identities from multiple sources into a single directory.

### Security and legal compliance

In the past few years, personal data has become a hot-button issue, with numerous high-profile data breaches and the passage of data privacy regulations around the world. Laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) demand that businesses exercise greater control over who can access their user data and also require businesses to share that data with users upon request.

There are high costs for failing to comply with data privacy laws, and as more laws are passed, adjusting an IAM solution for each one can easily be costly. Proprietary systems often have hidden vulnerabilities and may not conform to an industry's security best practices. Outsourcing to a trusted third-party IAM platform can offload some of the burdens of compliance and ensure that security measures evolve in keeping with current best practices.

## IAM: Central to Your Business, Crucial to Your Future

As you've seen, IAM is an umbrella term that encompasses multiple tools, functions, and even philosophies about how organizations manage access and identity within their systems. Many executives who aren't used to devoting much thought to IAM are surprised to learn how closely it's tied to security, user experience, and business outcomes. However, even as IAM evolves to be more important and complex, the technology for managing it is evolving to be more comprehensive and intuitive. 

If you're interested in learning more about how Auth0's IAM platform can serve your identity needs, please [reach out to our dedicated team](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


What is IAM?

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Find out how business leaders are using identity to accelerate their business strategy



In response to COVID-19, 75% of CEOs have accelerated digital transformation, a recent [Zscaler study](https://www.zscaler.com/resources/white-papers/securing-remote-work.pdf) found. 

While the study specifically focused on work from anywhere (WFA) solutions, the need for digital change isn't critical just for employee access. As nearly every customer experience is driven online, your customers' digital experience is the major way they experience your brand.

[Fortune](https://fortune.com/2020/06/26/coronavirus-accenture-ceo-digital-transformation/) noted that the crisis has quickly widened the performance gap between companies investing in digital innovations and those who weren't into a "chasm," saying "digital leaders were performing better through crisis." Companies need new technologies that allow them to activate new business models fully. In this environment, digital transformation initiatives may still be scoped over multiple years, but CIOs need to demonstrate value on a much faster timeframe. 

And the need for rapid digital adaptability is surfacing as an even stronger driver amongst Auth0 customers, especially for those seeking [B2B](https://auth0.com/b2b-enterprise-identity-management) and [Customer and Identity Access Management (CIAM)](https://auth0.com/b2c-customer-identity-management) solutions.

<include src="ebook-ads/DigitalTransformationBook" />

For many business leaders, the question is not just about how to add artificial intelligence and machine learning to new products, but how to keep their companies moving forward, given unpredictable global conditions. Others are wondering if it's too late to catch up &mdash; or even run ahead.

If you're willing to treat Identity Access Management (IAM) as a reusable service as part of your digital transformation strategy, it's not.

## Reusable Services Speed Digital Transformation Success

Many digital transformation projects are executed over the course of several years, while everyone works through "rigid" monolithic I.T. infrastructures and apps created for specific moments in time. Replacing legacy technology with "[componentized](https://auth0.com/resources/whitepapers/state-app-assembly-2020)" digital technologies (think building blocks) that can be more easily reassembled and re-architected allows companies to adapt more rapidly to changing business needs.
 
Reusable services like online payments, communications capabilities, and identity management allow companies to speed their digital transformations and deliver scalable value to customers. Basically, these services give you the power to do what you need to do, when and how you need to do it.

As Pierre Alvear Foxler, Service Manager, IAM, for Northern Europe's leading farming cooperative, [Lantmännen](https://auth0.com/case-studies/lantmannen/), points out, shifting from on-premises to services-based solutions like Auth0 have financial benefits as well as usability benefits. "We went from an on-premise solution that was capable, but complex and costly, to one that saves us money on infrastructure, IAM delivery, and application management," he says.

Strongly designed services can also make it easier to manage the complexity of the fragmented healthcare system, says Chris Carruthers, Principal Technical Program Manager, [Providence](https://auth0.com/case-studies/providence/), a nonprofit healthcare organization based in the U.S. "The healthcare industry is a complex landscape. Many customers have legacy applications and require highly secure vendor systems that meet patient data privacy requirements. Auth0's adherence to top compliance frameworks makes them a valuable identity partner for us."

## Reduce Time to Implementation

The most effective business strategy in the world, expressed through well-planned business models, can easily stall (or die) due during change management. IAM can be a powerful tool for business leaders to speed implementation. Resolving IAM challenges with the help of a vendor focused on not only current, but potential business possibilities means that you can use the IAM discussion as a framework to drive consensus and momentum for their evolving digital transformation strategy.

### Lifen: Contact Tracing in 5 Days

AI-powered [Lifen](https://auth0.com/case-studies/lifen-cs/), a solution that facilitates the secure transfer of medical documents between patients, private practitioners, and hospitals, came to Auth0 early in the pandemic with the goal of replacing their existing identity infrastructure &mdash; and rapidly spinning up a contact tracing solution. We delivered in five days.

You read that right &mdash; five days.

"It was in record time," says Lifen CTO Dali Kilani. "We've put it in the hands of multiple healthcare institutions."

But speed wasn't Lifen's only goal. 

Especially in a global environment with an increasing number of [data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/), fast means nothing if your new solution isn't also more secure. Despite the rapid turnaround, Kilani is more than comfortable. "Auth0 maintains the highest level of security that is possible at this point. Every single doctor and patient that accesses our solution performs their authentication through Auth0. We've put Auth0 at the heart of our service."

### Gymshark: Headless Commerce + Credential Stuffing Protection

For Auth0 customer [Gymshark](https://auth0.com/case-studies/gymshark/), a conditioning brand dedicated to fitness apparel, digital adaptability means making major shifts away from siloed logins that were spoiling their user experience. "We're going down a headless commerce route, doing much of our ops and infrastructure through serverless technologies with cloud partners such as AWS. We're kind of rebuilding the whole back office of the company from the ground up," says Dan Lake, Gymshark Engineering Director.

The complexity of managing a digital transformation alongside a social media following of 10+ million and customers in over 170 countries could have made customer identity and access management (CIAM) changes extremely challenging. 

Instead, Auth0 saved time and effort.

"The ease of implementing Auth0 was brilliant. It saved us months of time, salaries, effort in finding the right engineers, obviously ongoing support, and also probably given us back a few years in our lives as well through stress," says Lake.

Lake also points out that Auth0 has added benefits. "Auth0 protects us against credential stuffing. You don't realize how valuable [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) features are until it happens. Those are the kind of features that we relish at the moment, things we see that our customers don't."

### Scale Quickly Across Multiple Applications 

Global technology powerhouse [Siemens AG](https://auth0.com/case-studies/siemens/) plays a pivotal role in everything from digital enterprise to energy to financial services and operates in nearly every country in the world. Performing on a global scale can get extremely expensive when apps are measured across multiple divisions. Creating a uniform login experience for customers and partners allows Siemens to sustain a focus that benefits their business. 

"It was of the utmost importance to have a secured, stable and reliable authentication platform, [so that] our clients and partners can focus on their business instead of focusing on how to log into hundreds of Siemens' applications available in the market," says Hugo Francisco, Service Owner of Siemens ID, Siemens.

## Make Sure Your UX Keeps Pace With Your Business Innovation

With 170 superstores across the U.K., Dunelm prides itself on style and affordability &mdash; and is transforming their digital experience to keep pace with their tangible one.

Moving to a modern, flexible cloud platform is a critical part of that business strategy.

"One of the key things we wanted to do was move over to a cloud platform, AWS, where we could scale up and down and build the best in class for our online customers," says Antony Sohal, Head of Data Platforms for Dunelm.

But instead of building that digital experience in-house, Dunelm created the customer experience using a componentized approach. "One of the key decisions was to focus on what we're good at and single out what we're not good at. We built a product service, a pricing service, we bought authentication, we even bought search as a service. We bought the infrastructure we needed," explains Sohal.

Buying identity-as-a-service means that the effort that would be spent on authentication can instead be spent on core functions and, with the right identity partner, used to customize the user experience. This means there's no need to sacrifice digital innovation for time-to-market. A flexible, extensible identity platform means you can get to market faster and ensure future adaptability.

Treating identity as a reusable service can help your new products get to market faster — and strengthen your ability to adapt once you're there. As Lake explains, "The largest shift and growth at Gymshark is we've become a tech company through our aim to unite the conditioning community. We're building the foundation for where we're headed, and it's just going to get bigger and bigger."

Carruthers says [Providence](https://www.providence.org/en) turned to Auth0 for help creating a seamless, consumer-facing digital experience for patients. "We're years ahead of where we would be if we were to build identity ourselves," says Carruthers.

If you'd like to learn more about how Auth0 could help your company continue to adapt and grow, please reach out to an [Auth0 resource](https://auth0.com/contact-us).

<include src="asides/AboutAuth0" />

How Digital Transformation Enables Business Adaptability

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Leading laboratory testing provider seamlessly handles 25x volume increase in patient portal users during COVID-19 with Auth0



**BELLEVUE, Wash. – Dec. 10, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it is providing [BioReference Laboratories, Inc.](https://www.bioreference.com/), an OPKO Health company and a leading provider of laboratory testing services in the U.S., with end-to-end authentication for its patient portal, giving patients HIPAA compliant and secure, direct access to their lab results and medical data. This was essential as COVID-19 hit and BioReference faced a rise in new patient portal users&mdash;including a 25x increase in volume overnight&mdash;who needed a secure and easy way to monitor their test results.

BioReference provides comprehensive diagnostic solutions to healthcare providers, clinics, hospitals, employers, government units, correctional institutions, medical groups, and more. The laboratory’s vast test menu is utilized in the detection, diagnosis, evaluation, monitoring, and treatment of disease, including COVID-19. In recent months, BioReference has made significant investments in its B2B and B2C offerings, including Customer Digital Solutions, Direct-to-Consumer Solutions, Telehealth, and Patient Empowerment. 

“COVID-19 has caused a seven to ten-year acceleration in consumer and digital trends,” said Richard Schwabacher, SVP for Digital Health and Chief Digital Officer at BioReference Laboratories. “Securing, transmitting, and authorizing patient access to health information digitally is now critical to the practice of medicine and core to what is needed from a modern digital health solution.”

Identity and access management (IAM) was a key component in BioReference’s transition to providing a more patient-centric model. The company leveraged Auth0 as the IAM in its new patient portal so that patients can securely see results and pay bills, giving patients direct access to their healthcare information. Now, patients no longer have to depend upon their healthcare provider to act as an intermediary to access this information.  

“Auth0 helps address concerns about security and user access, especially during times like the present when COVID-19 is causing a significant increase in patient demand,” said Vinny Pacione, VP of Consumer Technology and Digital Solutions at BioReference Laboratories. “Enabling delivery of this data to individuals in a self-service way using scalable, automated digital platforms was a key problem to solve. The most fundamental piece of the solution is securing the data and ensuring that only the individuals who have appropriate authorization can access it.”

“Identity management is a critical component of any digital transformation initiative, and COVID-19 has forced many companies into transition,” said Ghazi Masood, SVP of Americas for Auth0. “BioReference aspires to transform telehealth and put patients at the center of the future of medicine. We are proud to aid them in their journey and help them to deliver a secure, seamless experience for their patients.”

More details on BioReference’s implementation of Auth0 can be found [here](https://auth0.com/case-studies/bioreference/).

## About BioReference Laboratories, Inc.

BioReference provides comprehensive testing to physicians, clinics, hospitals, employers, government units, correctional institutions, and medical groups. BioReference developed and offers test services that yield high quality and accurate results, including a molecular test for helping with COVID-19 diagnosis and a serology test to help indicate possible COVID-19 exposure. The company is in network with the five largest health plans in the United States, operates a network of 11 laboratory locations, and is backed by a medical staff of more than 120 M.D., Ph.D., and other professional level clinicians and scientists. With a leading position in the areas of genetics, women’s health, maternal fetal medicine, oncology, and urology, BioReference and its specialty laboratories, GenPath and GeneDx, are advancing the course of modern medicine. For more information, visit [www.bioreference.com](https://www.bioreference.com/).

<include src="asides/AboutAuth0" />

### Media Contacts: 
Auth0 Global Communications <br />
[press@auth0.com](mailto:press@auth0.com) <br />
 
Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />

BioReference Laboratories Communications <br />
[media@bioreference.com](mailto:media@bioreference.com)


Auth0 and BioReference Laboratories Answer Patient Demand for Secure, Direct Access to Test Results

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Every business that accepts credit cards needs to be compliant with PCI, but your obligations vary dramatically depending on your size and structure.



If your business accepts credit card transactions, then you should be familiar with the Payment Card Industry Data Security Standard (PCI DSS). The rules (usually abbreviated as PCI) are a set of guidelines that seek to govern how businesses safeguard sensitive credit card information, with the goal of minimizing data breaches and fraud. Many merchants know PCI only as a mysterious surcharge from their credit card processor. But PCI compliance can become a serious and costly issue, especially if your bank unexpectedly demands that you prove compliance.

Here, we’ve created a straightforward guide that cuts through both legalese and technical jargon in order to explain what PCI is and how to determine your compliance obligations.

## PCI Definition and Key Concepts

Underneath the acronyms, PCI is actually very simple: a set of rules established by credit card companies to ensure that merchants are keeping their sensitive data secure.

### Background

PCI was [established in 2006](https://www.pcicomplianceguide.org/faq/#12) by Visa, Mastercard, Discover, American Express, and JCB, and it’s been updated periodically since then. The specific standards are written by a council created by the payment companies: the Payment Card Industry Security Standards Council (PCI SSC). However, the rules aren’t enforced by the council but by the card companies and [acquiring banks](https://www.merchantmaverick.com/what-is-acquiring-bank/).

### Compliance and noncompliance fees

It’s important to emphasize that PCI is not a law. However, given the clout of the five major card brands, as well as the credit card processors and acquiring banks, PCI is functionally mandatory. Credit card companies can issue fines for acquiring banks for noncompliance. Banks, in turn, will charge merchants a [PCI non-compliance fee](https://www.valuepenguin.com/credit-card-processing/pci-compliance-fee-explained#:~:text=Some%20merchants%20may%20also%20be,commonly%20around%20%2420%20per%20month.) and can even stop working with a business altogether.

Conversely, most credit card processors/merchant service providers also charge a monthly or annual [PCI compliance fee](https://www.merchantmaverick.com/pci-compliance-fees/). Many providers that charge this fee include services to make sure your business is PCI-compliant. However, some just tack on the surcharge without giving you anything in return.

### PCI Overview

All PCI rules relate back to a central goal: to encourage merchants to store as little credit card information as possible, so they are less vulnerable to data breaches and fraud. Meanwhile, PCI also helps craft guidelines for the service providers that handle cardholder data, minimize their exposure.

PCI helps to minimize risk by imposing lighter standards on merchants who do a few key things:

* Outsource credit card processing and data storage to trusted service providers.
* Regularly audit and update their security measures, such as encryption, password changes, etc.
* Keep internal systems as simple as possible. In the case of brick-and-mortar merchants, for instance, they point to Wi-Fi, in-store cameras, and physical terminals as threat vectors that hackers can use to steal data.

### PCI key terms

[PCI DSS defines a merchant](https://www.pcisecuritystandards.org/pci_security/glossary#M) as “any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC.” So while the term “**merchant**” can evoke a traditional idea of retailers, the term here is much broader. It’s also important to note that debit cards, if they bear the logo of the major brands, also fall under the rules.

Meanwhile, PCI defines a **service provider** as an entity that is “directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data.” So if a merchant uses Stripe or PayPal to handle e-commerce payments, those are service providers, but the category can also include your website hosting provider, your identity and access management (IAM) platform, and any other service that touches this data. Unsurprisingly, service providers can also be merchants since they too accept cardholder data as payment.

So what kind of data are we talking about? **Cardholder data** under PCI includes the card number, which PCI calls the “primary account number (PAN).” It can also mean the PAN, as well as the cardholder’s name, the card’s expiration date, or the security code.

## Does PCI DSS Apply to My Business?

The short answer is yes! If your business accepts card payments&mdash;whether in person, online or over the phone&mdash;PCI applies to you. However, your obligations under PCI vary dramatically depending on what type of business you have and how you handle payments.

The best way to determine your business’s obligations is to take the [self-assessment on PCI’s website](https://www.pcisecuritystandards.org/document_library?category=saq&document=saq). But there are multiple self-assessment questionnaires, so you need to determine which one best applies to your business. You can do that using this [PCI-provided table](https://www.pcisecuritystandards.org/pci_security/completing_self_assessment). Figure out which designation describes how you process credit card payments, and then take the appropriate questionnaire.

![PCI Questionnaire](https://images.ctfassets.net/23aumh6u8s0i/3Pij7WjlmS0GBMTCrnj5X2/e6f32e65e95e6e16d6e38469e9bfa2f5/pci_table)

You might notice that the vast majority of the merchant types above describe businesses that don’t store credit card information themselves. That’s in keeping with PCI’s overall preference for merchants outsourcing this storage to third-party professionals. Merchants who do choose to store credit card data themselves&mdash;for example, for the purpose of processing recurring payments&mdash;have among the highest compliance standards. Those merchants may be obligated to hire a [qualified security assessor (QSA)](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors) to conduct an onsite audit to ensure a merchant meets their PCI DSS requirements.

Your PCI obligation also varies by level, based chiefly on your card transaction volume. Every business is assigned a PCI compliance level from 1-4, with level 1 having the highest standards. Unfortunately, these levels aren’t exactly straightforward, and, technically, each cardholder brand has its own set of levels. However, the Visa and Mastercard levels are generally considered standard, so they’re the ones we include here:

* **PCI compliance level 4**: For e-commerce: fewer than 20,000 annual Visa/Mastercard transactions. For all merchants: fewer than 1 million annual Visa/Mastercard transactions.
* **PCI compliance level 3**: This level applies only to merchants that process 20,000 to 1 million annual e-commerce transactions per year.
* **PCI compliance level 2**: All merchants who annually process between 1 million to 6 million Visa/Mastercard transactions, regardless of channel.
* **PCI compliance level 1**: Any merchant annually processing more than 6,000,000 Visa/Mastercard transactions via any channel. In addition, any merchant that has experienced a security breach that exposed cardholder information is automatically moved to level 1.

## PCI DSS Compliance Guidelines

Regardless of your merchant level or how you accept payments, there are some basic housekeeping steps you should take to keep up on your PCI compliance:

* **Conduct a quarterly vulnerability scan of your systems using a PCI-approved party**. This scan is an automated process that probes your systems to identity potential entryways for attackers. If you’re currently paying a PCI compliance fee to your merchant service provider, this is one of the services they should offer you.
* **Conduct an audit of your current credit card processes**. This doesn’t just mean the processing itself, but every touchpoint for that data, including both digital and physical access. If you’re not sure where to start, take a look at [PCI’s documentation](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf), which points out some common data security pitfalls. For example, if you’re a brick-and-mortar retailer, make sure you don’t have internet-connected security cameras pointed at your point-of-sale system. If you’re an e-commerce merchant and you process payments yourself, make sure internal access to payment pages is rigorously controlled.
The basic rule of thumb in a self-audit is that if there isn’t a strong business need for keeping cardholder data in-house, don’t do it. Such data makes you vulnerable to attackers, increases the likelihood that you’ll be found PCI-noncompliant, and puts you at risk of non-compliance with [global data privacy laws](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA/email/?email=elaine%40animalz.co).
* **Keep your security up to date**. At a minimum, that means regularly updating system passwords, installing patches to all software (especially antivirus software), and updates on your payment terminals. These are simple fixes that can prevent a lot of attacks.
* **Use responsible vendors and service providers for payments**. PCI SSC provides this [list of questions](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Questions_to_Ask_Your_Vendors.pdf) to ask vendors to ensure you’re working with partners who are themselves in compliance and who can support you in maintaining compliance.
* **Control internal access to data**. As the [PCI SSC’s guide for small merchants states](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf), “Access control is all important.” Implement strong access-control measures to ensure that employees can only access the amount of cardholder data they need to do their jobs.

You need an [IAM system](https://auth0.com/blog/what-is-iam/) that issues a unique ID to anyone who can access this information, so you can trace any breach to the source. If you have one “admin” login for an entire store, and every employee can use it, you’re in serious need of an IAM update.

Like your payment platform and firewall provider, your IAM partner needs to be PCI compliant. For example, in 2019, [Auth0 became](https://auth0.com/blog/auth0-completes-pci-dss-validation-for-iam/) among the first identity providers to achieve Level 1 compliance.

## Getting PCI-Compliant Is a Smart Business

Many small-business owners simply aren’t accustomed to thinking about their information security policy. Unfortunately, no merchant is too big or too small for hackers, and credit card data is some of the most valuable and sensitive information in existence. So while no one really wants to think about PCI DSS compliance, it might be just the nudge you need to update your information security policy and implement tighter security controls.

For more information on how an IAM partner can be a part of your data protection strategy, please [reach out to the professionals at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


What Is PCI? A Business Guide to Compliance

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Learn how identity and access management (IAM) is a critical enabler for smooth, secure replatforming and M&A.



If you are [replatforming](https://auth0.com/blog/what-is-replatforming/) on the cloud or looking to enhance your appeal as an acquisition target, [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/) should be at the heart of your strategy. Successfully replatforming, whether as part of post-M&A integration or a broader [digital transformation strategy](https://auth0.com/blog/how-digital-transformation-enables-business-adaptability/) to improve scalability, security, experience, and performance, is easier and more effective when you have a specific plan for managing identity.

### What does replatforming involve?

Replatforming entails changing and updating specific components of an application to allow it to function in the cloud and benefit from the resulting improvements in experience, scalability, security, and efficiency. As more organizations take advantage of cloud-native [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) platforms designed with agility and transparency in mind, updating your application allows you to take advantage of modern features like social login, [multi-factor authentication (MFA)](https://auth0.com/intro-to-iam/what-is-multifactor-authentication-mfa/), and [single sign-on (SSO)](https://auth0.com/docs/sso).

Implementing social login can increase conversions and improve customer experience because end-users can create an account and start accessing your services within seconds. MFA is increasingly considered an essential cybersecurity feature. Entrusting identity to an IDaaS provider can also reduce the maintenance costs of updating protocols to ensure compliance with [GDPR](https://auth0.com/docs/compliance/gdpr) and other data privacy laws.

<include src="ebook-ads/PostMergerIntegration" />

### How does IAM come in?

Naturally, both M&As and replatforming journeys demand a huge amount of advance planning. Decision-makers need to consider which systems to keep and which to jettison. They have to decide which business functions to integrate into their tech stack and how. And, in the case of M&As, they need to manage the expanded pool of user data that results from a deal without exposing security vulnerabilities, creating friction that drives users away, or roadblocking business goals. IAM empowers companies to accomplish all this with minimal disruption to business processes and end-user experience. 

In this post, we’ll explore why IAM is a critical step in your migration journey, no matter what shape that journey takes.

## The Value of IAM for Replatforming

### Deliver a superior experience

The ultimate goal of an M&A or a cloud migration is to deliver more value to customers. But if your migration is so painful that your customers abandon you for another service, your digital transformation won’t succeed. Because signup and login are integral elements of the customer experience, an IAM solution is a necessary ingredient in eliminating friction.

Every time you lose a customer due to a messy M&A integration or a clumsy cloud migration, your organization loses value. That’s why it’s so crucial to deliver a frictionless customer experience during your M&A integration or while you’re replatforming.

### Ensure a smooth migration

[As many as 70–90% of M&As fail](https://advisory.kpmg.us/articles/2018/improve-your-deal-results-with-a-new-approach-to-synergies.html), often because there’s no clear identity integration process in place. If you’re interested in making an M&A deal, you need to demonstrate to your new partner that you can integrate your operations with theirs quickly and easily without compromising on security. The best way to do that is to weave IAM into the fabric of your M&A strategy. 

The same logic applies to replatforming in the cloud. If you start migrating without a coherent identity strategy, you’ll end up with a heap of usability problems for your teams, your vendors and partners, and your customers. 

Having an IAM solution in place before a merger or acquisition keeps you from spending months integrating applications rather than focusing on value creation. During the merging/onboarding period, your teams still need to get their work done. A centralized identity strategy goes a long way toward minimizing the disruption.

Managing post-M&A integration in-house is a hard, resource-heavy job. Identity is a highly specialized and rapidly evolving field, and your developers shouldn’t have to become security experts for you to achieve a smooth integration. IAM allows developers to focus on adding value to their own solutions rather than reinventing the identity wheel.

### Enhance security and guide compliance

Potential M&A partners will see you as a major security headache if you’re struggling to manage a high volume of identities across multiple platforms without a centralized identity strategy. That’s because merging data is an integral part of any successful merger. Fundamentally, it’s what allows each partner to benefit from the other’s teams, technology, and customer bases. An IAM solution helps you sidestep the duplicate processes, squandered resources, frustrated teams, and lost customers that often result from M&As.

Another reason to implement IAM before you pursue M&A deals is that mergers and acquisitions can increase the risk of cyberattack, and your data is more vulnerable without a solid IAM solution in place. A majority of companies report that the risk of attack increases during M&A. According [to a survey by Donnelley Financial Solutions](https://www.acuris.com/assets/DFS%20Spotlight_September%202017_Final.pdf), 44% of companies say the threat of attack increases _significantly_ during a merger or acquisition, while 56% report that it increases somewhat.

In today’s regulatory environment, with data privacy laws like GDPR, CCPA, APPI, and LGPD covering about 65% of the world, it’s critical to assess security and data privacy prior to a merger or acquisition. If your new partners don’t like what they see, they may abandon the deal &mdash; or wish they had. A [survey by Forescout Technologies](https://www.forescout.com/company/news/press-releases/forescout-study-reveals-cybersecurity-concerns-on-merger-and-acquisition-activity/) found that 53% of organizations had encountered a cybersecurity issue during an M&A deal that jeopardized the deal, while 65% of respondents felt regret after closing an M&A deal due to cybersecurity concerns.

## Don’t Be a Cautionary Tale

A solid plan for managing identity can make the difference between an M&A deal that realizes value and one that does irreparable damage to your brand. [Let’s recap](https://auth0.com/blog/recent-ma-deals-that-imploded-over-cybersecurity/) a few M&A deals that flopped for data privacy reasons: 

* **Marriott/Starwood data breach resulted in $123 million GDPR fine:** [Marriott International’s purchase of Starwood Hotels & Resorts](https://www.cnbc.com/2016/09/23/marriott-buys-starwood-becoming-worlds-largest-hotel-chain.html) for $13.3 billion in 2016, which created the largest hotel chain in the world, was followed by a cumbersome integration that still wasn’t complete in 2018 when Marriott admitted that Starwood’s reservation system had experienced [a huge data breach](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/) that exposed close to 400 million guest accounts. Marriott was forced to pay a $123 million GDPR fine.
* **Yahoo’s data breaches cost them $350 million in Verizon acquisition:** [Verizon’s 2017 acquisition of Yahoo](https://www.washingtonpost.com/news/the-switch/wp/2017/06/13/its-official-verizon-finally-buys-yahoo/) almost fell through when pre-acquisition due diligence uncovered two data breaches that compromised at least 1.5 billion accounts. The deal went ahead &mdash; but for $350 million less than initially agreed.
* **Facebook passed on TikTok forerunner due to concerns about illegal data use:** [In 2016, Facebook considered acquiring Musical.ly](https://fortune.com/2019/11/13/facebook-musically-tiktok-bytedance-acquisition/), the forerunner of TikTok, a video-sharing platform that now boasts more than a billion users around the world, before ultimately passing because of cybersecurity and data privacy concerns. Facebook’s concerns were not unfounded: TikTok is facing a class-action lawsuit in California alleging that the company collects and stores user data without consent, then illegally shares that data with servers in China. The Committee on Foreign Investment in the United States (CFIUS) is also investigating ByteDance, TikTok’s parent company, for inappropriately censoring videos for political reasons and failing to protect personally identifiable data. 

In hindsight, of course, it’s easy to recognize that these wince-worthy stories have some common elements. With help from dedicated IAM experts, all of the companies involved in these deals could have spotted the red flags. That’s the kind of information you want to have before you hand over $13 billion.

## Position Yourself for Success With IAM

Whatever kind of replatforming or integration journey you’re facing, you need data that is secure, accessible, and actionable. Before you replatform or get serious about an M&A deal, it’s worth investing in an extensible IAM platform like Auth0 to position your company for success.

To learn more about how Auth0 can help meet your identity needs, [get in touch](https://auth0.com/contact-us).

<include src="asides/AboutAuth0" />


Why IAM is Essential to M&A and Replatforming

steven-rees-pullman

I am an Internationally proven professional with experience including full P&L, Business Sector and Corporate planning and execution roles. My specialities — driving revenue and organisational growth in the EMEA.

General Manager EMEA

Steven Rees-Pullman

IAM is either making your business money or draining resources. Here’s how.



Business decision-makers often balk at updating their [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/) system, partly because of a fundamental misunderstanding of what IAM actually is. To be fair, it’s easy to confuse IAM with its most visible element: the login box. But in reality, the login box is to identity management what a light switch is to your home’s electrical system. IAM encompasses a complex set of functions that touch nearly every aspect of your business and have a measurable impact on your bottom line. Leaving an outdated IAM system in place — whether you’re managing the identities of employees, business partners, or end customers — is both costly and dangerous.

The alternative to living with this faulty wiring is to replace an in-house identity solution with a third-party system built by experts in the [Identity as a Service (IDaas)](https://auth0.com/blog/identity-as-a-service-in-2018/) field. A modern IAM solution can provide both a quick business win and long-term value by decreasing costs, increasing revenue, and making businesses more adaptable in a shifting technological and legal landscape.

![Business Value of Identity](https://images.ctfassets.net/23aumh6u8s0i/6hiKy3QBcDylVsHi8509Eq/414d9b468d1cadaa748ca38699c3e80f/iceberg_business_value)

## Modernizing Identity Reduces Maintenance Costs

Businesses that are reluctant to invest in IAM are often unaware of how much money they’re already spending on it. Maintaining an outdated, decentralized IAM system is usually a full-time job for at least one developer. In addition, dealing with identity-related issues such as lost passwords takes up the majority of your support desk’s time.

The maintenance costs of in-house Identity are high even if we only define “maintenance” as keeping the existing system running so users can log in and access resources. When businesses improve their custom IAM systems, those costs skyrocket.

Auth0 customers regularly report that if they attempted to build our features themselves, it would take an entire team of developers. For example, Gymshark saved £900,000 per year in engineer salaries when they enlisted Auth0 to centralize authentication across their apps.

The reason it’s so challenging for companies to update IAM in-house is simply that legacy, and in-house identity systems weren’t designed to do everything that modern IAM platforms can do. A startup can get by with a simple approach to IAM if all they’re doing is managing logins for their small team of employees. But that approach doesn’t scale well, especially if the company also wants to manage the login process for its customers. So when that business moves past the startup stage, and it acquires another business, their Identity needs become dramatically more complex. How will they migrate both sets of employee data to a single system when their IAMs don’t naturally integrate? How will they control access to sensitive data during the transition period, when employees are leaving and joining the business? Trying to answer these questions yourself costs time and resources, can derail important M&A deals, and erodes the experience for external users in a context where customer experience has a direct impact on the bottom line. 

## Identity Is Critical to Legal Compliance and Security

If you don’t invest in a sophisticated, secure identity solution, then you’re essentially budgeting for regulatory fines and the myriad costs associated with data breaches. Given the rise in global data privacy laws and cyberattacks, the chances that you will be impacted are only increasing.

### Identity-based attacks are a pervasive threat

Today, hackers the world over use authentication as their preferred gateway to attack. [Verizon’s 2020 Data Breach Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf) found that the most common forms of data breaches are identity-based: phishing and attacks using stolen credentials. These [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) mean huge expenses for businesses, in the form of application downtime, lost customers, and IT costs. The [Ponemon Institute reports](https://www.akamai.com/us/en/multimedia/documents/report/the-cost-of-credential-stuffing.pdf) that a company that falls victim to a credential stuffing attack stands to lose an annual average of $6 million (about 4.6 million pounds or 5.1 million euros). Thwarting these attacks requires IAM features such as brute force protection, multi-factor authentication (MFA), and rigorous access control.

### Identity is at the center of data privacy laws

The General Data Protection Regulation (GDPR) made data privacy a major issue for companies in the EU and around the world, and much of what it sought to regulate concerned managing access to personal data. Many of the [biggest GDPR fines](https://auth0.com/blog/gdpr-fines-hit-these-companies-hard-heres-how-to-avoid-them/) have been issued to companies that lacked adequate access controls or failed to protect user credentials.

Since GDPR’s passage, more countries have passed laws of their own, and today, we live with an ever-evolving patchwork of international data privacy legislation. This state of affairs will only increase, which makes compliance an ongoing challenge. According to [Gartner](https://www.gartner.com/en/newsroom/press-releases/2020-09-14-gartner-says-by-2023--65--of-the-world-s-population-w), “By 2023, 65% of the world’s population will have its personal data covered under modern privacy regulations, up from 10% in 2020.”

When the European Court of Justice (ECJ) [struck down the EU-US Privacy Shield](https://auth0.com/blog/schrems-2-eu-us-privacy-shield-ruled-invalid/) framework in July 2020, it highlighted how these laws can change overnight and cause severe business disruption. Businesses that invested huge sums to make their in-house IAM Privacy Shield-compliant are now faced with the daunting prospect of another overhaul with [Schrems 2](https://auth0.com/blog/schrems-2-eu-us-privacy-shield-ruled-invalid/). But IDaaS providers like Auth0 were prepared for the change, so their customers can continue doing business, uninterrupted.

## IAM Unleashes Innovation

For better or for worse, your company’s IAM platform will impact your ability to innovate. This happens in two ways. The first is simple: Every hour your developers spend on authentication is an hour they’re not improving your core product.

Most companies are familiar with this logic when making other decisions about building vs. buying microservices. For example, [Auth0’s research](https://info.auth0.com/rs/712-VXW-158/images/The%202020%20State%20of%20Application%20Assembly.pdf?utm_medium=email&utm_source=mkto&utm_campaign=state-of-app-2020-whitepaper&mkt_tok=eyJpIjoiTm1JM1pEazVOamcxTURReSIsInQiOiIrVHZ3dnA5b1JBK09VbUFnUmVnTThESVpEQkZRZlErelVsV0x2VGlsTUEzeVl6dTcxKzdEakVRaHJvb3o3WFB4VjRxSXZXRU9SUjV1ZG1tQ1wvdE1rYUR1OU9vVXNvU3dFZEJZR1EzTVZsb2t5MjFzVjhsSkZjTjhUaGZjMGpmQTYifQ%3D%3D) found that when companies need to incorporate a payment tool in their app, only 26% build it themselves. The other 74% use a software-as-a-service SaaS solution like Stripe or Paypal. The same logic holds true for authentication.

Companies can reserve the resources they save on IAM and devote them to innovating. For instance, [Auth0 customer Signify](https://auth0.com/case-studies/signify/) was able to reinvest 4.8% of their sales in R&D, an investment they otherwise would have spent on authentication. According to Etienne Bertou, Signify’s principal cloud architect, “When you work with a partner like Auth0, it takes a lot off of your roadmap that should not be the focus of your R&D teams.”

Aside from freeing up resources, an IAM system can drive innovation. For example, consider the impact of centralized Identity on improving analytics and customer outreach. When a single IAM provider handles user authentication across devices and integrates seamlessly with every other system, it de-silos data to create a single source of truth about users. This idea is the heart of an [omnichannel approach](https://auth0.com/blog/why-an-omnichannel-strategy-is-critical-in-2020/) to retail and marketing.

![Omnichannel](https://images.ctfassets.net/23aumh6u8s0i/4R9jiLsQ22iKfF5nFYW5qm/5e22f180c5c980130af02a358c9d7d04/omnichannel_diagram)

Streamlining authentication also improves UX and shows users that they’re dealing with a cutting-edge business. After all, the login box is where you make your critical first impression with customers &mdash; and they’ll quickly be turned off by cumbersome form fills. When Auth0 customer [Arduino introduced social logins](https://auth0.com/case-studies/arduino/), they increased conversions by 20%, proving the value of a modern authentication experience.

## Identity Is Central to Your Business

It’s always important to make sound investments in technology, and particularly in a moment of global uncertainty. But having a secure and extensible IAM solution is one of the best defenses against that uncertainty because it makes businesses more capable of adapting to change.

Moreover, IAM is already affecting your bottom line, even if some of that impact only becomes visible when something goes wrong. Instead of waiting for an IAM emergency, start calculating all the ways your approach to Identity impacts your business. You’ll soon learn whether it’s working as a cost or as an asset.

<include src="asides/AboutAuth0" />


The Business Value of Identity

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

A customizable Identity and Access Management (IAM) solution is key to improving CX in mixed environments.



## Every Environment Is a Mixed Environment

Software implementations are often discussed in terms of “[build vs. buy](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management),” meaning that for each functionality desired in the tech stack, an organization needs to decide whether to develop the functionality in-house (build) or go with a third-party solution (buy). The latter essentially means entrusting the functionality, whether that’s team communications or identity and access management (IAM), to a dedicated expert.

But what if your environment comprises both built and bought solutions? For many companies, particularly at the enterprise level, the build vs. buy thinking doesn’t necessarily capture their experience. Instead, they’re working with legacy architecture that’s a highly customized combination of purchased and built-to-spec apps. Sometimes the reality is that, in the words of one CISO, “every environment is a mixed environment.”

## IAM Alleviates Pain

In a mixed environment, ensuring a frictionless customer experience can be a challenge. Having more applications in your architecture creates more opportunities for friction to disrupt the user experience. And now that identity is disseminated across so many different platforms and devices, with users needing the flexibility to log in anywhere, from any device, it’s more important than ever to support [federated identity](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/). But how can you ensure that you’re prepared to solve the constantly-shifting identity challenges presented by distributed and mixed environments?

IAM lightens the burden on companies struggling to manage identity in mixed environments. Implementing IAM empowers companies to increase security, work more efficiently, and deliver a painless customer experience regardless of tomorrow’s fresh challenges and unforeseen pain points. 

An identity-as-a-service provider like Auth0 manages authentication across all of your applications, so the login experience is both seamless and secure. A flexible IAM solution gives your team the access and insight they need to accelerate innovation, deliver more value to users, and strengthen your security posture — not just in response to the identity challenges you’re encountering now but those you’ll encounter in a year or five years. 

## Customization Is the Key

To address today’s rapidly evolving use cases, you need to add modern, greenfield functionality to your tech stack. Companies often add that functionality through third-party microservice providers: cloud-based software-as-a-service (SaaS) companies like Salesforce, ZenDesk, or Trello. At the same time, your legacy environment is powering your business, so while you might see the benefits of moving completely to the cloud, you may not be ready for the disruption of a full-scale cloud migration.

Fortunately, customization is the middle ground that can alleviate much of the pain you feel without creating additional headaches by forcing you into a migration strategy that’s not right for your situation. 

Auth0 powers customizations that integrate easily with your legacy system, driving revenue and allowing you time to adjust your strategy and reach consensus before moving forward with full-scale digital transformation. The right IAM solution helps you minimize disruption for users and customers during replatforming and other transitions, so you can minimize turnover and limit missed opportunities.

## Use Identity to Bring Business Logic Into Focus 

The process of implementing an identity strategy clarifies what your company needs to do. Put a different way, to make your identity strategy work; you need to understand the structure and needs of your business at a deep level. Implementing IAM creates opportunities for discussion that brings business logic into sharper focus and allows you to build innovation into your company’s DNA.

Building a product that is as flexible, extensible, customizable, and responsive to change as you need it to be also create the opportunity to take this same approach to higher-level conversations. When leadership sets lofty business goals, you can execute on these goals quickly, equipped with an identity solution that speeds time-to-market (TTM).

## Real-World Example: Bluetooth Special Interest Group (SIG)

Let’s look at an example of an enterprise environment where a flexible IAM solution helped mitigate the pain of a mixed environment that encompassed multiple different apps — and presented multiple challenges.

Formed in 1998, [the Bluetooth SIG](https://auth0.com/case-studies/bluetooth-sig/) is the not-for-profit trade association that oversees Bluetooth® technology. In support of more than 34,000 member companies, the Bluetooth SIG facilitates the collaboration of its members to create new and enhanced specifications that expand the technology, drives global interoperability via a world-class product qualification program, and grows the brand by increasing the awareness, understanding, and adoption of Bluetooth technology.

Bluetooth SIG needed a modern identity solution with single sign-on (SSO) to support all of the company’s homegrown and third-party SaaS apps. They had to be able to implement the solution while keeping the existing platform operating and mapping a path for full migration in the future. It was also essential to establish user roles and access to ensure proper protection for confidential information.

Auth0 fulfilled all of Bluetooth SIG’s requirements. Our solution was easy to implement and allowed the Bluetooth SIG team to add SSO and modern authentication. Without disrupting the legacy system, a migration plan was developed and carried out. Implementation of Auth0 took days, compared with the months it would have taken to implement an in-house platform. 

Top-tier documentation with detailed code samples helped Bluetooth SIG engineers get up to speed quickly on their modern identity solution. Bluetooth SIG and Auth0’s developer success engineers worked together to develop a proof of concept showcasing the platform’s capabilities. Ultimately, Auth0’s full suite of technology, documentation, and expert support gave Bluetooth SIG the solution they were looking for.

## Support Business Processes With Software, Not the Other Way Around

Software should support your core business functions — not the other way around. With an [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider like Auth0, you’ll have the functionality and extensibility to accomplish what you need to without wasting time and resources on a solved problem. IAM is a rapidly evolving specialty in which the only constant is the change. That’s why an out-of-the-box identity solution or an in-house authentication platform can only take you so far. 

Auth0 believes in the business value of entrusting identity to an IDaaS provider, but we also understand the power of code. That’s why we feel an IDaaS+code approach gives you the best of both worlds: identity services managed by an easy-to-use service, plus the same customizability and control you’d have if you’d coded the entire solution from scratch. 

To learn more about how the right identity solution can provide enhanced data protection and a seamless customer experience in your mixed environment, [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us).

<include src="asides/AboutAuth0" />


How to Improve Customer Experience in Your Mixed Environment

ken-oestrich

Ken Oestreich is a Product Marketing and Product Management veteran. He's a serial achiever at introducing new products and categories, growing platform adoption, building marketing teams, and maturing new markets for B2B enterprise technologies. He has consistently anticipated and marketed new industry solutions in the IT space, including cloud workspaces, data center infrastructure automation, and federated identity management, and API/Integration technologies.

VP Product Marketing, Messaging, Content, DevRel.

Ken Oestrich

Apps are becoming componentized and API-based to facilitate reuse and agility; Identity management cloud services will help.



> _"In today's online-first, intensely competitive environment, creating a monolithic, inflexible CIAM system will quickly put the firm on the path toward extinction."  - Forrester's Customer-Obsessed IAM Operating Model April 2020_

There is an "old-school" view of Identity and Access Management (IAM) that sees it purely as a security requirement for apps and websites. Simply put, IAM is there to keep the bad guys out and let the good ones in. 

A more progressive view recognizes how IAM can help provide a better level of user convenience and app-level [personalization](https://auth0.com/blog/how-identity-management-helps-you-personalize-your-user-experience/), as well as [lower-friction interactions](https://builtin.com/product-management/customer-friction). Plus, it can offer the business better CRM data, a lever for managing [data privacy](https://auth0.com/blog/data-privacy-101/) and [compliance](https://auth0.com/security) controls, and (if implemented properly) a consistent [security perimeter](https://www.itproportal.com/features/why-user-identity-is-becoming-the-new-security-perimeter/) across all apps/properties.

But there's a third level of benefit of IAM that IT often overlooks: _A consistent, flexible IAM foundation can contribute to the firm's overall [digital agility](https://auth0.com/digital-transformation)._ 

Here's why: IAM systems have traditionally been embedded into apps and frameworks (think: React, Angular, JS, etc.). Using that approach, each app runs the risk of becoming an IAM silo unto itself. And when it comes time to integrate those apps with other identity-driven systems, the approach can create a massively _inflexible_ infrastructure. 

Worse, firms should expect that many of their custom apps will have to work alongside other enterprise apps &mdash; e.g., marketing, digital experience, privacy/governance, business systems, and of course, security and analytics. However, the reality is that the logical topology surrounding your IAM system _will always be dynamic and distributed_ &mdash; plan for it. The nature of enterprise systems IAM needs to interface with will always change. But when business leaders don't plan a consistent IAM foundation, digital agility is one of the big losers.

![IAM](https://images.ctfassets.net/23aumh6u8s0i/sBencPL2DaZRTy2DXX8JJ/ebc8f6a50b2b5f9eb45442c49edb43b7/iam_digital_agility)

## Identity Has Become a Foundational Component of Digital Transformation, IT Agility, and Infrastructure Modernization

[_Digital transformation_](https://auth0.com/blog/what-digital-transformation-is-and-what-it-isnt/) initiatives are when progressive software-driven companies shift from rigid, monolithic IT infrastructures and apps into more componentized [API-first architectures](https://auth0.com/blog/the-business-value-of-api-first-design/). These are more easily reassembled/rearchitected and reused (see this great blog about [API strategies](https://blogs.informatica.com/2019/09/18/how-to-win-with-apis/) by Informatica). Component software also means that app updating can be done on a piece-part basis, without requiring the _entire_ application to be retested and QA'd. 

When shifting to an API-based strategy, there is often a simultaneous [replatforming](https://auth0.com/blog/what-is-replatforming) initiative for some (or all) of the components, shifting them into the cloud and/or onto serverless cloud platforms. These initiatives also help businesses respond more rapidly to fast-moving opportunities and/or competitive issues. The growth of API-first architectures and use of serverless execution platforms has been nearly geometric during the past few years.
![Growth API](https://images.ctfassets.net/23aumh6u8s0i/4dwfCPiVqFIyeaNqR5KFAN/8f3e34515b5bdb607e7d46620555dafc/growth_api)

### Distributed and loosely coupled

In software design, a loosely coupled system is one where each component has, or makes use of, little or no knowledge of the other components. This could include the coupling of software classes, interfaces, data, and other SaaS services. Loose coupling is important because it allows you to rearchitect specific components in the future with minimal impact to other components. 

Often, one of the loosely-coupled underpinning layers of these digital transformation initiatives is security and access management &mdash; certainly found at the application level, but also even at the _component_ level. With potentially millions of such API-first distributed components being deployed, each component, app, and composite application _must be reliably and consistently secured_, embracing the capacity to be _identity-aware_.

Decoupling identity from the application and/or app component means avoiding inconsistent IAM stores/DBs, yet ensuring a consistent privacy model, reliable access, and a strong security perimeter. 

## The auth0 Point of View: Your Identity Management Functions Must Be Componentized, Programmable, and Cloud-Neutral

Many of today's IAM technologies are embedded in programming frameworks and therefore hardwired to apps. We believe these IAM functions must &mdash; and will &mdash; become decoupled from the apps they support. Decoupling IAM helps release customers from the bonds of vertical integration stacks that are inherently siloed, brittle, and fundamentally non-optimized for the complexity of today's identity needs. 

IAM functions should also be released from mega-cloud lock-in. The market requires an IAM foundation that's open and customizable &mdash; rather than a foundation that binds customers to an Amazon, Azure, or Google agenda.

This matters because an IAM approach that's API-first, application-decoupled, and componentized also allows developers and their enterprises to rearchitect and dynamically deploy new updates, features, and functionality without disrupting the underlying identity infrastructure. That results in the ability to respond to business conditions and competitive situations more quickly and reliably.

<div class="alert alert-info alert-icon">
<i>“Using microservices in containers has also allowed us greater flexibility when deploying IAM solutions.  Typically IAM solutions have featured larger, more monolithic services that are harder to scale and upgrade.  Microservices allow the structuring of an application as a collection of loosely coupled services.  This architecture then enables the continuous deployment of complex applications, as it is less complicated to update smaller services incrementally than larger ones.  It also allows the scaling of particular components (e.g. databases, LDAP servers, etc.) to meet demand as required.”</i></br> 
<b>~ IAM DevOps in Capgemini, Terence Stamp</b><br>
</div>

### Some closing recommendations 

For executives, technology agility equates to business agility. Work with your technical colleagues to understand what IAM underpinnings you currently have and how those will need to evolve to work alongside adjacent systems for marketing, digital experience, privacy/governance, business systems, and security and analytics. Urge technical partners to: 
* **Seek to componentize applications underpinned by a consistent IAM infrastructure**. Treat IAM as a reusable component service the way you use other reusable SaaS services (e.g., payments, databases). 

* **Measure and justify the benefits of IAM across your infrastructure**. Collaborate with colleagues in security, customer experience, web, and CRM teams; assess where identity can yield quantifiable top-line revenue and competitiveness.

* **Prioritize customer outcomes within digital transformation initiatives**. Digital agility and transformation program outcomes must be driven by a focus on responsiveness to customer needs and expectations. Identity management foundations not only contribute to a consistent/reusable infrastructure but also help build a comprehensive customer 360°.

* **Neutralize cloud vendor lock-in risk with an independent, cloud-neutral IAM system**. Long-term agility and avoidance of high switching costs are further enabled by using an independent, cloud-neutral IAM service.

For technologists, it's time to apply IAM like other loosely-coupled SaaS services you commonly use. For example: 
* **Use familiar API and microservices principles when adding IAM into your platform**. Select a reusable, easily-integrated cloud IAM service that's compatible with a broad set of programming languages and frameworks. 

* **Reduce IAM time to production; simplify app reuse**. Get your team started quickly with a solution offering SDKs, quickstarts, and implementation guidance. 

* **Consolidate user IAM systems and databases**. Use an IAM solution offering a range of migration tools and customer DB connections to fit the user migration scenario best for you. 

To learn more about how IAM contributes to overall digital agility, [explore our identity resources](https://auth0.com/resources/), or [reach out to sales](https://auth0.com/contact-us).

<include src="asides/AboutAuth0" />


Digital Agility: The Auth0 Point of View

Learn what multi-factor authentication is and different methods for implementing MFA.


Before you can learn about multi-factor authentication, you must understand authentication itself. Authentication, simply put, is the process of **verifying that someone is who they say they are**.

When you want to sign in to your account on a website, the website must first make sure you're the owner of that account. How do they do that? They ask you for something that only you should know. Typically, this is the **username and password** that you set up when you created the account. Great! You were the one who set it up, so there's no way anyone else could have your password, right?

It turns out that someone providing the correct username and password to access a resource doesn't necessarily prove that they are who they say they are. User credential breaches have become much more prevalent in recent years, so there's a good chance that some of your username and password combinations have been involved in a breach. This means that relying only on a username and password to identify someone isn't a great practice.

This is where multi-factor authentication comes into play.

## What is Multi-factor Authentication

Multi-factor authentication (MFA) provides a method to verify a user's identity by requiring them to provide **more than one piece of identifying information**.

You have most likely encountered multi-factor authentication on some of your favorite websites already. For example, when you sign in to your banking account, you may get a screen requesting that you enter the code that was emailed to you. Once you enter this code, you're then able to access your bank account. This is an example of MFA in action!

Providing a username and password coupled with a code sent to your email is one form of MFA, but there are several other options you have for implementing MFA. Let's look at some of those now.

## Types of Multi-factor Authentication

The category that you use to identify a user is called an **authentication factor**. In general, these identification methods fall into three authentication factor categories:

**Something you know** &mdash; Something you know, such as a password, PIN, personal information like mother's maiden name, etc.

**Something you have** &mdash; A physical item you have, such as a cell phone or a card.

**Something you are** &mdash; Biometric data, such as fingerprint, retina scan, etc.

To implement multi-factor authentication, you need to cover at least two of these categories.

A common scenario would be requiring a user to sign in with their username and password. This covers the "**something you know**" category. After providing their username and password, they'd receive a text to their cell phone with a short code called a one-time password (OTP). This covers the "**something you have**" category. They'll be required to type this code into the website, and if correct, then they'll be authenticated.

<AmpContent>
![One-time password screen](https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password)

</AmpContent>

<NonAmpContent>
<p>
<img class="img-responsive" src="https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password" alt="one-time password screen" style="width:50%"/>
</p>
</NonAmpContent>

In this scenario, even if an attacker knows the user's password, *it isn't enough*. They'll have to also gain access to the user's phone to provide the one-time password.

### One-time passwords

In the scenario above, the application sent the user a code known as a **one-time password (OTP)**. This is one of the most commonly used forms of multi-factor authentication. Let's take a closer look at what one-time passwords are.

A one-time password, like its name indicates, is a pseudo-randomly generated password that expires after a short time period and is only valid for one login. They are typically paired with a traditional username and password to make the authentication process more secure. Even if a user has a weak or reused password, the one-time password that is sent to them is a way to indirectly strengthen their credentials.

There are a few different ways to send one-time passwords to users.

#### SMS

SMS is one of the most user-friendly ways to send one-time passwords. The user signs in to your application with their username and password, and then they receive a text message to their cell phone with their OTP. They're able to easily copy the code from the text message and send it back to the application.

While this may be simple for the user, and it's better than not having MFA at all, it's still [not the best way](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/#The-SMS-Controversy) to send or receive one-time passwords.

Believe it or not, delivering an OTP through SMS carries the risk of compromise. Here are some of the ways that an attacker can gain access to your OTP through SMS:

- **Social Engineering** &mdash; An attacker that has breached a user's username and password may also have access to their phone number. Attackers have been known to obtain SMS-delivered one-time passwords by sending a text to the user telling them that they used to have the same phone number as them, and they are locked out of one of their accounts because they forgot to update the phone number listed on the account. They politely ask for the code that was just sent to the user's cell phone, so they can get back into their account. Many people want to help the person on the other end, so they text them the code without thinking much of it.

- **SIM Swap** &mdash; [SIM swapping](https://www.consumer.ftc.gov/blog/2019/10/sim-swap-scams-how-protect-yourself) (also known as simjacking) is when an attacker gains access to your cell phone number. One interesting (and terrifying) way this can happen is by an attacker calling your cell phone provider and convincing them that they lost their phone and need a new SIM card activated. The SIM card that gets activated is one that the attacker owns. If the cell phone provider obliges, then the attacker now has access to any text messages, phone calls, etc. that come through. So, if they already have your username and password, all they have to do is type in the OTP that is texted to your phone number (which they now have access to), and they're in! This [Hacking Challenge at Defcon video](https://www.youtube.com/watch?v=fHhNWAKw0bY) has an excellent demonstration of this in action.

#### Email

Another option for receiving OTPs is through email. While this does provide another step to access your account, which is great, it still has some downfalls:

- Because [password reuse is so prevalent](https://www.zdnet.com/article/44-million-microsoft-users-reused-passwords-in-the-first-three-months-of-2019/), there's a chance that a user's email password is the same as the account that's requesting the OTP. Assuming the attacker already has this password, then the extra step of the OTP is useless.

- One of the requirements for MFA is that the implemented factors come from at least two of the MFA categories: something you know, something you have, and something you are. The username and password fulfill **something you know**, and OTP is meant to fulfill **something you have**. Ideally, something you have would be a physical item, such as your cell phone. Having access to an email account doesn't necessarily mean that the cell phone is in your possession, as you could access your email from any device. 

#### Authenticator apps

Another common way to manage OTPs is with authenticator apps. Once you install the app up on your cell phone, you can set up any accounts that work with the authenticator app to send your one-time passwords to that app. The OTPs will typically regenerate every 30 seconds, so instead of waiting for an email or a text message, you simply open up the app, and you'll always find a valid OTP there.

There are a lot of authenticator app options. Some of the most popular ones are [Duo](https://duo.com/), [Authy](https://authy.com/), and [Google Authenticator](https://support.google.com/accounts/answer/1066447).

An authenticator app is an excellent choice for receiving one-time passwords. Unlike SMS, an attacker can't access your authenticator app simply by having access to your text messages or phone number. Your one-time passwords also can't be stolen if someone gains access to your email account.

There are, however, still downsides to authenticator apps. Some users may find it too much of a hassle to download a new app and set up all of their accounts on it to receive one-time passwords, especially when it's so much easier to just enter their phone number instead.

Another issue is that if you lose your cell phone, accessing those accounts that have MFA enabled can quickly become a nightmare. Most popular authenticator apps now have [safeguards, such as key backups, built-in](https://authy.com/blog/how-the-authy-two-factor-backups-work/). To enable backups, you have to create a strong password that's used to encrypt your OTPs. Then, if you ever lose your phone, you can install the authenticator app on your new phone and type in your password to decrypt your keys.

## Step-up Authentication

You may have noticed a common theme amongst the downsides to some of the OTP options: **user experience**.

One of the biggest obstacles to mass adoption of MFA is the slight hit that user experience takes. Generally, the more steps you require to sign in to your application, the fewer people will want to use it.

To manage the balance between user experience and security, some people find it best not to require MFA on every login, but instead, require it when accessing more sensitive data.

> With [step-up authentication](https://auth0.com/docs/mfa/concepts/step-up-authentication), applications that allow access to different types of resources can require users to authenticate with a stronger authentication mechanism to access sensitive resources.

For example, say you have an application that requires users to sign in with their email and password to access customer data. However, when a user wants to see employee data, an **extra authentication factor** is required.

![Auth0 step-up authentication](https://images.ctfassets.net/23aumh6u8s0i/7AkLMOctLnHeZk8BFrw3fz/7aa520a8fa86e9f485d809c0aec4f0d2/step-up-authentication-flow)

Step-up authentication is an excellent option to bridge the gap between user experience and security.

## Implementing Multi-factor Authentication with Auth0

Now that you've seen why multi-factor authentication is important, you're probably wondering *how* you can implement it into your own apps. Let's go through how you can get MFA up and running in just minutes using [Auth0](https://auth0.com).

To start, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>. Once you go through setup, leave the tab open, as you'll be returning to it soon.

Next, you're going to clone this [sample React application](https://github.com/auth0-blog/auth0-react-sample) that has already been set up to use Auth0 for authentication.

> If you'd like to know more about how this application was built, check out [The Complete Guide to React User Authentication](https://auth0.com/blog/complete-guide-to-react-user-authentication/).

In your terminal, run the following:

```bash
git clone git@github.com:auth0-blog/auth0-react-sample.git
cd auth0-react-sample
npm install
```

Next, create the `.env` file in your `auth0-react-sample` root directory:

```bash
touch .env
```

This is where you'll store your Auth0 variables so that you can connect your React application to Auth0. Paste the following into `.env`:

```
REACT_APP_AUTH0_DOMAIN=
REACT_APP_AUTH0_CLIENT_ID=
```

Back in the [Auth0 dashboard](https://manage.auth0.com/dashboard/), click on "**Applications**" and then on the "**Create Application**" button.

Name your application anything you'd like, click on "Single Page Web Applications", and then click "Create".

![Auth0 new application](https://images.ctfassets.net/23aumh6u8s0i/4qVyZ0Mpj5B9GhqeZuSc3Y/4aeab2a7cfaf7ebddf030ba9da13106f/new-auth0-application)

Click on the "**Settings**" tab. Paste the development URL for your React application (`http://localhost:4040`) into the text area under "Allowed Callback URLs", "Allowed Logout URLs", and "Allowed Web Origins".

**Allowed Callback URLs**: `http://localhost:4040`

**Allowed Logout URLs**: `http://localhost:4040`

**Allowed Web Origins**: `http://localhost:4040`

❗ Make sure you scroll down to the bottom and click "Save changes".

Next, you'll need to paste some of these values from the Settings page into your React application's `.env` file so that the Auth0 authentication server recognizes your React application.

Back in your code editor, open your `.env` file. Set `REACT_APP_AUTH0_DOMAIN` to the value for "Domain" from the Auth0 Settings page and `REACT_APP_AUTH0_CLIENT_ID` to the value of "Client ID". 

```
REACT_APP_AUTH0_DOMAIN=your-domain.auth0.com
REACT_APP_AUTH0_CLIENT_ID=yourclientidstring
```

Save this and then start your React application by running the following in your terminal:

```bash
npm start
```

Head to [`http://localhost:4040/`](http://localhost:4040/) in your browser to see your application live.

To test it out, click on the "Log In" button. You'll be redirected to the Auth0 Universal Login page (https://your-domain.auth0.com/login), where you can sign up as a new user. 

![Auth0 signup/login page](https://images.ctfassets.net/23aumh6u8s0i/6ToiqA66XF0UEs1OhYZ2Dw/66e51832bd2c5976b128ecf072927494/auth0-login-screen)

And just like that, you've successfully set up authentication on your demo React application! However, as you know from learning about MFA, this username and password approach leaves a little to be desired. Let's see how you can step up your application's security a notch by turning on multi-factor authentication.

### Enabling MFA with Auth0

Head back to the Auth0 dashboard and click on [**Multifactor Auth**](https://manage.auth0.com/dashboard/#/mfa) in the sidebar.

![Auth0 MFA](https://images.ctfassets.net/23aumh6u8s0i/7wWKd6DIOFnWafex1Iu4rT/c3df03c639a32e4679390c5b1223a7d5/mfa-dashboard.png)

There are a few options here that you can choose. To quickly see MFA in action, select "Phone Message". Scroll down a little and select "Always" from the "Require Multi-factor Auth
" dropdown, and then press "Save".

![Auth0 MFA phone number](https://images.ctfassets.net/23aumh6u8s0i/2jbVMojYAIwwnldyQBMCIY/07413d4028ea0afa75caf81f4f151969/auth0-mfa-phone-number)

Head back to your React application, sign out, and then sign back in. After entering your email and password, you'll be prompted to enter your phone number. Once you do, you'll be asked to enter the 6-digit code that was texted to you.

![Auth0 MFA text OTP](https://images.ctfassets.net/23aumh6u8s0i/4TisUePt1RFWO7GCoxiqnN/208fb3f7ab33d6be9120c862e862952c/auth0-mfa-text-otp)

![Auth0 MFA text OTP code](https://images.ctfassets.net/23aumh6u8s0i/7lCkR3RkB3XqjpIDsEk7F0/283bd91de9a1b338493df8d0361c4137/sms-otp)

Type in the code that you received to your cell phone, and then click "Continue". You'll then be asked to copy a recovery code. This is one of the safeguards that we covered back in the Authenticator Apps section that will allow you to recover your account if you ever lose your phone.

![Auth0 MFA recovery code](https://images.ctfassets.net/23aumh6u8s0i/1fK66CyrkCPmjghImTP4Hb/0e6390f24f78f7758cb8bc40b4130bbe/auth0-mfa-recovery)

Once you've copied it and pressed "Continue", you'll be redirected back to the React application, and you're now signed in!

🎉 **You just enabled MFA on your application in a matter of minutes!**

Auth0 offers several different options for MFA. This demo showed how to set up an SMS one-time password for the sake of simplicity, but if you'd prefer an even better option, you can choose from some of the authenticator apps that are offered. Feel free to experiment in the dashboard and see what works best for you!

## Wrap Up

If you need any more convincing about the need for multi-factor authentication, have a look at the popular website [haveibeenpwned.com](https://haveibeenpwned.com/). The website collects data on password breaches. You can type in your email address to see if it has been involved in any publicly known data breaches. As of writing this, there are **over 10 billion accounts** listed. So, even if you have a strong password, you're trusting the websites you use to keep that password safe, which unfortunately doesn't always happen.

While it's on your mind, take this time to go review your important accounts to make sure you have MFA enabled. Nobody wants to deal with the fallout of canceling their credit cards, dealing with stolen funds, and resetting all of their passwords because their bank account was breached due to weak credentials. Make sure you're always on the offensive by securing your accounts as much as possible! And if you run a website, take care of your users by giving them the means to secure their accounts on your application.

Be sure to reach out in the comments below or [find me on Twitter](https://twitter.com/hollylawly) if you have any questions. Thanks for reading!

Multi-factor Authentication Guide

Fintech companies must evolve their identity strategy for the future of banking.



A solid customer identity and access management (CIAM) strategy is a crucial ingredient in successful digital transformation. Over the last several months, many financial services organizations have been forced to recognize that they’re not ready to operate fully online. Features and capabilities that seemed like nice-to-haves in 2019 are being rushed to market in 2020 to meet consumers’ rapidly evolving needs. Delivering a seamless user experience without compromising a strong security posture is the fintech challenge of the moment. 

CIAM is among the best tools for building digital resilience and strengthening online banking security. [Auth0](https://auth0.com/) CEO and co-founder [Eugenio Pace](https://www.linkedin.com/in/eugeniop/) and [IMDWORKS](https://www.idmworks.com/) founder and CEO [Paul Bedi](https://www.linkedin.com/in/paulbedi/) talked with Nick Holland of Information Security Media Group (ISMG) about the role of CIAM in helping banks adapt to our new remote reality and what this means for the future of banking.

## Banks Must Change How They Interact With Customers

Life for most people has changed radically over the last several months, and we’ve reached an inflection point where we’re appraising and challenging established systems and procedures. Put plainly, banks, and fintech companies must change how they interface with their customers. 

**“The way that banks interact with their customers will evolve massively.” &mdash; Paul Bedi, Founder, and CEO of [IMDWORKS](https://www.idmworks.com/).**

For instance, [telehealth](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) has gone from an occasional use case to the new default for many types of healthcare. This shift has accelerated the pace of innovation as health systems and technology providers work to redesign their products and procedures for a new system of care.

The COVID pandemic has also created new opportunities for fraud and data theft, raising the security bar even higher. [The Federal Trade Commission](https://www.cnbc.com/2020/04/15/americans-have-lost-13point4-million-to-fraud-linked-to-covid-19.html) reports that Americans have lost more than $13.4 million to COVID-related scams since the beginning of 2020. Meanwhile, [VMWare noted](https://searchsecurity.techtarget.com/news/252481832/Ransomware-attacks-see-148-surge-amid-COVID-19) an alarming 148% surge in ransomware attacks between February and March 2020, along with a 38% increase in the number of cyberattacks in the same period. It’s never been more critical to leverage CIAM to seal up the cracks and ensure your identity strategy is sound. 

### Enable Contactless Transactions

To establish a financial relationship, people used to bring proof of their identity into a brick-and-mortar bank and show it to a bank employee. Before 2020, Millennials’ preference for online banking over in-person transactions was already driving the industry towards developing better remote capabilities, but the pandemic has accelerated this shift. Financial institutions must be able to authenticate customers remotely: not just when they are accessing an established account via ATM or mobile app, but also when they are first launching their financial relationship. The cost of face-to-face interactions, whether measured in terms of public health or time optimization, has risen.

In general, a trend toward contactless transactions has become apparent. When we ordered a takeout dinner in 2019, we met our delivery driver at the door as they handed over our eagerly-anticipated meal. Now food delivery services leave our orders outside the front door and text us because neither party wants to be exposed to unnecessary risk — and because we have the technology to enable us to neutralize that risk.

Other everyday procedures such as notarization, which traditionally involves a face-to-face interaction, analog signatures, and a physical stamp, need to evolve to match the current situation. Because of pandemic-related travel barriers, pace points out, and demand is growing for technology that facilitates international transactions and interactions. It’s no exaggeration to say that we are in the process of reimagining and rearchitecting the entire technological infrastructure upon which we’ve built our lives and livelihoods.

### Earn Customer Trust With User-Centric Security

People have faith in physical banks, Holland suggests because they can see the vault and the teller; there are powerful visual clues that the bank is secure, inviolate. The structures for cultivating and reinforcing this same level of trust in online banking security need to evolve.

A data breach has a devastating impact on customer confidence. [IBM reports](https://www.ibm.com/security/data-breach) that the average data breach costs $3.92 million — of which 36% ($1.42 million) is the direct result of lost business. [A 2019 customer survey from Ping Identity](https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf) found that 81% of respondents would stop engaging with a brand online if there were a data breach, while 25% would stop engaging with the brand across all channels. 

Bedi advocates for fintech companies embracing public, user-centric security policies and guaranteeing the security of user data across online and mobile apps. “The onus is on you, the company, to protect them, the users,” he says. He urges banks and financial services to consider establishing a contact center staffed with knowledgeable people who can help customers troubleshoot and resolve fraud issues. Now more than ever, Bedi suggests, people want to place complete trust in their financial institutions; they want the reassurance of guaranteed security and genuine accessibility.

## Balancing Security and UX Requires a Fresh Authentication Approach

Maintaining a strong security posture without creating friction that drives users away is a perennial challenge. This is especially true with fintech companies and banks: They operate under heavy regulation, and their top priority is protecting user accounts. Their user bases, meanwhile, often vary wildly in terms of technical sophistication, so the authentication function must be low-friction to avoid confusing, frustrating, and ultimately losing customers. 

### Lose focus on UX and lose 32% of your users

The impact of a cumbersome user experience is easy to dismiss, especially when it’s so important to [protect customer data](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/) (not to mention a legal requirement across 65% of the globe). But bad experiences for users translate directly to lost revenue for you. [PwC found](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) that almost a third of customers will abandon a brand they like after just one negative experience. That’s why it’s crucial to balance high security standards and a smooth customer experience. 

Bedi argues that achieving this balance means making the security paradigm completely invisible to users. In other words, making the systems and processes involved in verifying and managing identity so seamless that the user scarcely registers them. “That’s when you know you’ve succeeded [with CIAM],” he says.

### Put authentication decisions in context

A primary consideration in balancing security and user experience, says pace, is a keen understanding of the context in which interactions are happening. Situations with different levels of risk demand different levels of authentication. For instance, just checking an account balance might require a lower level of authentication than making a transfer. When a user attempts a higher-risk action, they’re prompted with an additional verification step, like multi-factor authentication (MFA) or a [CAPTCHA](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/).

Authenticating based on context also involves looking at what time of day a request was made, from what location, and using which device. Historical behavior patterns also come into play. For example, if you always pay your bills on Monday evenings from your laptop at home, a smartphone login in the small hours of Saturday morning from an unexpected location might trigger an additional verification step, because there’s contextual evidence that you are not the one making the login request. On the other hand, a Monday evening request from your living room might not require that additional authentication — and demanding it might create sufficient friction to drive you, the user, to another bank.

Pace explains that the security world has tended to view authentication in binary terms: a user is either authenticated or they’re not. Fortunately for today’s use cases, modern CIAM technology is sophisticated enough to evolve systems to evaluate all of these contextual factors when making decisions. Requesting different levels of authentication depending on context allows fintech companies to maintain high security standards without pestering the user for authentication every time they turn around.

## The Bank of the Future Isn’t Just a Bank

No one has a clear idea of what the future of banking will be, but what is clear is that many features will remain digital. Even once it’s possible to do more banking face-to-face, plenty of customers will still prefer to bank remotely. A hybrid structure is how fintech companies will thrive going forward. 

In a post-pandemic world, real-life interactions will incur a new kind of value, and this certainly applies to financial services companies. One possibility Bedi raises is that banks will transform into offshoots of the community. Like [Capital One Cafés](https://www.capitalone.com/learn-grow/money-management/explore-capital-one-cafes/), banks might leverage their real-estate assets by opening common spaces where people can transact business face-to-face — adding another layer of value to the banking experience. Another possibility is that banking locations could become remote call centers for customers with the kinds of questions that would once have been addressed in person. 

Bedi’s predictions largely align with how pace sees banks evolving in the near future. “The emphasis will be on relationship-building,” he says. In order to keep customers coming through the doors, banks will have an opportunity to deliver value users can’t get online. A bank branch could, for instance, proactively reach out to local customers who qualify for a higher line of credit or a lower interest rate on their mortgage, instead of waiting for customers to seek out their services.

## The Future Calls for CIAM

Ultimately, no matter what new revenue streams financial companies discover in the course of hybridizing their structures, both customers and vendors will be pressuring banks to digitize more fully. A sound CIAM strategy clears the way to next-generation UX without increasing the security risk to customer accounts.

<include src="asides/AboutAuth0" />


How FinTech Benefits From IAM

Privacy and security are partners joined by an IAM



_**Disclaimer:** This article is for general information purposes only and not a substitute for legal advice. Please consult with your legal counsel to obtain specific advice for any legal manner._

Any pre-teen with a journal understands the difference between data privacy and data security. If you secretly read your friend’s journal to find out their secrets, you’ve violated the principles of data privacy. But if your friend tells you their secrets, and you write it in your own journal, and then leave that journal out where anyone can read it, you’ve violated good data security.

As a pre-teen, a failure on either front can cost you your friendship. In today’s business world — in which cybersecurity threats are rampant, and data privacy laws like the EU's General Data Protection Regulation (GDPR) and California Consumer Privacy Act ([CCPA](https://auth0.com/ccpa/)) are cropping up around the world — failure can be even more costly. Knowing the difference between data privacy and data security, and the tools you must employ to protect both can help prevent breaches and achieve legal compliance. Unfortunately, too many executives think that their data security policy covers data privacy, and vice versa.

In this climate, it’s crucial for executives to understand how these concepts differ, how they overlap, and how to incorporate both into a sound data governance strategy.

## What's the Difference Between Data Privacy and Data Security?

You can imagine data privacy and data security as a Venn diagram with significant points of overlap, but businesses should have a distinct set of strategies for managing each. 

That doesn’t mean you can have one without the other, necessarily -- you can hardly protect privacy without security. But it does mean that sometimes it’s important to look at each concept separately to make sure both sides of the security/privacy coin are being properly addressed. 

### Data Privacy

Data privacy is about defining what personal information you should and shouldn’t ask for (or gather) from your users.

It concerns how and why an entity collects, stores, shares, and controls access to sensitive data. Data privacy is about the kind of information you ask from your users (or collect via cookies or from third parties), why you ask for that information in the first place, and how you plan to use the information you’ve gathered.

**Data privacy applies to the personal information of an individual.** GDPR and [CCPA](https://auth0.com/ccpa/) have [broadly similar definitions of personal data](https://fpf.org/wp-content/uploads/2018/11/GDPR_CCPA_Comparison-Guide.pdf). An individual’s full name and mailing address will typically be considered as personal data, while in some cases, browsing history could also be seen as personal data. GDPR goes further in defining special categories of data, such as health information, political affiliation, biometric data, and sexual orientation, which are all subject to stricter requirements for processing. The personal data of minors is also subject to stricter regulation under many international laws.

**Data privacy laws address both the "how" and the "why" of data collection.** These laws require companies to transparently communicate their policies with users and give users greater control over how their data is used, which may require providing users with the ability to opt in or out — that’s the “how.” But they also require companies to disclose what purpose they’re collecting data for — that’s the “why.” In other words, what is the reason for the intrusion.

For instance, prior to GDPR’s passage, the [UK fined Facebook](https://www.bbc.com/news/world-us-canada-48972327) for giving Cambridge Analytica access to user data without user consent, violating their privacy. There wasn’t a data breach or a malicious hacker involved — the company just wasn’t respecting user privacy, and that data was then used to [manipulate elections potentially](https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election).

There are, of course, totally legitimate ways for a company to collect personal information without prior consent that doesn’t inherently violate the principles of data privacy. Most companies who do business online collect things like usernames, password hashes, bank or credit card information, and other data directly related to business operations.

If you’re a home insurance company, you may need the address of the customer’s home, the size of the home, the year it was built, etc. It may be perfectly fine to have that information, but if your insurance company shares this data with an unauthorized third party without your customers' knowledge or consent, you may be trodding into non-compliance territory.

Personal information as defined by the laws is a bit of an ever-changing and refining property, but there are [methods for keeping up with the changes](https://auth0.com/resources/whitepapers/evolving-definition-of-personal-Information). 

**Some data privacy laws, including GDPR, specifically enshrine the "[purpose limitation principle](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/),**" mandating that personal data can’t be used for a new purpose without specific permission. GDPR also requires “data minimization:” that entities don’t [collect more data than is needed for a particular purpose](https://auth0.com/blog/avoid-sinking-your-code-by-treating-data-as-a-liability/) for a specific purpose.

### Data Security

If data privacy concerns the personal data of individuals, data security concerns how a company protects that data from unauthorized access or corruption. Data security is what you do with the data you’ve gathered from your users — where you store the data, whether or not you encrypt it, who has access to it, and how you determine who is an authorized user.

It’s possible to have good data privacy standards while still failing on data security. Even if your data collection policies are strictly in accordance with the law, if you’re not protecting that data with adequate security measures such as authentication and access management, you still may not be in legal compliance.

![dataprivacy_vs_datasecurity-sep-1](https://images.ctfassets.net/23aumh6u8s0i/74v3Z31GvHeWlHw69QRUck/f46dcb7bc08161945d39d0f6bfa54283/dataprivacy_vs_datasecurity-sep-1)

## How the Law Regulates Data Privacy and Data Security

The [GDPR and the CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) came into being largely in response to unscrupulous data collection policies that failed to respect users’ privacy. Data privacy laws may require companies who deal in personal data to have well-maintained records of how user data was acquired, why, who had access to it, and where it was sold or shared and with whom. You may need to have all that information ready at all times, and be able to share it with users and regulators upon request.

The current crop of data privacy laws also specify, to varying degrees, the security measures that companies are obligated to adopt to protect data.

### Protecting Access and Anonymity

There are tools to help you build a stronger data privacy and security program.

**Access management is all about ensuring the user is who they say they are, that you have access to what you should have access to, and having a way to manage that access**. [Implementing multi-factor authentication (MFA)](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) is a major element to data security; otherwise, it would be easy for intruders to impersonate users and expose records through credential stuffing. MFA identifies users by checking who they are (a username), that they know something the user ought to know (a password), and that they have something only the user would have (a USB key, a mobile phone, etc).

Depending on which law you’re trying to comply with, **anonymization and de-identification are all about scrambling user data so it is no longer identified or identifiable**. There are varying legal and technical standards for what constitutes de-identification and anonymization, but as more laws develop, and the ones on the books have time to mature, we can expect some clarity and convergence on this front. IAM’s management can aid compliance even with ever-changing legal definitions. 

## Creating a Data Privacy Plan
A strong data privacy plan is all about knowing what data you have on the customer/client/user and why you have it.

You’ll need both an internal and external policy. Where an external privacy policy lets clients, customers, and shareholders know what kind of data your collecting and why, the internal privacy policy outlines what team members and the company can do with that information.

### Hash Out the Internal Policy

Sit down with your development team and hash out the bare minimum data you need to ask for.

A mapping app needs GPS locations, an online order needs an address, etc. Do not ask your customers (and do not _collect_ from your customers) any non-essential data. Even if it might “come in handy” due to future planned features of your business, GDPR and other laws stipulate that you cannot use data for anything beyond what it was originally gathered for. There’s no saving it “for later.”

The next step is to create a comprehensive policy for everyone that outlines what kind of data you’re collecting for your business, the related bits [of the actual regulation text](https://gdpr-info.eu/) to keep everyone on the same page, and detail who’s responsible for executing each leg of the policy.

Next, take stock of all the data you have and create a comprehensive inventory.  

An identity and access management (IAM) system can help you find and manage this kind of data. Take inventory of where the data has gone - to other businesses or people - and track how it got there and for what purpose.

### Drafting the External Policy

What do you need in your privacy policy to put customers at ease and meet compliance? 

First, find the relevant laws you’re working on in your location and business. A corporate lawyer who specializes in your industry may be a smart first investment, or at the very least seek out the advice of an expert in your field. 

Draft a privacy message that communicates what data you’re collecting and why, matching the legal requirements. Cribbing from boilerplate privacy permission forms from other companies in your industry could be a good starting point, but always work with your legal counsel to make sure your privacy statement accurately reflects your organization’s practices.

### Execute the Plan

The broadcast and execution of the internal and external privacy policy will need a multi-pronged approach. 

The internal privacy policy needs to be located in a knowledge base that all relevant team members have access too, and team members will have to be trained on the new policy. And, of course, developers will have to deploy these changes throughout the system, overhauling or tweaking how you collect customer data (and what data you collect). 

The external privacy policy will need to be broadcast wherever clients and customers will see it when giving the company data of any kind -- on a website, a mobile app, paper forms, whatever method your company uses.

## Create a Data Security Plan
Data security tackles two kinds of data: structured data and unstructured data.

**Structured data is the kind you'll find in your IAM** &mdash who is accessing what, and where, while logged into your system. Modern IAM platforms like Auth0 make handling structured data relatively easy. 

**Unstructured data is anything from emails to PowerPoint decks to paper notes on an employee's desk**: sensitive or valuable data that is outside of your IAM, that cannot be easily tracked and collated. Are employees emailing files to each other instead of sharing them via an encrypted cloud service? Are they taking data home in the form of print-outs or USB dongles?

### Make Someone Responsible for Data Security

The person in charge of these plans should be your CDO (Chief Data Officer) or an equivalent, dedicated position depending on your company’s size and resources. 

They should be in charge of compliance, data handling, and employee instruction on up-to-date data policies. 

###  Identify Your Vulnerabilities
Where are your data security vulnerabilities?

The more sensitive data you collect, the greater your security should be. If you have an online store, your IAM needs to help you manage and encrypt user names, addresses, and financial information.

For a company that controls medical information and has a greater responsibility to protect data in the eyes of the law, authorization and security must be airtight. Methods like multi-factor authentication and data scrambling become non-negotiable. Choosing a security solution with HIPAA experience that can offer BAAs is paramount.

If your organization stores messages, chat, or email from customers and clients, those messages need to be encrypted -- data pulled from seemingly innocuous communication could contain user information useful to breach financial accounts. If you offer a reward or loyalty program, those are frequent targets of fraud and require strong authentication and identification.

### Secure Every Form of Data

Your plan to secure data is going to depend on what sort of data you’re dealing with. Most, if not all, organizations deal with both structured and unstructured data. 

**In the case of structured data, your security plan should be tightly controlled permissions, multi-factor authentication, and single-sign-on policies for all sensitive data**. All passwords need to be hashed and salted in your database, as do all usernames.

**The primary weapon against unstructured data breaches is training**. To tackle unstructured data, start with a strong DLP (data loss prevention) plan to identify your most sensitive data and your most likely avenues of breach. 

Again, whoever is in charge of data security is also responsible for training team members about the danger of USB drives, sensitive information written on slips of paper, mobile phone photos and videos.

Create regular reminders and in-person training, showing all employees how to keep their communication private, and how to properly share files while keeping them in your secured Cloud. 

Detail policies of what data can go home if any, and consider tagging that data with a kind of check-out system to increase accountability.

**And don’t neglect machine-generated unstructured data**. Does your workplace have security cameras? Are those security cameras, either the live feeds or backed-up recordings, accessible online in anyway? Cameras and video storage can be hacked, and it's very easy for hackers to glean a huge amount of sensitive data from visible computer screens and conversations.

If you have a fleet of vehicles, their GPS data can be hacked. Your logistical routes for both cargo and personnel isn’t something you want a bad actor to have, but it’s the kind of unstructured data that’s easily forgotten.

![dataprivacy_vs_datasecurity-sep-2](https://images.ctfassets.net/23aumh6u8s0i/717Ex47kQdyZ5d40k3dM24/bd043d7ddbc62e50247db9b1f3399cb8/dataprivacy_vs_datasecurity-sep-2)

## How to Address Data Privacy and Security With IAM

Good data privacy and security means controlling permissions and dictating who has authorized access to user information. It means ensuring that the only people with access to user data have adequate training and are doing so for legitimate purposes. It means defining authorized access and prohibiting unauthorized access. It means knowing, at all times, who is doing what in your system and why.

One major point of overlap between data privacy and security (and subsequently the best place to address both) is IAM. With your IAM platform, you can authenticate users, protect their data from unlawful access, and create user profiles from which administrators can access and manage all the data you have on everyone in your system.

When formulating your company’s [data governance strategy](https://segment.com/resources/cdp/customer-data-management/), the right IAM solution will help you get a picture of where your data is being stored and control who accesses it. A good IAM system keeps your finger on the pulse of what’s actually happening in your system and provides up-to-date information on your user-base's data.

![IAM](https://images.ctfassets.net/23aumh6u8s0i/60gvj9w6NoByMHhxSq0wQM/95c8e6319ed6f269aee6e02a891ecf0f/dashboard)

Auth0’s IAM system creates granularity of access — you can define which users have permissions and at what level of security. It doesn’t have to be a binary choice between admins (who can access everything at all times) and users who are completely blocked. You can define different permissions for different needs: helpdesk, accounting, marketing, and your CTO would all have vastly different levels of trust and access. This not only tracks accountability better, but ensures that a breach of one account won’t necessarily expose all the data in the system.

Sophisticated IAMs also enable features like [multi-factor authentication](https://auth0.com/blog/different-ways-to-implement-multifactor/) and single sign-on, both of which [act as safeguards against breaches](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/) in the first place.

## Data Privacy Plus Data Security Equals Compliance

While data privacy and data security aren’t the same, they are complementary concepts, and executives must take both into account when approaching data.

Your users, your partners, and international regulators all expect you to be able to explain what data your company possesses, what you do with it, and how you protect it. They also want assurance that the data collected is only for the stated purpose, not to be sold, shuffled around, or exploited when new features or services are created.

The right IAM platform can help you find the answers to those questions, and help you design data privacy and data security policies that work together to form a cohesive whole.

<include src="asides/AboutAuth0" />


Data Privacy vs. Data Security: Why Your Business Needs Both

Outdated IAM can cost you in terms of analytics, security, and UX.



The saying goes, “If it ain’t broke, don’t fix it,” and plenty of CISOs and CTOs live by that motto when considering whether to update or outsource a particular functionality. But when it comes to Identity and Access Management (IAM), just because your old system is still up and running, doesn’t mean it’s working as it should.

At best, an outdated IAM solution could be leaving money on the table by failing to fully take advantage of user data. At worst, it could be leaving your company vulnerable to potentially disastrous data breaches and regulatory fines, and siphoning off developer time that could be spent refining your core competency.

We’ll go over three of the hidden costs that lurk beneath the surface of in-house IAM solutions, and how real companies have reaped the benefits of investing in an alternative.

<iframe width="560" height="315" src="https://www.youtube.com/embed/LWZkJtJw1JU" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## If You Don’t Deal With Data Security, It Will Deal With You
In recent years, data security has become an urgent issue for companies of all sizes, with [3,813 breaches reported](https://pages.riskbasedsecurity.com/2019-midyear-data-breach-quickview-report) in the first half of 2019 alone, exposing billions of records. 
The problem isn’t confined to a single industry or region, as evidenced by some of the most recent high-profile data breach stories:

* Facebook has repeatedly been in the news for exposing user records, including an [April 2019 scandal](https://www.cnet.com/news/millions-of-facebook-records-were-exposed-on-public-amazon-server/) that exposed passwords the company had stored in unencrypted text.

* A hacker broke into Australian graphic design company [Canva](https://www.zdnet.com/article/australian-tech-unicorn-canva-suffers-security-breach/), stealing 139 million records and tarnishing Canva’s reputation as a tech darling.

* Europe has been rocked by numerous major breaches and equally major regulatory fines. The [top ten GDPR fines](https://www.law360.com/articles/1223876/biggest-eu-data-breaches-generated-402m-in-fines-in-2019) for breaches in 2019 totaled €402 million.

* Meanwhile, Latin America is grappling with its own epidemic of breaches. According to [one 2018 study](https://www.welivesecurity.com/wp-content/uploads/2018/06/ESET_security_report_LATAM2018.pdf), three in five businesses in the region have had at least one security incident.

In response to these breaches and concerns about ethical data collection, new data privacy laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) are springing up around the world. 

All these laws seek to ensure that companies have appropriate security measures in place to safeguard personal data. IAM is at the heart of data privacy and security, and a sophisticated platform like Auth0 can save you money by protecting you from breaches and helping to manage your compliance obligations.

According to [IBM](https://www.ibm.com/security/data-breach), the average cost of a data breach is $3.92 million, and no company can assume they’re safe. A [Verizon](https://enterprise.verizon.com/en-gb/resources/reports/dbir/2019/summary-of-findings/) study found that 43% of all breaches in 2019 involved small businesses. One of the most serious cybersecurity threats of the moment are credential stuffing attacks, in which hackers use credentials stolen in one breach to log in to other accounts.

If these attacks lockout users (as in the [Disney+ attack](https://auth0.com/blog/the-disney-credential-stuffing-attack-could-happen-to-you/)), they can be damaging, but if someone impersonates an admin, they can be downright devastating, and [Auth0 detects](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) over 50,000 credential stuffing attacks every day. Implementing multi-factor authentication (MFA) and breached password detection are the most surefire ways to ensure your users are who they claim to be, but these capabilities may be out of reach for a legacy IAM system.

Aside from the damage done by an attack itself, a lack of security can leave your business vulnerable to prosecution under data privacy laws. Under the EU’s GDPR, many businesses have been hit with significant fines for failing to implement identity-based security measures. For example, [Dutch insurer UWV](https://www.natlawreview.com/article/dutch-supervisory-authority-imposes-gdpr-security-standard-processing-broadly) will have to pay €900,000 specifically for not having MFA in place for health data. A sophisticated IAM platform like Auth0 is continually evolving to meet the regulatory and cybersecurity challenges of the moment, while an in-house IAM solution may fall behind without constant maintenance.

<include src="TweetQuote" quoteText="Just because your old identity system is still up and running, doesn’t mean it’s working as it should. How to avoid the high cost of doing nothing."/>

## Maintaining IAM Is a Costly Distraction to Your Team
Coding for identity and authentication in-house is a time-consuming (and therefore expensive) proposition for developers. Aside from maintaining legal compliance, integrating with new applications and third parties can be tricky, since most DIY IAM solutions weren’t designed with extensibility in mind. 

While your in-house developers tinker with your system, you’re pushing back your time to market and keeping your partners and customers waiting. When you consider costs associated with those delays and missed opportunities, building IAM yourself simply doesn’t make sense; it’s like forcing a basketball team to sew its own sneakers. Now consider the alternative: outsourcing to IAM experts. 

In contrast, implementing Auth0’s platform takes less than a month for [94% of customers](https://auth0.com/blog/the-real-roi-of-auth0-part-1-time-to-market/), and according to [Forrester’s research](https://auth0.com/forrester-total-economic-impact/), Auth0’s customers reduce the time it takes to federate enterprise partners by 33%. For example, the automotive data services platform [Otonomo](https://otonomo.io/) started out with an in-house identity solution, but it became too difficult to manage as they grew. They [switched to Auth0](https://auth0.com/learn/otonomo-saves-200000-annually-auth0/) and reported savings of at least $200,000 per year and a 10% reduction in development time. Similarly, [Servcorp](https://www.servcorp.com/en/) says that they save weeks [using Auth0](https://auth0.com/learn/servcorp-saves-months-development-time-thanks-auth0/) rather than using their own in-house system when they are onboarding new applications.
 
Extensibility is particularly critical for companies in the [M&A market](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/), since quickly integrating data after a deal is crucial to identifying synergies and creating value, but without an extensible IAM solution, migrating data can take months. But a platform like Auth0’s can connect to any application, platform, or device. This allows for [automatic migration](https://auth0.com/docs/users/guides/configure-automatic-migration) from multiple databases, creating a single source of truth without slowing down normal operations.

An IAM solution’s ability to quickly integrate new features can make or break a business. Case in point: Apple recently announced that it would begin requiring every app in the App Store to [Sign In with Apple](https://auth0.com/blog/what-is-sign-in-with-apple-a-new-identity-provider/). That means that every business with a mobile app has to incorporate this feature or lose their seat at the table. But if your team has to stop everything and focus on integration, your other projects, more central to your company’s value proposition, will inevitably fall by the wayside.

<include src="TweetQuote" quoteText="Uncover the three of the hidden costs that lurk beneath the surface of in-house IAM solutions."/>

## IAM Should Be a Bridge, Not a Wall, Between You and Your Users
When you’re using a legacy IAM solution, it can feel like your company and its users are on either side of a brick wall. Users are frustrated by poor UX, and businesses are left in the dark about their users’ identities, needs, and behaviors.

Removing that barrier starts at the login box by making the experience both frictionless and secure. Achieving this requires a highly customizable IAM solution. If you’re still making your users enter a username and password combination every time they log in, you risk users forgetting their passwords and having to reset them, which is not the pleasant experience you want them to associate with your business. Users might also recycle the same password over multiple applications—the very behavior credential stuffing attacks take advantage of.

With a cutting-edge IAM platform, on the other hand, the login experience can create a single, holistic view of users. You can implement [Single Sign On (SSO)](https://auth0.com/single-sign-on) and enable enterprise federation or social login. Users are familiar with the experience of a single login giving them access to multiple applications from companies like Google, which automatically logs users into all their connected accounts. It provides them with an easy experience, and for companies, it enables the creation of data-rich profiles, allowing you to visualize each step of a user’s journey.

![SSO](https://images.ctfassets.net/23aumh6u8s0i/6OrHw7kjnnCI4U2raQ9EeG/df571074acd713cbe3db69d21ec13dc6/sso-diagram-desktop-56afcf29cf)

Building security into authentication without compromising UX requires a highly customizable IAM solution. For example, it would be a mistake to implement MFA across the board; users don’t want to have to enter a one-time code every time they log in. But Auth0’s platform allows for [step-up authentication](https://auth0.com/blog/step-up-authentication-is-key-to-making-paywalls-work-in-media/), so with a few lines of code, your developers can define the specific parameters under which to request extra credentials. With this level of customizability, you can use security measures as a precise tool, not a blunt instrument.

The login box is the most visible part of IAM for your users, but a sophisticated IAM platform goes much further in organizing and protecting their data. Legacy IAM systems leave data siloed across multiple applications and mean that a single user might have multiple profiles. That makes it difficult to manage user requests, or even have a clear idea of where all their personal data is.

But Auth0’s platform offers the simplicity of a central dashboard, a single location from which you can manage user needs. If an employee starts or stops work, you can grant or revoke their access to sensitive data. From there, you can manage permissions with the flip of a switch. If the system flags a suspicious login, you can examine the circumstances and decide what action to take. And if users make a request to change or delete data, you can quickly comply, thus meeting your data privacy obligations.

## Make IAM an Asset, Not a Drain
Most legacy IAM solutions were designed to be more or less static, but today, identity is evolving at breakneck speed. Without a cutting-edge IAM solution, your company will have to slam on the breaks every time a new data privacy law is passed, a new threat appears, and every time you want to embrace innovative new technologies. 

If you don’t have an identity platform that evolves with you, you’re building these costs into your business plan. So while “If it ain’t broke, don’t fix it” may be an apt expression in certain contexts, IAM, a better adage is “An ounce of prevention is worth a pound of the cure.” 

Digital transformation is a moving target for any company, but when choosing priorities to overhaul, consider that IAM sits at the nexus of security, analytics, and UX. If you’d like to learn more about how the right IAM solution can save your business money, time, and energy, don’t hesitate to [reach out to the Auth0 team](mailto:sales@auth0.com).


The High Cost of Doing Nothing

The value in healthcare M&As lies in data. The right IAM platform can unlock its potential.


In the past decade, healthcare has become one of the most dynamic industries for M&A deals, with global transactions valued at over [$200 billion every year](https://www.spglobal.com/marketintelligence/en/news-insights/latest-news-headlines/54645340) since 2014. M&A activity has ranged from mega-mergers brokered by private equity to independent hospitals trying to seize economies of scale by joining a local hospital system.

The healthcare merger and acquisition market is expected to remain robust in the coming year. In a [2019 Merrill Insights survey](https://hitconsultant.net/2019/05/29/healthcare-ma-survey-health-it-represents-the-richest-opportunity-in-sector/#.Xg4VbBdKhTZ) of global M&A professionals, 52% believed that the healthcare M&A market is headed in a positive direction in 2020, driven by the healthcare IT sector. Yet 40% of respondents said that data connectivity is the single greatest obstacle to harnessing opportunities in healthcare M&A.

So why is data the sticking point? Because while data should be an asset in healthcare mergers and acquisitions, trying to integrate IT in the wake of a deal can be a frustrating, resource-draining process that remains uncompleted even years after a merger has taken place.

Healthcare companies that want to position themselves for successful M&A deals need to make data integration a primary consideration, but in vast systems riddled with legacy applications in which HIPAA compliance is always a concern, it can be difficult to know where to start. The answer is Identity and Access Management (IAM): the central nervous system running through a healthcare company's operations.

## IT Integration Can Make or Break Healthcare M&As
Margins for healthcare companies, especially hospitals, are often razor-thin, so the success of an M&A transaction depends on being able to quickly capitalize on cost-saving synergies. But when data remains siloed, then integration never fully occurs, and that’s a missed opportunity for improved revenues and patient outcomes.

According to [Deloitte](https://www2.deloitte.com/us/en/pages/life-sciences-and-health-care/articles/healthcare-it-mergers-and-acquisitions-technology.html): “IT is typically the largest investment cost in the broader integration of health care systems. And it also accounts for roughly 70 percent of all synergies in the process.” Yet often, IT integration is treated as an afterthought, with no clear chain of command for overseeing it and a shortage of qualified developer talent to manage it.

For example, an analysis of American hospital data by [_Health Affairs_](https://www.healthaffairs.org/do/10.1377/hblog20190304.998205/full/) found that at hospital mergers and acquisitions, only a third of acquired hospitals switched to the electronic health record (EHR) provider of their acquirer, and 44% continued using a separate EHR system.

Broadly, healthcare companies have two options for dealing with IT integration during a merger or acquisition: the so-called “rip and replace” approach, where one entity scraps their existing software and adopts the software of the other health system, or interfacing, in which the two companies attempt to share data over separate systems. The former option can be extremely costly, and the latter can be extremely time-consuming, especially for healthcare companies using legacy or in-house software that is challenging to integrate.

## The Right IAM Solution Saves Time and Money

Using a modern IAM platform to approach the data integration challenge in healthcare M&As lets companies start sharing data across different systems immediately, creating a unified view of patients and staff. By treating identity (of patients, clinicians, and administrators) as the crucial element, rather than trying to align each individual application, a sophisticated IAM platform provides a clear path through the data jungle.
<include src="TweetQuote" quoteText="Faced with merging data during a healthcare merger? Find out why IAM is the place to start."/>
Auth0’s platform offers [turnkey enterprise federation](https://auth0.com/healthcare/) that can integrate with Active Directory, PingFederate, LDAP, or custom SAML-P providers. This enables healthcare providers to connect multiple directories, combining the data from each to create a single source of truth about patients. This gives clinicians across a healthcare system a holistic look at a patient’s history, which lets them make more informed care choices, faster.
![healthcare](https://images.ctfassets.net/kbkgmx9upatd/6T68NBcnHGWYCeqs8qeq2/e38e804ab0a26e3816cb03ba91fc103b/healthcare-phi-illustration.svg)
An IAM platform can also enrich the patient experience during a merger by creating a user-friendly patient portal they can navigate easily to look at their health plans, health insurance issues, and seek care within the medical system.

By implementing an extensible IAM solution like Auth0, you can make your healthcare organization much more attractive for M&As because you won’t waste precious developer time trying to integrate systems. Instead, you can put the right data in the hands of clinicians, administrators, and patients without forcing anyone to adapt to new software.

## Use IAM to Keep Data Secure During M&As

Personal Health Information (PHI) is a valuable asset for healthcare companies, but its intensely personal nature means that it can also be a liability, if not carefully protected. Increasingly, M&A dealmakers are making data security a part of due diligence to ensure they’re not acquiring a security nightmare. A successful M&A strategy requires an acquired company to prove from the outset that their [data is in order](https://www.docsend.com/blog/data-driven-approach-deal-management-good-everyone/) and ensure that it remains secure during the integration process.

Any IAM platform that handles PHI should be HIPAA-compliant, but Auth0 goes even further in protecting PHI from breaches that can lead to [costly fines and lawsuits](https://auth0.com/blog/8-ways-to-avoid-healthcare-breaches/). That’s more vital than ever with the rise of cyberattacks and global privacy legislation like [GDPR](https://auth0.com/docs/compliance/gdpr) in the EU and CCPA in the United States. In particular, medical identity theft is a growing concern, with [87,765 reported cases in 2018](https://www.cnbc.com/2019/06/07/how-to-avoid-medical-identity-theft.html). And in July 2019, [Quest Diagnostics](https://www.cnbc.com/2019/06/07/how-to-avoid-medical-identity-theft.html) revealed that the personal information of 11.9 million patients had been compromised by an unauthorized user.
<include src="TweetQuote" quoteText="Medical identity theft raises real threats during a healthcare M&A. Learn why IAM can be the right prescription."/>
These sorts of breaches are the result of poorly managed access to data: insufficient login requirements, unencrypted records stored in the wrong place, and inappropriate permissions assigned to staff members and third parties. The risk of these policies leading to a breach is exacerbated during an M&A when staff turnover is high and data is in transit. But with the right IAM platform, you can manage access to PHI throughout the transition period. With a user dashboard, you can see who has access to data and implement increased security protocols wherever you choose.

<include src="asides/AboutAuth0" />

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4jTBX21IwfoVe0hK9Jys4D/7bfcdf1a6525ef6a115dafcd8576402e/auth0-dashboard)

If a clinician attempts to log in from a new device, you can employ [multifactor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) to ensure they’re who they claim to be. And if a staff member exits the company, you can revoke their access with the flip of a switch.

## Healthcare M&As Need IAM Solutions
Healthcare M&A deals have the potential to deliver value for stakeholders and improved outcomes for patients, and that potential is precisely why the healthcare industry has seen such a high deal volume in recent years. But delivering on this promise requires healthcare companies to treat data as a core asset in any deal and be equipped with the right tools to put that data to work.

[Deloitte’s 2018 report](https://www2.deloitte.com/us/en/pages/life-sciences-and-health-care/articles/healthcare-it-mergers-and-acquisitions-technology.html) on healthcare M&A concluded that “If IT is not baked into the earliest stages of M&A, carefully considered in due diligence, [and] planned for in integration strategies...provider organizations can find themselves...with spiraling IT costs and mounting frustration for lack of efficiencies gained, putting the future in serious doubt.”

If you’re in the healthcare M&A market, and you’d like to address any doubts you have about your data governance, reach out to the [experts at Auth0](mailto:sales@auth0.com).


Why IAM Is the Prescription for Healthcare M&As

Your company’s value lies in its data. Here’s how to get it M&A-ready.


For executives, positioning your business for mergers and acquisitions is a bit like searching for a spouse: Ideally, two organizations join together in a binding relationship to create something that is greater than the sum of its parts. But just as most first dates don’t lead to marriage, most Merger and Acquisition (M&A) deals fall apart before they ever take place.

Often, due diligence reveals that one company’s internal operations are in disarray, and the dealmakers get cold feet. Even if the deal does go through, [research shows](https://hbr.org/2016/05/so-many-ma-deals-fail-because-companies-overlook-this-simple-strategy) that the majority of completed M&As end up coming at a loss to shareholder value.

If you’re looking to put together a successful M&A deal, you need to prove from the outset that you can integrate your operations with a new partner quickly, easily, and securely. That requires putting identity and access management (IAM) at the center of your M&A strategy.

## IAM Integration Shouldn’t Slow Down Your M&A

When the ink is dry on your M&A deal, you want to hit the ground running and capitalize on synergies, locate economies of scale, and break into new markets. But part of a merger is the merging of data, allowing you to benefit from each other’s workforces, infrastructure, and market share. If your IAM solutions don’t integrate, you can wind up with duplicate processes, wasted resources, and team members who can’t access the information they need under the new structure.

Trying to handle post-merger integration is a challenge for most in-house developers because coding for identity is a specialized and constantly evolving field. If your IAM solutions aren’t compatible, [it can easily take months](https://auth0.com/learn/servcorp-saves-months-development-time-thanks-auth0/) to integrate applications, and that’s time that internal teams should spend on value creation.

A successful M&A deal has hundreds of moving parts — from consolidating your supply chains to picking out a new logo — and, inevitably, getting both parties in line takes time. But during the onboarding period, employees still need to be able to go ahead with business.

<include src="TweetQuote" quoteText="Change is a huge part of post-merger integration. Find out how @auth0’s IAM solution is central to your M&A strategy."/>

Kurt Borg, senior product owner of Auth0 customer [Catena Media](https://auth0.com/case-studies/catena-media/), has discussed the challenge of managing multiple teams during acquisitions: “We had a lot of systems that people used to log into with different accounts,” Borg says. “That is a nightmare to maintain and it’s a nightmare for scalability because new people join and need access... And when people leave that is the most delicate thing because you need to make sure that all access is closed. If you don’t have one centralized authentication system, there’s going to be a problem.”

Controlling permissions across multiple systems requires an extensible IAM solution so administrators can manage disparate applications from a single location. Auth0’s platform connects to any application running on any platform or device, with detailed, step-by-step instructions so your developers can integrate across organizations as quickly as possible. That way, legacy applications aren't holding you back from locating cost synergies and embracing new technologies.

![Dashboard](https://images.ctfassets.net/23aumh6u8s0i/6NsvZr7ypj7N9Hbve61ObJ/14bb6abb55f40e92ff777a0f576cf980/IAM-dashboard)

## Mergers & Acquisitions Don’t Have to Compromise Customer Experience

Whether your business model is B2B or CIAM, the last thing you want to do is frustrate your customers with M&A disruptions, since every time you lose a customer, your M&A deal loses value. That’s why it’s vital to provide a seamless customer experience during the transition, even while you’re consolidating operations behind the scenes.

A modern IAM platform can enhance customer experience by providing frictionless [access across multiple brands](https://auth0.com/blog/how-enterprise-architects-can-cut-manteinance-costs-in-multi-brand-media/). Implementing [Single Sign On (SSO) Authentication](https://auth0.com/learn/how-to-implement-single-sign-on/) allows users to log in to one application and then gain access to all of a parent company’s business units without needing to sign in again. Not only does this benefit customer experience, but it’s also the first step in creating a single, unified view of your customer, rather than the same person logging in with multiple sets of credentials. Consolidating customer directories during M&As can take significant time, but with a federated approach to identity, you don’t have to wait to start creating a centralized repository of customer information to act as a single source of truth.

<include src="TweetQuote" quoteText="Discover how #identitymanagement can help reduce the scalability nightmares during acquisition-driven expansions by streamlining post-merger integration."/>

Ensuring customer satisfaction during an M&A isn’t just about improving their login experience, and your most important customer-facing touchpoints are your employees. Those employees can’t assist customers if the data they need is siloed, or if they’re struggling to navigate unfamiliar tech. But with a modern, centralized IAM platform, employees from across both organizations can access a complete profile of a customer and their needs while they're speaking, enabling them to offer the right assistance and products. Being able to offer IAM as a competitive advantage can increase the purchase price of an acquired company.

## Data Security Can Be an M&A Liability… or an Asset

If data security was once an afterthought in M&A transactions, it’s now a make-or-break factor. Today, companies must contend with a new wave of global data privacy laws like [GDPR and CCPA](https://auth0.com/blog/data-privacy-2019-the-lowdown/), which can impose debilitating fines for noncompliance.

Case in point: [Marriott International](https://www.csoonline.com/article/3441220/marriott-data-breach-faq-how-did-it-happen-and-what-was-the-impact.html) was hit with a $123 million [GDPR fine](https://www.forbes.com/sites/kateoflahertyuk/2019/07/09/marriott-faces-gdpr-fine-of-123-million/#2c71c1484525) for a data breach that came as the direct result of IT problems with their acquisition of Starwood. Starwood’s network was compromised in 2014, Marriott acquired them in 2016, and in 2018, when the breach came to light, Starwood’s reservation system still hadn’t been migrated to Marriott’s system. The breach, and its fallout, has become a cautionary tale about the importance of data security due diligence in M&A deals.

Achieving compliance in a rapidly evolving regulatory landscape requires expertise and constant, ongoing maintenance, so a legacy, in-house IAM solution may have security or compliance gaps. Some SMBs may be too small to fall under CCPA or GDPR’s scope, but it should still be part of your growth strategy. Even if you’re confident your system is airtight, an M&A deal could fall through if your prospective acquirer is nervous that they’ll be inheriting unresolved issues.

To give potential M&A partners peace of mind that there are no skeletons in your data security closet, you first have to form a complete picture of where your data is being stored and who has access to it. Unfortunately, most businesses have sensitive information siloed across business units, shared via unsecured applications, or access to vendors or ex-employees. But if you connect your applications to a centralized user management system, you can impose order on your data.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4jTBX21IwfoVe0hK9Jys4D/7bfcdf1a6525ef6a115dafcd8576402e/auth0-dashboard)

With a dashboard for user management, you can see how your data is being used, manage permissions, and implement heightened security as needed. For example, if there were a spreadsheet of unencrypted customer data, you could see who had access via your dashboard. From there, you could decide that it would be an appropriate place to implement [multifactor authentication (MFA)](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/), so your employees would have to prove their identities before accessing it.

The simplest solution for proving your data security bona fides is to outsource IAM to a trusted, credentialed IAM platforms like Auth0, whose core competency is data security and compliance. Not only will the right IAM partner provide the appropriate security updates, but it will also lend you its credibility, and your prospective partners will feel more comfortable sharing their data with you.

## Give Your Company M&A Appeal

2018 and 2019 were banner years for M&A activity, and the [trend will likely continue](https://www2.deloitte.com/us/en/pages/mergers-and-acquisitions/articles/ma-trends-report.html) in 2020. Executives who want to capitalize on this moment have to be able to prove that their partners will be getting data that is streamlined, accessible, and secure, not a tangled legacy application stamped with the idiosyncrasies of in-house developers. With an extensible IAM platform like Auth0, you can position your company for successful deals—not just in getting them signed but in getting them to deliver real shareholder value as well.

<include src="asides/AboutAuth0" />


Why Your M&A Strategy Has to Include an IAM Solution

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

IAM systems integrator enables digital transformation for Germany’s top companies


**LONDON – 7 January 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced a partnership with systems integrator [iC Consult Group](https://ic-consult.com/en/ic-consult-home/#services_img). The specialist in Identity and Access Management (IAM) is Auth0’s first partner covering the German market and works with 50% of major German companies on the DAX stock index. iC Consult Group also operates globally with 12 offices across the UK, Europe, America, and Asia.

The addition of iC Consult Group and [Auth0’s overall growth in DACH](https://auth0.com/blog/auth0-announces-growth-in-dach/) indicates demand for cloud-based identity management solutions that balance security and customer experience. According to a recent survey from Germany’s digital association Bitkom and KPMG, cloud is an important driver of [digital transformation](https://hub.kpmg.de/cloud-monitor-2019) with 73% of German companies using some form of cloud computing. iC Consult Group introduces a tremendous opportunity for Auth0 to help German customers increase their efficiency in managing user identities across digital apps and services.

“In the area of identity management, we’re seeing more of our customers deviate from on-premise to cloud-based alternatives. Auth0 addresses this need by providing a lightweight solution that is quick to implement and does not tie up unnecessary development resources. Because at the end of the day, it’s all about accelerating the digitization of services,” said Andre Priebe, Chief Technology Officer at iC Consult Group.

In addition to the classic enterprise IAM topics of governance, provisioning, Single Sign On (SSO) and identity federation, the systems integrator wants to focus more on consumer IAM, including social media logins like [Sign in with Apple](https://auth0.com/blog/learn-how-to-implement-sign-in-with-apple-easily/), and [Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/) for the Internet of Things.

"We are thrilled to welcome iC Consult Group to our program. The move to the cloud requires a new approach and specific expertise. Combining Auth0's flexible and extensible identity platform with iC Consult Group's experience moving businesses into the cloud can be a true source of competitive advantage for our mutual customers,” said Bill Lapcevic, VP of business development at Auth0.

Expansion to Germany follows the recent [growth of Auth0’s global partner programme](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/) and brings the total number of European partners to 30. Learn more and join the [Auth0 Partner Program here](https://auth0.com/partners).

## About iC Consult Group

iC Consult Group and its companies – iC Consult, xdi360, IAM Worx, and Service Layers – specialize in Identity and Access Management (IAM). The services we provide include IAM Business Consulting, Architecture and Design, Implementation and Integration, Managed Services, and our Identity as a Service offering: Service Layers. With over 300 consultants, 30 IAM product partners, and more than 1000 successful projects, we have demonstrably achieved customer success.

For more than 20 years, we have been inspiring our renowned global customers from the automotive, logistics, pharmaceutical, and financial sectors – but not only with classic IAM. We are also at the forefront of innovative topics such as Customer IAM, Internet of Things, and API Management.

For more information, please visit [https://ic-consult.com](https://ic-consult.com).

<include src="asides/AboutAuth0" />

### Media Contacts:
Silvia Hänig<br>
[shaenig@wireside.com](mailto:shaenig@wireside.com)<br>
0173-3838572<br>
089-44848127<br>

Mark Fowler<br>
Racepoint Global for Auth0, EMEA<br>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br>
+44 (0) 77 1124 4113<br>


Auth0 Expands Partner Programme to Germany with iC Consult Group

Permissions-based access controls ease administrator management



**BELLEVUE, Wash. — November 25, 2019 —** Auth0, the identity platform for application builders, today announced its integration with Session Tags, a new IAM feature from AWS. This integration provides AWS users with access to the right information based on their user attributes, and reduces the number of AWS roles and permissions policies the administrator has to manage and update when employees’ responsibilities change. 

Customers frequently manage their workforce identities using an identity provider (IdP), federating from it into AWS using industry standards such as SAML and OIDC. Now, with session tags, when users federate into AWS, Auth0 can be configured to send attributes — for example  an environment tag, project tag, team tag, and cost center tag — which are then used to determine the correct IAM policies for controlling access to AWS resources. 

Customers can rely on the attributes from their corporate directory and ensure each employee receives defined permissions based on those attributes during an AWS session, simplifying fine-grained access control. Customers are able to scale more quickly without the administrator burden, and have a verifiable audit trail for permissions-based changes. 

“A lot of customers use attributed-based access control now, but are not able to make use of their existing IdPs to do so,” said Bill Lapcevic, VP of Business Development at Auth0. “Thanks to our integration with Session Tags, AWS IAM users will benefit from the ability to use existing attributes to automatically apply specified permissions, giving power back to the IdP as the source of truth for access control.” 

Please visit our [technical documentation](https://auth0.com/docs/integrations/aws) on Session Tags for more details on how to implement this feature.

<include src="asides/AboutAuth0" />


Auth0 Announces Partnership with AWS for IAM Session Tags

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn avatar

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn

I like working at Auth0 because I’m interested in how to scale a startup and training the next generation of identity experts.

Strategic Operations and Technical Field Enablement Director

Yvonne Wilson

Five critical identity features to help you rapidly innovate your business strategy


You can’t buy digital transformation off the shelf.

Digital transformations are driven by a fundamental rethinking of business strategy that creates new business models and innovative services that offer your customers more personalized experience and significant new value.

A few examples of innovative digital transformation:

- **Provide expertise**: A medical insurance company provides a smartphone app that helps people evaluate illnesses and obtain advice on whether they need to visit a doctor. The ability to get immediate advice provides assurance to customers without adding the cost of non-essential visits to doctors offices and emergency rooms.

* **Utilize simulations**: Manufacturers of expensive equipment that is costly to reconfigure such as wind turbines in a wind farm add sensors that feed into simulation apps. Simulation enables customers to experiment faster and with less cost to identify the best configuration to use with a product. This helps customers maximize the benefits they get from products faster, which increases customer satisfaction.

- **Change revenue model**: Vendors of physical products convert a product into a subscription service to create an ongoing revenue stream, with apps to manage the new service. For example, instead of selling lightbulbs, providing lighting as a service so building owners no longer worry about buying and replacing lightbulbs. This provides a helpful service to customers and an ongoing, service-based revenue stream to the lightbulb vendor.

* **Monitor systems**: Manufacturers can add monitoring capability into products to enable remote monitoring via apps to give customers status and early warning of likely failures in equipment or services they’ve purchased. This applies to everything from medical devices to heavy construction equipment to locomotives. Access to granular sensor data helps prevent downtime in critical equipment and increases customer visibility and satisfaction.

* **Multi and Omnichannel**: Almost any business can use digital transformation to integrate customer experience across multiple sales channels and platforms to deliver better customer experience. Orders placed on a website can send alerts with shipping updates or in-store pickup data to a customer’s phone. A customer in a retail store can take a picture of a product in an app that pulls up all the relevant product information from the website. This provides better information to a customer and enables staff to spend time helping customers in other ways.

Digital transformation drives how an organization combines technology, people, and processes to deliver new or creatively updated services that help customers solve problems, gain new insights and save time.

For innovation to provide a competitive advantage, it has to be unique to your business, which often requires some custom applications. The applications created as part of digital transformation require several different Identity Management features.

## **Critical Identity Features for Digital Transformation Apps**

Auth0 has worked with customers in many industries on creating the identity management foundation for their digital transformations. We’ve identified five common identity requirements for successful digital transformation projects.

### Feature #1: Readying Authentication

Almost every digital transformation project involves applications that need to authenticate users, but most teams can’t afford the time to research obscure authentication protocols and it’s highly likely that the project could require consolidating or connecting to legacy systems. Ultimately, teams need a secure authentication platform that’s easy to integrate with applications and that solves the problem of legacy user stores, so the team can focus on delivering innovation and business value.

If a project involves sensitive data, you’ll want to offer your customers the added protection of multi-factor authentication that’s convenient to use.

### Feature #2: Extensible User Profiles for Customized User Experience

Delivering a personalized experience to users requires that applications have access to user profile data. This requires the ability to consolidate or integrate disparate sources of user profile data if they are spread across legacy repositories. It also frequently calls for the ability to customize the user profile information available to your applications.

### Feature #3: Swiss Army Knife of Identity &mdash; Authentication Hub

Many digital transformation projects involve collaboration and the need to authenticate users from partners, business customers, and consumers. Some organizations will demand that you support their chosen identity service (bring-your-own-identity) so they retain centralized control over their users’ accounts. This requires supporting many different authentication protocols such as SAML, OIDC, and myriad custom implementations by different social providers.

### Feature #4: Omnichannel &mdash; Be Mobile Ready

As digital transformation initiatives progress, they need to integrate services across different device channels, known as providing multi-channel and omnichannel service. This demands a similar authentication experience across different device types for an integrated customer experience.

### Feature #5: Authorization

Digital transformation projects require the agility of application architectures based on APIs which can be evolved rapidly. Security demands proper authorization to access those APIs for both applications and users. This requires an extensible authorization platform to govern access for users, applications, and APIs.

<include src="TweetQuote" quoteText="Find out what are the critical identity features often required for #digitaltransformation wins."/>

## **Auth0 Has You Covered**

Auth0’s authentication and authorization platform can be easily integrated into your applications and provides each of the critical features described above, so your project is successful.

### Authentication

Auth0 provides an authentication service, complete with user login and signup features, that can be customized and branded, as needed, with minimal effort. Auth0 can support authentication against legacy databases or help you migrate users out of legacy repositories if needed. With Auth0 you can also turn on multi-factor authentication with a toggle, immediately offering stronger authentication to protect your customers’ data.

[_Auth0's Lightweight Universal Login_](https://auth0.com/universal-login)

![Auth0's Lightweight Universal Login Auth0](https://images.ctfassets.net/23aumh6u8s0i/54lZ5srDBAM0dqWSRkdxXk/f4260dcf2af6e7b5b4a52c62769e0745/lightweight-login)

### User Profiles

Auth0 provides options for migrating and consolidating user profiles from legacy databases, and the ability to deliver customized user profile data to applications. Auth0 features can optionally be used to migrate users from legacy data stores into one consolidated repository. You can also customize the user profile data within Auth0 and deliver selected custom attributes to applications in signed security tokens. This enables your applications to deliver a more customized experience for each user.

[_Customized User Profile_](https://auth0.com/docs/users/concepts/overview-user-metadata?origin_team=T025590N6#metadata-usage)

```json
{
  "emails": "jane.doe@example.com",
  "user_metadata": {
    "hobby": "surfing",
    "room_preferences": ["king", "finance_news", "quiet"],
    "preferred_language": ["french"]
  },
  "app_metadata": {
    "plan": "full",
    "hotel_addons": ["tour", "laundry", "biz-center", "spa"],
    "last_visit": "2019_05_09"
  }
}
```

[_User Profiles_](https://auth0.com/docs/users/concepts/overview-user-profile)

![Image of Auth0 Dashboard showing the User Details view](https://images.ctfassets.net/23aumh6u8s0i/2g54DuahgxCZudEUI1NY6o/dd7f81ff935b5be0ca273119b19aec82/user1)

> You can use the [Auth0 Dashboard](https://auth0.com/docs/dashboard) to manage your users.

### Authentication Hub

Auth0 supports connections to a wide array of identity providers so your application doesn’t have to directly support different protocols and the implementation specifics of each one. This allows you to easily say, "yes!" to customers and partners who demand a bring-your-own-identity model.

[_Auth0 Social Identity Providers_](https://auth0.com/docs/identityproviders#social)

![An image of Auth0 social identity providers](https://images.ctfassets.net/23aumh6u8s0i/37EouP087RNF0DWID3IlnJ/5348b16e147d1a43e56f4113ed188967/auth0-social-connections)

[_Auth0 Enterprise Identity Providers_](https://auth0.com/docs/identityproviders#social)

![An image of Auth0 enterprise identity providers](https://images.ctfassets.net/23aumh6u8s0i/5rYXcu5W2mlJja6MoI54wl/e19e75742220340589a7bef2a337fa18/enterprise-social-connections)

### Cross-Platform Support

Auth0 provides SDKs for popular languages and platforms, enabling you to deliver a unified authentication experience across both desktop and mobile platforms to support your multi-channel and omnichannel initiatives.

[_Auth0 SDKs_](https://auth0.com/docs/libraries#auth0-sdks)

![An image of Auth0 supported frameworks and languages](https://images.ctfassets.net/23aumh6u8s0i/6JeMxaoncqQuRu0BaW9UPQ/708fa3cadce011d0970c3173dca33124/auth0-sdks)

[_Authentication Platform_](https://auth0.com/)

![Authentication Platform](https://images.ctfassets.net/23aumh6u8s0i/1anAYpgtGaLXDdenMcZRZx/72a706ca6ef5c18d2ae004b5ba7cd385/authentication-platform)

### Authorization

Auth0’s authorization features make it convenient for you to protect the data you manage by controlling exactly what each application and user can do. We provide a convenient configuration interface and deliver carefully scoped security tokens to your applications.

[_Authorization_](https://auth0.com/docs/authorization)

![Image of the Permissions view of the API section from the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/6NZD2ZUvbHF2ipeBuENgql/a6e412e9acd339a0d50de089d56df44b/api-def-permissions)

[_API Authorization_](https://auth0.com/docs/api-auth)

```bash
https://YOUR_DOMAIN/authorize?
    response_type=code&
    client_id=YOUR_CLIENT_ID&
    redirect_uri=https://YOUR_APP/callback&
    scope=SCOPE&
    audience=API_AUDIENCE&
    state=STATE
```

> Example of making a [request to the authorization URL](https://auth0.com/docs/flows/guides/auth-code-pkce/call-api-auth-code-pkce#example-post-to-token-url) to get an authorization code.

<include src="TweetQuote" quoteText="You can't afford to be slowed down by identity management challenges while your team learns obscure authentication protocols. Speed up your #digitaltransformation with Auth0."/>

## Hitting Delivery Dates with Identity

You can’t buy digital transformation off the shelf, but you can buy an identity platform that starts delivering value out-of-the-box. With Auth0, you can easily consolidate legacy repositories of customers without password reset with [_trickle migration_](https://auth0.com/docs/users/guides/configure-automatic-migration), implement [_Single Sign On_](https://auth0.com/docs/sso/current) (SSO) for customer convenience, and take advantage of the latest standards and best practices for authentication and authorization, like OIDC and OAuth 2.0.

Competitive pressures and emerging privacy regulations demand that you innovate or renovate applications and deliver digital transformation at pace. You can’t afford to be slowed down by identity management challenges while your team struggles with complex authentication protocols. Your project team can focus on innovation and hitting delivery dates if you have an identity management solution that is fast to adopt — and easily extended as your project evolves.

In this post we’ve focused on the 5 common identity needs experienced across many different digital transformation projects, and how Auth0 supports those requirements. 

If you’d like to learn more about how Auth0 can help you score an early digital transformation win with identity, please reach out to an [_Auth0 resource_](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


Why Identity is an Easy Win for Digital Transformation

story-tweedie-yates

Story is a Sr. Director of Product Marketing at Auth0, where she is passionate about the value of identity in the applications you build. With an eclectic background in psychology, professional athletics and cybersecurity, her expertise lies in working deeply with analysts, sales and customers to uncover the significance of security and identity to customers’ biggest business problems. Story is a Stanford graduate with a BS in Psychology. She also has an MBA from Thunderbird School of Global Management, speaks fluent Spanish and has done business in over 40 countries. In her time off, you will find her scooting her twins around the town or exploring underwater treasures with a scuba mask alongside her husband.

Sr. Director Product Marketing

Story Tweedie-Yates

Auth0 positioned highest in the Visionaries Quadrant for ‘Ability to Execute’


After announcing our [Series E funding](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) this past May, our CTO and co-founder Matias Wolowski wrote a meaningful [blog post about Auth0's evolution over the past six years and our vision for where we're heading](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/). We believe that our placement as a Visionary in the 2019 Gartner Magic Quadrant for Access Management* is another opportunity to reflect on a few customer trends behind that vision.

According to the report, "SaaS-delivered access management has become the norm, as has advanced user authentication including MFA. AM vendors are maturing their approaches to session management, contextual and adaptive access, and API protection, which will begin to enable CARTA-aligned access management approaches."

Customer trends brought to our mind by these themes are:

1.  **Universality**: Some identity features are not necessarily user-specific - e.g. identity features typically used for consumers accessing an app are also being used for business users.

2.  **Security**: Security practitioners want identity solutions to enforce policy and export security data to their own tools vs. do the analytics and create yet another dashboard to look at.

3.  **Developer-centricity**: The influence of developers on identity tools benefits the broader team involved in identity in terms of licensing simplicity, speed of implementation, and customization capabilities.   

## Trend #1: Identity Features That Are Beneficial beyond One Use-Case

One of Gartner's criteria for inclusion in the Magic Quadrant report is, "Vendors must have marketed and sold products and services in 2018 to support all major use cases (B2E, B2C and B2B). Substantial customer numbers for each use case were required. For example, CIAM solutions that are only or mostly marketed to support only B2C use cases were excluded." We know that Auth0 has been a universal platform since day one, designed for any and all use cases, so it's relevant for us to dive into features intended for a specific audience and see if our customers are finding them helpful for other users.

For example, an e-commerce app might offer sign in via [social login](https://auth0.com/learn/social-login/) with Facebook or Google, whereas a B2B SaaS app would be more concerned with connecting to [enterprise identity providers](https://auth0.com/docs/identityproviders#enterprise) like LDAP or Office 365 and having a [delegated administration](https://auth0.com/docs/extensions/delegated-admin) functionality to manage their customers' users and permissions.

What we are seeing more and more, however, is that applications are serving different kinds of users concurrently. And features that typically would have been only considered for a particular use case are becoming surprisingly helpful for others.

For example, SSO is an important functionality for both enterprise and end consumer users. But consumers prefer to sign in with social login, which lowers login friction and increases conversions. There are social logins that are more relevant to business versus end user audiences, but customers are using the same login box for an application that caters to both enterprise and end consumers, with a social login option for each. For example, GSuite for enterprise users and Facebook for consumers. And SSO works — from that login box as a start — for each type of user.

A more surprising example is multi-factor authentication. This is widely used among business users but is traditionally believed to have a lower adoption rate with consumers due to its perceived impact on the user experience, and slowing down the login process. Our customer data shows that MFA implementation actually increases when applications include both end consumers and business customers, versus apps that only have one or the other. We are analyzing this to discover if the underlying cause is that these same customers have also possibly put [tools](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) in place like [Step-up Authentication](https://auth0.com/docs/multifactor-authentication/step-up-authentication) or [Contextual MFA ](https://auth0.com/multifactor-authentication)to lower the impact on their end users.

## Trend #2: Identity Playing an Integral Role in Overall Security Strategy  

According to this year's report, "Gartner's evaluation of vendors' products and services in this Magic Quadrant included new considerations about the vendors' primary ability to provide AM solutions that either offer embedded or integrated identity corroboration capabilities for CARTA." CARTA stands for "Continuous Adaptive Risk and Trust Assessment."

Our vision is to provide people with secure access to any application in one click or less, so this concept touches both on the element of security, as well as good user experience. We have confidence scores, a part of our own Continuous Authentication roadmap in Early Access at the moment, and we think  adaptive security is particularly important to the future of identity.

Gartner specifies that "to embrace an adaptive approach, Gartner evaluated AM vendors' capabilities to address at least these three needs:

-   Context-based "conditional" access control.

-   Integration between applications and other sources of risk context information. This can be provided via an externalized authorization architecture (OFA, CASB); an application wrapper and protocol interpretation; a WAF; zero-trust network access (ZTNA; formerly a software-defined perimeter); or an API gateway.

-   Continuousness. Risk and trust automatically assessed for every interaction throughout every session --- and this can come only through integration with applications."

To us, this suggests that no identity vendor is ever going to have all the security analytics and data, making the ability to integrate with other, more advanced and specialized tools, a necessary strategy.

In order to find anomalies in massive amounts of security data that flow from a multitude of products, well-defined and purpose-made incident response tools are the de facto best practice for mature security teams. Our customers seek the security data that comes from our platform as a way to enforce their overall security strategy. With our mission of securely enabling access to any application in one click or less, our customers no longer have to choose between security and user experience. Both can prevail.

We also have a strong interest in how our customers digest and use the security data from our product. Our vision includes an optimal and secure end user experience as well as providing an optimal experience for the teams tasked with making sense of and acting on the security data.

Our customers want us to be able to integrate with other, possibly more advanced, visualization, auditing and analysis tools as part of their overall observability strategy. They value the auditing, logging, and policy enforcement power of Auth0 alongside the ability to export that data to the tool of their choice.

## Trend #3: Developers Are Empowered to Make Decisions That Impact the Bottom Line  

[Matias's blog post](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/) highlights the visual below, with the developer in the center, surrounded by the architect, product manager, IT admin, and security engineer.

![Auth0 focuses on different actors, like end users, security teams, and administrators and IT professionals.](https://images.ctfassets.net/23aumh6u8s0i/1S43nIErK2EYrEYKuB1SoD/08b241acac6544ea5c554bffb2a7bf1e/end-to-end-solution-to-different-personas)

Source: Auth0, 2019

This entire ecosystem benefits from licensing simplicity and speed of implementation. No matter how simple you think your pricing model is, customers still want it to be even more straightforward. And developers need to get the job done to move the rest of their work forward. For them, identity is not the be-all end-all — far from it. It is instead a difficult, time-consuming speed bump that can quickly become a thorn.

And the onus doesn't just fall onto the developers, even though they are the ones implementing it. Their efforts have a ripple effect, including architects with migration deadlines, product managers with revenue targets based on launch dates, and IT Managers panicking over compliance deadlines.

While identity is historically very tricky and requires a lot of customization, vendors who have figured out [the right mix of the out-of-the-box and customization capabilities](https://youtu.be/1w8KlTMWglA) empower developers to get identity going quickly, and this benefits the rest of the team, and bottom line.

We are constantly learning from our customers and take their feedback to heart, not only to predict where the market is heading, but to continually improve upon our platform. We are excited to be in the Gartner Magic Quadrant for Access Management as a Visionary for the second year in a row and are thankful for our customers who continue to teach us about the true impact of identity on their goals.

If you would like to learn more about our vision, platform, and how we can help your organization, don't hesitate to [reach out](mailto:sales@auth0).

_*Gartner, Magic Quadrant for Access Management, Michael Kelley et al., 12 August 2019_


Auth0 is a Visionary in the 2019 Gartner Magic Quadrant for Access Management

Enable your upmarket strategy with the right technical infrastructure



Enterprise customers are demanding.

Long sales cycles, filled with requests for custom features and integrations, can monopolize your developers and your sales team. If a contract falls through, a lot of time and money will fall through with it.

But the [_move upmarket_](https://auth0.com/blog/how-to-go-upmarket-and-grow-your-revenue-by-20x/) doesn't need to be such a struggle. If you're willing to slightly alter your sales strategy, you can quickly impress new clients and close enterprise deals.

Enterprise clients present three primary challenges to growing B2B companies:

1. **Legacy technology stacks**: Enterprises prioritize stability and often favor products from companies that have long histories in their industries.
2. **Intensive security demands**: Enterprises handle large volumes of data that make security breaches especially risky.
3. **Unique needs**: Enterprises have numerous stakeholders who need to be satisfied, some of whom will demand simplicity and others customization.

With Auth0's [_B2B federation_](https://auth0.com/b2b-enterprise-identity-management/), you can shorten the sales cycle with compatible infrastructure, ensure that the connections between your product and their employees are secure, and address their unique needs with custom configurations.

![Auth0 helps B2B companies grow](https://images.ctfassets.net/23aumh6u8s0i/76cbcjek9FIZY6nxQmvdZR/f0a096097a955ecfb53f099394e91092/b2b_1)

## Offer Compatibility Options to Shorten Your Sales Cycles with Enterprise Customers

The bigger an organization gets, the more internal and third-party tools — all potentially built on different stacks with different protocols — are likely to be in use. The person you're initially selling to might not even know all the infrastructure complications lying in wait.

A primary example is identity and access management (IAM) providers. Your ability to integrate with whichever provider your customers use can drastically shorten or lengthen the sales cycle. If they use Active Directory (and _[hundreds of thousands do](https://auth0.com/blog/analysis-of-enterprise-connections-data/)_), you'll need to implement that before you can close the deal.

If you let the sales cycle stretch out (already _[estimated at 3-6 months](https://saasmetrics.co/benchmark-for-b2b-saas-sales-cycles/)_ for deals that exceed \$100,000 in annual contract value), your internal advocate might move to a different position or company, or the benefits of your initial pitch might not remain relevant. Meanwhile, you might be losing out on other opportunities as you pay expensive developers to make your back end work with theirs.

Worse, if your next customer has a different back end, you'll have to do it all over again.

Auth0 offers B2B federation that _[integrates with 10+ IAM providers](https://auth0.com/blog/how-enterprise-federation-helps-shorten-the-sales-cycle/)_. With a few lines of code, you can configure any enterprise connection, including Active Directory, LDAP, ADFS, SAML, and more.

![Auth0 enterprise connections](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation provides the technical compatibility that makes your product more trustworthy and easier to use. By configuring your app with Auth0, you effectively configure it for numerous providers at once.

A sustainable [_enterprise sales strategy_](https://sapphireventures.com/oiling-the-enterprise-it-sales-engine/) builds from one company to the next, so you don't need to start over each time.

<include src="TweetQuote" quoteText="Auth0 offers B2B federation that integrates with 10+ IAM providers. Active Directory, LDAP, ADFS, SAML? Bring it on!"/>

## Show Enterprise Customers They Can Trust You

High-profile [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) have made enterprises increasingly risk-averse. To a wary enterprise, another partnership might seem like another vulnerability. New products, though they might be valuable, risk widening an enterprise's attack surface.

Enterprises are more likely than SMBs to have security and compliance teams that will take a critical look at your product. These teams need more than assurance. Their input for your service-level agreements will go beyond up-times and scalability and into strict security parameters and compliance standards.

If you provide federation through Auth0, however, maintaining security and compliance in the authentication process is much easier. Auth0 combines the simplicity of a federated identity provider with customizable security features. Your customers can enable tools like multi-factor authentication (MFA) and reinforce compliance procedures as necessary.

![Auth0 multi-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/5zHCdntb8UHVwFG6QBnhd4/2b9f2ba4cfbcab1461b35f82e76d4e8c/why-federation-is-your-secret-weapon-for-enterprise_auth0-multi-factor-authentication)

With MFA, your enterprise clients know that access to sensitive materials won't be granted to anyone with a username and password. Despite these barriers to malicious access, administrators can approve requests easily across a variety of devices.

Guardian, Auth0's MFA application, also provides Mobile SDKs for [_iOS_](https://auth0.com/docs/multifactor-authentication/developer/libraries/ios) and [_Android_](https://auth0.com/docs/multifactor-authentication/developer/libraries/android) that enable you to build a white-labeled MFA application that matches a customer's branding.

Auth0 is compliant with a [_wide range of security, privacy, and compliance standards_](https://auth0.com/security/), such as HIPAA BAA, SOC 2 Type II, and PCI DSS, so you can demonstrate an understanding of your customer's industry-specific needs.

If you're competing with other products that have similar value propositions, the trust you build with enterprise customers can tip a decision in your favor. With Auth0 backing you, it's easier to address concerns from security and compliance teams. The faster and better you can satisfy these stakeholders, the closer you can get to completing a deal.

<include src="TweetQuote" quoteText="Auth0 is compliant with a wide range of security, privacy, and compliance standards such as HIPAA BAA, SOC 2 Type II, and PCI DSS that lets you cover your customer's industry-specific needs."/>

## Sell across Organizations with Single Sign on and Customization

Selling to an enterprise requires selling across levels and [_pleasing different parties_](https://www.copper.com/blog/enterprise-sales-prospecting). Your point of contact might be excited by the core value proposition, but the project managers might be worried about its execution. If all decision-makers aren't in agreement, a deal months in the making can fall apart.

Authentication can be a significant hurdle. IT staff, for example, might resist a new product if it threatens to increase their account-management workloads. Other stakeholders might resist the sheer addition of more credentials to memorize.

Single sign-on (SSO) can dispatch these concerns. With Auth0, employees will only have to enter their credentials once.

![Auth0 single sign-on](https://images.ctfassets.net/23aumh6u8s0i/51MTEF6y286lEpPFiuWMMC/5b67cb0f5643bb655fe06ddf981240cc/why-federation-is-your-secret-weapon-for-enterprise_auth0-single-sign-on)

Enterprises have a higher volume of users and tools, so the ability to sign on once is compelling.

Safari, a company that provides access for corporate learning materials, [_leveraged Auth0's SSO capabilities_](https://auth0.com/learn/safari-case-study/) to expand to enterprise customers. SSO cut support calls for account management without Safari having to dedicate specialized resources. They have since added numerous enterprise customers, differentiating their offering with easy authentication across desktop and mobile devices.

If you need to make integration and usage even smoother, Auth0 also provides customizable _[Rules](https://auth0.com/docs/rules)_. With this customization engine, you can make unique authentication and authorization stages for the customers that need it.

You can use Rules to assist migration by reusing information from existing databases, maintain a white list for particular users, notify systems of login attempts, and more.

## Moving Upmarket Requires a Renewed Strategy

Moving upmarket is more complicated than aiming your sales team at a different target. While you might be able to [_validate product/market fit_](https://www.intercom.com/blog/podcasts/the-myths-of-product-market-fit/) with smaller companies first, moving to enterprise clients requires significant planning.

Moving too fast can threaten your stability. A big contract might seem like a win at first, but without a [diverse customer base](https://www.inc.com/magazine/201606/jason-fried/saying-no-to-large-enterprise-customers.html), too much of your sustainability might hinge on a single large customer. If you shift your business to serve only a few clients, then your future belongs to those contracts—and that's a position no one wants to be in.

Closing deals with enterprise customers means closing the gap between a legacy provider's track record and your ability to meet the needs of your customer. The better you can tailor your product to their needs, the more you'll be able to _[shorten the sales cycle](https://blog.getbase.com/3-hurdles-slowing-sales-cycle)_ and build more valuable relationships for the long-run.

<include src="asides/AboutAuth0" />


Why Federation Is Your Secret Weapon for Enterprise

Auth0 gives you the tools and expertise to build the IAM solution that’s right for you – not us.



Creating modern applications can be like working with Legos — get the right set of instructions and you can build precisely what's on the box.

That can work for simple scenarios, but half the fun of Legos (and of business) is making what YOU want to build.

In other words, whatever you want to make — [easy integrations for multiple business units](https://auth0.com/learn/new-business-accessed-cimpress-platform-5-minutes-auth0/), a product that will [connect expert medical staff and patients globally](https://auth0.com/learn/act-md-sees-2x-dev-savings-auth0/), or [seamless customer experiences](https://auth0.com/learn/jetprivilege-case-study/) - it's unlikely to match exactly what your identity service provider has created for you out-of-the-box. Your vision, your execution, your customers are all bigger than that — you're bigger than a box, so we won't put you in one.

![You're bigger than a box, so we won't put you in one](https://images.ctfassets.net/23aumh6u8s0i/34pl8N4OEbbu63V2ibsmPC/95db6f8792ec661e07547dec35e2604a/you-are-bigger-than-a-box)

One-size-fits-all solutions assume that all organizations have the same challenges, goals, legacy infrastructure, team skills, etc. Only you know what your organization's challenges and goals are.

But identity probably isn't your main expertise. Why would it be? You're great at fintech or media or B2B Saas, so you might not realize that identity is a spot where you can increase conversion rates and [streamline your customer experience across multiple brands](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) — or realize that some intriguing ideas face security risks. If you choose Auth0 for identity, part of our job is to give you the right advice and tools to support your vision, but you are always in control.

## POC on Your Terms

Part of that control begins with the proof-of-concept (POC). You shouldn't have to wait around for months to learn whether or not a provider can handle your particular use case. Figuring out if Auth0 will work for you is free, no credit card required. And we support you with [docs](https://auth0.com/docs/), [quickstarts](https://auth0.com/docs/quickstarts) and our [Auth0 Community](https://community.auth0.com/).

Finn AI, an Auth0 customer and partner, was working on creating a conversational AI for banking providers and needed to know if Auth0 was up to the security, regulatory, and speed challenges. "Our first proof of concept around using Auth0 was done by an engineer over his weekend because he was excited about it. We had a 48-hour turnaround on that first POC of Auth0 within an SDK environment," says Robin Monks, Director of Engineering, [Finn AI](https://auth0.com/learn/finn-ai-saves-10-5-ongoing-engineering-time-auth0/).

Finn AI's experience is no anomaly. We frequently hear from customers after they've had the opportunity to explore Auth0 on their own terms.

## Helping You Do More, Go Farther

We often find that our collaborative architecture process surfaces business choices. We always present options that empower decision makers within an organization — not us.

Take the recent example of a large global industrial company looking to ensure that each business unit can handle identity independently, but remains within the organization's overall guardrails. We helped the organization create a B2B2C hybrid solution that allowed them to decide on their particular mix of control and freedom, including multi-tenants that could be unified across business units while requiring universal multi-factor authentication.

## Fixing Challenges Quickly

Not every app is born in a green field. Identity seems like it ought to be simple, but is actually really complex. Whether you're dealing with connecting multiple legacy applications across geographies with different data regulation requirements or rapidly shifting business needs, Auth0 can help you adapt by handling that complexity for you. From trickle migrations that can help you seamlessly move users without forcing password resets to [effortlessly managing scalability spikes](https://auth0.com/learn/sports-centric-streaming-service-fubotv-sees-50-roi-just-auth0s-security/), Auth0 can help you solve problems before they happen.

Auth0 helps [Siteminder](https://auth0.com/learn/siteminder-enhances-experience-security-30000-hotels-auth0/) manage more than 87 million hotel bookings each year (a rate of 166 per minute), engaging guests through a full range of [third-party applications](https://www.siteminder.com/siteminder-exchange/?utm_source=referral_pr&utm_medium=referral&utm_campaign=sm-201901-pr-global-auth0-case-study&offer=none&productinterest=sm) including mobile messaging, customized emails, mobile key, and feedback tools. Siteminder CTO and Co-founder Mike Rogers says they're also dealing with a "land grab" market situation and Auth0 helps manage that complexity. "Auth0 is pretty much invisible," says Rogers. "And, I think it works well when you are that transparent. We don't have to worry about it because login and password management is now a solved problem for us."

Rogers goes on to talk about the thousands of dollars Siteminder would need to invest yearly to remain ahead of industry identity changes. "Anytime Auth0 releases a feature, that's something we don't have to do ourselves. Ultimately, that benefits not only us, but the hotel customers that rely on us to continue supporting them through our own enhancements and innovations."

## Respecting Your Vision, Execution, and Customers

At Auth0, we're excited by the complexity of identity and the wide range of business challenges we help our customers solve every day. We do that by fully respecting our customers vision, execution, and end users. At Auth0, we give you the tools and expertise to build the identity access management (IAM) solution that's right for you, not what's right for us.

If you'd like to learn more about how Auth0 can give you the tools and expertise to build the identity access management (IAM) solution that's right for you, not what's right for us, please reach out to an [Auth0 resource](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


You’re Bigger than a Box, So We Won’t Put You in One

Business can continue, but Auth0 identity can help reduce the GDPR-induced strain.



>_UPDATE Aug. 21, 2019:  [Waiting to see if Britain's new Prime Minister Boris Johnson can pull off Brexit](https://auth0.com/blog/how-iam-prepares-you-for-brexit-deal-or-no-deal/), leaves many companies facing technical uncertainties. Auth0 is closely monitoring the ongoing developments between the EU and the UK to ensure that Auth0 remains compliant with all applicable data processing laws, whatever the eventual outcome. We understand this is an anxious and uncertain time for many organisations and we are happy to answer any questions you might have on this going forward — just reach out to an [Auth0 resource](mailto: sales@auth0.com)._


Frustrated by indecision, thousands of people took to London's streets last Saturday, demanding a second Brexit referendum to "[put it to the people](https://www.npr.org/2019/03/23/706241418/march-in-london-demanding-a-second-brexit-vote-draws-huge-crowds)."

[Brexit could happen as late as May 22nd](https://www.ft.com/content/98ec4fc6-4c7d-11e9-bbc9-6917dce3dc62), in the unlikely event that British Parliament approves Prime Minister Theresea May's deal &mdash; or with a two-week extension on April 12th, if it doesn't. But even April isn't a hard deadline, with more than 120 MPs backing [an amendment in support of indicative voting](https://www.theguardian.com/politics/2019/mar/25/the-week-ahead-for-brexit-third-time-lucky-for-may) this week on options like leaving with no deal, a second referendum, or revoking Article 50 altogether.

"There are concerns that a no-deal Brexit could cripple traffic at border crossings and ports, as well as lead to shortages of food, medical supplies and other products now imported from elsewhere in the EU," reports the [Washington Post](https://www.washingtonpost.com/world/europe/the-latest-uks-may-has-personal-regret-over-brexit-bumps/2019/03/20/69deec5c-4b7e-11e9-8cfc-2c5d0999c21e_story.html?utm_term=.4e5262526ab3).

Alongside these very tangible dangers to daily life is the risk to data-driven technologies. In a recent report, Her Majesty's Treasury estimates that value at [£60 billion per year](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/731349/20180730_HMT_Discussion_Paper_-_The_Economic_Value_of_Data.pdf) to the UK economy by 2020.

What does all of this mean for companies and organizations doing business in and with the UK? We spoke with [Jonathan Keen, Associate General Counsel, Auth0](https://www.linkedin.com/in/jonathan-keen-6748a9143/) and [Chris Adriaensen, Solutions Engineering Lead, EMEA](https://www.linkedin.com/in/chrisadriaensen/) to get their insights.

<include src="TweetQuote" quoteText="What does Brexit mean for organizations doing business in the UK? We have your guide"/>

For data-driven companies (or any company with an app or website), the EU's General Data Protection Regulation (GDPR) spelled big changes in 2018, but the fact is that GDPR is actually an update and alignment of an existing network of data privacy laws. GDPR mandates that every EU member state offers at least the same (or better) level of data privacy protection to EU citizens. Countries deemed "adequate" can also freely move data across borders. Brexit raises concerns because it puts these adequacy rulings at risk for the UK.

![What does Breaxit mean for organizations doing business in the UK?](https://images.ctfassets.net/23aumh6u8s0i/3V93BWmVXIzZNUB20P80hz/57e41bf8e422b9e8b304c6750d6d6ab5/uk-may-be-leaving-the-eu)

[Source: [PixaBay](https://pixabay.com/illustrations/brexit-european-union-eu-1477615/)]

## Don’t Panic, Start Planning

"This is not the end of data protection transfers between the EU and the UK, says Jonathan, “First and foremost, companies shouldn’t panic, they should carefully analyze their data flows and identify operations that might be affected and how to address these. The UK has been operating within the GDPR framework for nearly a year now and its domestic legislative framework is unlikely to move away from the EU data protection regime, as this might hamper UK businesses ability to build and service a European customer base"

The Information Commissioner’s Office (ICO), the UK regulator for data protection, has already issued a statement confirming that even in the event of a no-deal Brexit, UK to EEA transfers of personal data will be permitted under UK law, as well as transfers from the UK to non-EEA countries who already benefit from an EU adequacy decision.

But this position has yet to be reciprocated by the EU.

“EEA to UK data transfers would be treated as if they were transfers to ‘third parties’ for GDPR purposes and require a valid GDPR transfer mechanism, such as Standard Contractual Clauses (SCCs). This would be an inconvenience and administrative burden for the businesses affected, but is by no means a show-stopper,” he says.

<include src="TweetQuote" quoteText="Don't panic, start planning. Your guide to Brexit and how IAM can help"/>

## Data Processing Center Location Matters

Since the UK faces significant challenges under a no-deal, altering a system seems unlikely. “In the medium-to-long term, it makes little sense for the UK to back away from the GDPR requirements to any significant degree, as it would handicap UK businesses’ ability to generate and support a European customer base,” he says.

What does matter, is the location of a company’s cloud provider, says Jonathan. “Cloud providers with processing centers in Europe will have a distinct advantage, regardless of how Brexit plays out.”

## Future-Proofing for Data Protection

Even though businesses move at a faster pace than most governments, they still need to plan to remain ahead of global privacy developments. "The interconnectivity and influence of modern technology have rightly elevated data protection and cybersecurity to the top of the legislative and enforcement agenda for national governments and regulators all over the globe," says Jonathan.

Expressing these regulations on a practical level isn't new says Chris Adriaensen, Solutions Engineering Lead, EMEA. "Security best practices have always existed, but GDPR enforces them. Compliance concerns are prompting companies to invest in identity management. From a technology perspective, identity and access management (IAM) helps companies address GDPR in three ways: consent management, transparency and control, and security best practices."

Data privacy, like business, is an [increasingly global](https://auth0.com/blog/data-privacy-2019-the-lowdown/) challenge &mdash; all signs suggest that regulations are going to increase rather than diminish as technology continues to develop. "Companies can consider state of the art and costs of implementation when making technology decisions, but the fact remains that building and maintaining appropriate security measures in-house is a heavy exercise. Rather than straining internal resources, they are better off using a live IAM platform that's continually updated and tested by security experts."

If you'd like to learn more about how Auth0's IAM solution can help lighten your data privacy and security load, please reach out to an [Auth0 resource](mailto: sales@auth0.com).

_EDITOR’S NOTE: [McKenzie Mayer](https://www.linkedin.com/in/mckenziemayer/) contributed to this post._


How IAM Prepares You for Brexit - Deal or No-deal

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Our 10 most-popular identity posts in 2018 ranging from auth standards to web authentication.



Time flies when you are having fun. It's December already and we are getting ready to wrap up this year. 2018 was a prolific year for the Auth0 blog: we published more than 200 posts (😱) where we tackled a diverse amount of topics: frontend and backend technologies, data breaches, GDPR, Cybersecurity, Company Culture, and of course, Identity.

We believe looking back is key to look ahead. That is why this week, we are going to take a look back at the best and most impactful posts we have published in 2018.

One article wouldn't be enough to review this amazing year, that's why we have decided to split this year in review into 3 parts: [Developer Posts](https://auth0.com/blog/10-most-popular-developer-posts-in-2018/), [Security Posts](https://auth0.com/blog/10-most-popular-security-posts-in-2018/), and Identity Posts.

Without much further ado, here's the roundup of our 10 most-popular Identity posts this year!

![Auth0's 10 Most-Popular Identity Posts](https://images.ctfassets.net/23aumh6u8s0i/2PZojrBsthRTB6sKxDI0nw/cf5db7303eafa89f7ef46b4bc5f05e81/identity-posts)

## Auth0's 10 Most-Popular Identity Posts in 2018

> The following posts are not listed in any particular order.

1. <a href="#an-overview-of-open-standards" target="_self">An Overview of Open Standards</a>
2. <a href="#3-iam-examples-to-support-digital-transformation" target="_self">3 IAM Examples to Support Digital Transformation</a>
3. <a href="#a-look-at-the-draft-for-jwt-best-current-practices" target="_self">A Look at The Draft for JWT Best Current Practices</a>
4. <a href="#introduction-to-web-authentication-the-new-w3c-spec" target="_self">Introduction to Web Authentication: The New W3C Spec</a>
5. <a href="#how-to-have-a-successful-idm-project" target="_self">How To Have a Successful IDM Project</a>
6. <a href="#how-to-have-a-successful-idm-project-part-2" target="_self">How To Have a Successful IDM Project (Part 2)</a>
7. <a href="#on-the-nature-of-oauth2s-scopes" target="_self">On The Nature of OAuth2’s Scopes</a>
8. <a href="#hashing-passwords-one-way-road-to-security" target="_self">Hashing Passwords: One-Way Road to Security</a>
9. <a href="#adding-salt-to-hashing-a-better-way-to-store-passwords" target="_self">Adding Salt to Hashing: A Better Way to Store Passwords</a>
10. <a href="#how-utilities-can-use-ciam-to-avoid-3-common-problems" target="_self">How Utilities Can Use CIAM to Avoid 3 Common Problems</a>

## <a name="an-overview-of-open-standards"></a>1. [An Overview of Open Standards](https://auth0.com/blog/an-overview-of-open-standards/)

In this overview, we will go over what open standards are and why they matter. We will also go over the top open standards used for identity including OAuth 2, OpenID Connect, JWT, and SAML. Open standards are important to understand but one can easily get overwhelmed by the technical specifications.

<include src="ClickImg" externalUrl="https://auth0.com/blog/an-overview-of-open-standards/" imgUrl="https://cdn.auth0.com/blog/10-most-popular-identity-posts-in-2018/open-certificationpng.png" altText="Open Certification" imgWidth="560" imgHeight="560"/>

## <a name="3-iam-examples-to-support-digital-transformation"></a>2. [3 IAM Examples to Support Digital Transformation](https://auth0.com/blog/3-iam-examples-to-support-digital-transformation/)

From basic website authentication to implementing an OpenID Connect server and API authentication: This article covers 3 IAM examples to support your Digital Transformation.

<include src="ClickImg" externalUrl="https://auth0.com/blog/3-iam-examples-to-support-digital-transformation/" imgUrl="https://cdn.auth0.com/blog/iam-digital-transform/sso-data-model.png" altText="SSO Data Model" imgWidth="714" imgHeight="559"/>

## <a name="a-look-at-the-draft-for-jwt-best-current-practices"></a>3. [A Look at The Draft for JWT Best Current Practices](https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bcp/)

In this post, we will take a look at the draft for the JWT Best Current Practices document. This document describes common pitfalls and attacks related to the use of JWTs, and how to implement mitigations against them. Read on!

<include src="ClickImg" externalUrl="https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bcp/" imgUrl="https://cdn.auth0.com/blog/jwt-bcp/Substitution-Attack-Different-Recipient.png" altText="Different Recipient JWT Substitution Attack" imgWidth="590" imgHeight="492"/>

## <a name="introduction-to-web-authentication-the-new-w3c-spec"></a>4. [Introduction to Web Authentication: The New W3C Spec](https://auth0.com/blog/introduction-to-web-authentication/)

Web Authentication brings a stronger authentication mechanism to the masses by defining an API that both authenticators and web browsers can implement. Learn why Google, Paypal, Mozilla, and others back it up.

<include src="ClickImg" externalUrl="https://auth0.com/blog/introduction-to-web-authentication/" imgUrl="https://cdn.auth0.com/blog/webauthn/1-Web-Authentication-Entities.png" altText="Web Authentication Entities" imgWidth="617" imgHeight="409"/>

## <a name="how-to-have-a-successful-idm-project"></a>5. [How To Have a Successful IDM Project](https://auth0.com/blog/how-to-have-a-successful-idm-project/)

Learn how to create a realistic project plan to have a good Identity Management project deployment.

<include src="ClickImg" externalUrl="https://auth0.com/blog/how-to-have-a-successful-idm-project/" imgUrl="https://cdn.auth0.com/blog/good-idm-project/enabling-mfa.png" altText="Eanbling Multi-factor Authentication (MFA) from Auth0" imgWidth="617" imgHeight="361"/>

## <a name="how-to-have-a-successful-idm-project-part-2"></a>6. [How To Have a Successful IDM Project (Part 2)](https://auth0.com/blog/how-to-have-a-successful-idm-project-part-2/)

Learn how to plan for failures and changes in your identity project.

<include src="ClickImg" externalUrl="https://auth0.com/blog/how-to-have-a-successful-idm-project-part-2/" imgUrl="https://cdn.auth0.com/blog/how-to-have-a-successful-idm-project-part-2/resetting-a-users-multi-factor-account-with-auth0.png" altText="Resetting a user's multi-factor account" imgWidth="617" imgHeight="439"/>

## <a name="on-the-nature-of-oauth2s-scopes"></a>7. [On The Nature of OAuth2’s Scopes](https://auth0.com/blog/on-the-nature-of-oauth2-scopes/)

Auth0 Principal Architect and Identity expert Vittorio Bertocci on why using OAuth2 scopes in every authorization scenario is not a good idea.

<include src="ClickImg" externalUrl="https://auth0.com/blog/on-the-nature-of-oauth2-scopes/" imgUrl="https://cdn.auth0.com/blog/on-the-nature-of-oauth2-scopes/oauth2-scopes-mail-api.png" altText="OAuth2 Scopes Mail API exmaple" imgWidth="617" imgHeight="280"/>

## <a name="hashing-passwords-one-way-road-to-security"></a>8. [Hashing Passwords: One-Way Road to Security](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/)

A strong password storage strategy is critical to mitigating data breaches that put the reputation of any organization in danger. Hashing is the foundation of secure password storage.

<include src="ClickImg" externalUrl="https://auth0.com/blog/hashing-passwords-one-way-road-to-security/" imgUrl="https://cdn.auth0.com/blog/hashing-one-way-road-to-security/hash-flow.png" altText="Hashing algorithm flow example - one-way" imgWidth="617" imgHeight="340"/>

## <a name="adding-salt-to-hashing-a-better-way-to-store-passwords"></a>9. [Adding Salt to Hashing: A Better Way to Store Passwords](https://auth0.com/blog/adding-salt-to-hashing-a-better-way-to-store-passwords/)

A salt is added to the hashing process to force their uniqueness, increase their complexity without increasing user requirements, and to mitigate password attacks like rainbow tables

<include src="ClickImg" externalUrl="https://auth0.com/blog/adding-salt-to-hashing-a-better-way-to-store-passwords/" imgUrl="https://cdn.auth0.com/blog/adding-salt-to-hashing-a-better-way-to-store-passwords/password-salt-example.png" altText="Example showing how using a salt with hashing produces unique hashes." imgWidth="617" imgHeight="277"/>

## <a name="how-utilities-can-use-ciam-to-avoid-3-common-problems"></a>10. [How Utilities Can Use CIAM to Avoid 3 Common Problems](https://auth0.com/blog/how-utilities-can-use-ciam-to-avoid-3-common-problems/)

Customer identity and management technology helps utilities reshape how they interact with users, improve their services, and tighten security.

<include src="ClickImg" externalUrl="https://auth0.com/blog/how-utilities-can-use-ciam-to-avoid-3-common-problems/" imgUrl="https://cdn.auth0.com/blog/how-utilities-can-use-ciam-to-avoid-3-common-problems/progressive-profiling-flow.png" altText="Utility customer progressive profiling flow" imgWidth="617" imgHeight="303"/>

## What's Next?

We are already preparing our content pipeline for 2019. Identity and digital transformation are key areas that will keep businesses evolving to tackle challenges around privacy, usability, growth, and sociopolitical policies. We are committed to keep our content relevant to these changes and offer effective solutions through our products and services.

We'd like to take this opportunity to thank all of our readers for their consistent support and feedback. Is there anything that you'd like us to cover in 2019? Any particular identity topic or trend? Please let us know in the comments below or through social media ([Twitter](https://twitter.com/auth0), [LinkedIn](https://www.linkedin.com/company/auth0)). As always, you can subscribe to our newsletter to receive a weekly digest of our blog content.

Happy Holiday Season!

<include src="asides/AboutAuth0" />


10 Most-Popular Identity Posts in 2018

Multifactor authentication and social login are just two of several tools that Auth0 offers on its platform to guard its customers against breaches.



The number of attacks on individuals' data is astounding. From the [Equifax breach](https://www.washingtonpost.com/news/the-switch/wp/2018/03/01/equifax-keeps-finding-millions-more-people-who-were-affected-by-its-massive-data-breach/?noredirect=on&utm_term=.4bbb572bb730) that continues to worsen to attacks on high-tech companies like [Uber](https://www.wired.com/story/uber-paid-off-hackers-to-hide-a-57-million-user-data-breach/) — it seems as if no one is immune to cybercrime. 

Several common threats exist to web apps:

* XSS (cross-site scripting), when malicious scripts are injected into otherwise trusted web applications
* Clickjacking, which happens when an attacker introduces transparent or opaque objects into your web application
* Cross-site request forgery, in which an attacker impersonates an authorized user and makes requests on their behalf, like resetting a password.

And it doesn't stop there. These threats are constantly evolving. As soon as IT teams and experts root out dishonesty,  it seems like the criminals pivot to find a new path. 

So what can you do, now, to secure your user database in this difficult landscape?

<include src="TweetQuote" quoteText="What can you do to secure your user database when there are so many threats like XSS, Clickjacking, Cross-site request forgery, etc?"/>

This piece will offer concrete tools and approaches for keeping your customers safe and help you build a solid technical foundation on which to scale. 

## Why Is Your User Database At Risk?

A major reason that user databases are at risk is inherent software vulnerability. For example, Apache servers have historically been exposed to the [Heartbleed](http://heartbleed.com/) bug. Heartbleed is unique to OpenSSL (the data encryption technology used by a huge chunk of the internet) and allows attackers to intercept vulnerable information between one's browser and computer. 

If you're entering a password or payment information into a browser, for example, although this data will be encrypted during the transfer to the computer on one level; a second connection, often described as a “heartbeat” between the browser and computer can be intercepted.

![The heartbleed bug](https://images.ctfassets.net/23aumh6u8s0i/7bi6p1IFj7zJXCTzoN17S5/2dc69f99ed1d1efc1ce92a3c6738fdaf/the-heartbleed-bug)

([Source](https://www.youtube.com/watch?v=WgrBrPW_Zn4))

The Heartbleed bug manipulates the secret keys that the browser and computer use to encrypt the names and passwords of the users, along with other sensitive content. In vulnerable versions of OpenSSL software, hackers can break in and steal data directly from the services and users. You can read more about it on the [Heartbleed website](http://heartbleed.com/). 

### Why Not Just Patch The System?

If you find holes or vulnerabilities in your system, why not just fix them up and continue with business-as-usual? 

First, taking a user database offline creates downtime for a business. This can result in frustrated users who enjoy and rely on your service. Down the line, it can lead to a loss in revenue. 

Patching software is also risky. Particularly if you work with a lot of sensitive customer information, such as [financial transactions](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), making changes to a software library can break critical processes, leaving your users out to dry with payments incomplete and exposed. 

In some dire cases, such as a medical facility, it could truly be a matter of life and death if your system, full of patient data, shuts down (even temporarily). 

## A Better Solution: Secure Your User Database With Auth0 Identity Tools

Outsourcing your cybersecurity needs, particularly for a user database, can be an excellent solution. Only a few teams have the in-house capability to build and customize cutting-edge tools without support. Particularly if your company is constantly growing and changing as it should — you need to both brace your systems against attackers and make them flexible enough to allow you to scale. 

Auth0 has [several tools](https://auth0.com/why-auth0) to help you do this.

### Content-Aware MFA Technology

Amid the many features that Auth0 offers customers on its universal authentication and authorization platform, [multifactor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) helps ensure that only the right users gain access to your system. Even if a hacker obtains a user's login credentials, s/he still needs a second piece of information, such as the user's thumbprint or mobile device, to make it through. 

It's simple to add MFA to your app. For example, if you want to add the Google Authenticator, which provides a six to eight digit one-time password to users as an alternate token, you can turn this on by first visiting Auth0's [Multifactor Auth](https://manage.auth0.com/#/guardian) page from the dashboard. 

![Auth0 multifactor authentication feature](https://images.ctfassets.net/23aumh6u8s0i/2ZuIZT9aZzbLGoaygmQljD/5704c74279f0f95fb04e3ee6de2ec85a/auth0-multifactor-authentication)

If you want to use a different provider like Duo, just click on the link to switch. You can then select if you want your users to receive the password via a push notification or SMS. 

While MFA is proven to reduce breaches of user databases, few organizations have successfully integrated it. Why? Making the 2FA setup simple for customers is a challenge. Even advanced services like [PayPal](https://www.paypal.com/us/smarthelp/article/how-do-i-enable-2fa-(two-factor-authentication)-for-my-paypal-powered-by-braintree-user-faq3500) have made users opt-in through a lengthy process that entails their first logging into a control panel, navigating to their account, and then independently enabling 2FA with a QR code or another supported app.

Auth0 can help you figure out ways to integrate and communicate MFA capabilities for your users in a more seamless and self-aware way. Visit our [business blog](https://auth0.com/blog/business/) for further resources.

### Social Login Integrations

You can also build robust profiles of all of your users using Auth0's [social login functions](https://auth0.com/learn/social-login/). Social login allows users to register and access your app by connecting via a provider like Facebook.

Auth0 supports over 30 social providers, including Facebook, Twitter, Google, Yahoo, Windows Live, LinkedIn, GitHub, PayPal, Amazon, VKontakte, Yandex, Basecamp, Box, Salesforce, and more.

![Auth0 social login integrations](https://images.ctfassets.net/23aumh6u8s0i/3SndDrKq0SuzoeXOcEt6Bb/08882aef7d9d6b36f48aa6d516b5300f/auth0-social-login-integrations)

In addition, you can add any OAuth2 Authorization Server you need. To enable social login, just click Connections and then Social in the Auth0’s Management Dashboard, then flip on the switch of the social network provider you'd like in the app(s) of your choice.

The advantages of social login are numerous. A few are:

* You know your users are verified since the social provider is already responsible for verifying the user’s email. 
* If you want to double check an individual, you can immediately access information such as their interests, location, connections, and more to make sure the account is real. 
* This data can also go a long way towards underpinning new marketing and product tactics.

You can take this a step further and build even richer customer profiles by integrating with a provider like [Clearbit](https://blog.clearbit.com/avoid-tedious-signup-forms-with-auth0-and-clearbit/). Clearbit sharpens customer intelligence, allowing teams access to valuable public information that can help them outperform.

## Why Auth0?

Outsourcing your user database needs allows you to turn over these critical tasks to experts, who are up-to-date on the latest trends and are keeping pace with evolving threats. An identity services provider like Auth0 doesn't have to balance these tasks with regular maintenance projects like most IT teams do. 

<include src="TweetQuote" quoteText="Outsourcing your user database needs allows you to turn over these critical tasks to experts, who are up-to-date on the latest trends and are keeping pace with evolving threats."/>

Auth0's user database tools support all major industry standards such as SAML, OpenID Connect, JSON Web Token, OAuth 2.0, OAuth 1.0a, WS­-Federation and OpenID, preventing vendor lock-in.

If you're looking for a quick solution to help you come into [GDPR](https://auth0.com/gdpr) compliance — as part of a larger customer identity and access management (CIAM) platform — MFA and Social Login will support your getting there in an efficient manner.

If you are just starting out or [modernizing](https://auth0.com/app-modernization) legacy apps from years of prior use, integrating tools to protect user identities from the outset will build a solid foundation for your products for years to come.


Use Auth0 Tools To Securely Manage Your User Database

Outsourcing cloud-based Identity as a Service (IDaaS) and Identity and Access Management (IAM) solutions are increasing in popularity amongst a variety of SaaS startups.



Chances are, if you're a B2B SaaS company (whether you're a large, established firm like Microsoft or an up-and-comer like Slack) — you're focused on being up to speed on the latest security tools. 

For teams of all sizes, however, it can be a challenge to keep up in a rapidly evolving threat environment. How do you ensure that your team has a safe foundation on which to scale?

Building your security practices around the starting point of understanding and managing all of your users can help ensure that you always have a handle on who is working within your system and with confidential information. When crafted well, a robust identity and access management (IAM) system for your users can be a springboard for moving forward.

<include src="TweetQuote" quoteText="When crafted well, a robust identity and access management (IAM) system for your users can be a springboard for moving forward."/>

## What Is Identity and Access Management (IAM)?

According to [Gartner](http://www.gartner.com/it-glossary/identity-and-access-management-iam/), "Identity and access management (IAM) is the security discipline that enables the right individuals to access the right resources at the right times for the right reasons." As teams become more dispersed and users are logging in across multiple time zones and various devices, IAM practices have emerged to organize and control appropriate access.

Historically, when teams were largely on site, enterprises simply used their own IAM software. Nowadays, as companies add more [cloud services](https://auth0.com/blog/moving-your-app-to-cloud/), managing access is becoming increasingly complex. For IT teams that are already swamped with maintenance tasks, outsourcing cloud-based Identity as a Service (IDaaS) and cloud IAM solutions is becoming more popular.

### Identity Management: To Build or To Buy?

While you might have the in-house capacity to build your own identity and access management system, most teams don't. Even if you do, going with a DIY solution is often [less cost-effective](https://auth0.com/learn/build-or-buy-20-identity-management-questions/).

In today's environment, an effective IAM solution should

* provide a clear and centralized view of all users at a given time;
* give an admin quick controls to communicate with, manage the access of, and even block users;
* be powerful yet still flexible to grow with your company; and
* help you comply with the latest security regulations.

Asking yourself the following questions will help you determine whether it's time to outsource your IAM:

* Have you thought about how you’ll [implement user management](https://auth0.com/docs/api/v2) (e.g., self-service or admin managed? 
* How will the user experience your solution?
* What [analytics](https://auth0.com/learn/powering-user-analytics-identity/) will you need for account creation and authentication events? 
* How will you use your system to stay on top of potential security vulnerabilities? 
* How will you [flag and mitigate anomalies](https://auth0.com/learn/anomaly-detection/) in user management and authentication events?
* How will you onboard new [B2B customers wanting SSO](https://auth0.com/learn/the-b2b-customer-value-journey/) for your product or service? 

For an even more comprehensive checklist, see Auth0's [guide](https://auth0.com/learn/build-or-buy-20-identity-management-questions/).

## Use Auth0 Lock for Simple, Secure Access

An example of a highly successful tool that has worked for a range of growing software companies, more established enterprise-scale companies, and even nonprofits is the [Auth0 Lock](https://auth0.com/blog/auth0-lock-is-here-for-b2b-and-b2c/). Auth0 Lock connects the login boxes of all users (i.e., both employees and customers) via a single, embeddable widget.

![Use Auth0 Lock for Simple, Secure Access](https://images.ctfassets.net/23aumh6u8s0i/7ovBZp8aNbgYrOgYCj2tIR/1dd6bb67c3b7c6807dd0f5375079537e/auth0-lock-connections)

Instead of having multiple login boxes for each category of users, which can add a layer of complexity to the admin process, entrance with Auth0 Lock is streamlined for all. Given distinct usernames and passwords, IT admins are easily able to differentiate between users as soon as they've logged in — and can view all activity at one time, from a central hub. Separate login credentials will usher users to different sites that suit their work needs. For example, if you're in [hiring mode](https://wizehire.com/), prospects can log in to fill out applications as easily as your [finance team](https://www.teampay.co/blog/finance-goals/) can update their records.

Once Auth0 Lock is implemented, your company can add features like [social login](https://auth0.com/learn/social-login/) and [single sign-on](https://auth0.com/single-sign-on) (SS0) to further secure and enhance the UX of authentication. It's simple to [customize](https://auth0.com/docs/libraries/lock/v9/ui-customization) Lock based on your company's needs and how you want the experience to be for your users. 

### The Power of Auth0 Connections

Auth0 sits between your app and the Identity Provider (like Twitter and Facebook, or enterprise providers like Active Directory and LDAP) that authenticates your users. Auth0 Lock is just [one tool of many](https://auth0.com/b2b-saas) that will help secure this connection. 

Auth0 supports over 30 social providers, 11 enterprise providers, and three legal identities. It adds a level of abstraction to your app to help isolate it from disruptive updates or idiosyncrasies of each provider's implementation. For example, as Facebook rolls out [new privacy standards](https://auth0.com/blog/cambridge-analytica-and-facebook/), any technical updates on their end that could change the login process for your users will be internalized and streamlined.

## If You're Still Unsure About Outsourcing Your Identity Management Needs, Consider Compliance

More than simply creating a safer and easier UX, Auth0 can help B2B SaaS teams comply with increasingly stringent [security regulations](https://auth0.com/security). A specialized provider like Auth0 can become a one-stop shop for adhering to GDPR and similar laws.

<include src="TweetQuote" quoteText="More than simply creating a safer and easier UX, Auth0 can help B2B SaaS teams comply with increasingly stringent security regulations."/>

Auth0 tools incorporate

* encryption;
* password protection; and
* five levels of password complexity.

In addition, Auth0 consolidates all of your user data into a single dashboard view, making it simpler to communicate processes to stakeholders — a core tenant of GDPR. 

Auth0 is a team of experts, focused on the specific task of authentication and user management 24/7. The company is up to date on all of the latest security developments and rapid changes in the industry. We monitor for new threats and adapt our tools accordingly for B2B SaaS companies at all stages of growth.


How B2B SaaS Teams Can Stay Up To Date With Identity Management

Insurers know that digital transformation is coming. To stand out from your peers, adopt identity and access management for a secure experience that customers can trust.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---


Insurers know that implementing digital changes have the potential to benefit them long term. A recent [McKinsey study](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/making-digital-strategy-a-reality-in-insurance) found that insurers that digitized their processes eliminated 30 to 50 percent of the human service costs. The top quartile of those surveyed achieved 2X the growth of their peers.

<include src="TweetQuote" quoteText="Insurers know that digital transformation is coming. To stand out from your peers, create a secure experience that customers enjoy and trust."/>

But specific obstacles in the industry have stalled progress. First, the majority of insurers don't have the in-house technical expertise and equipment to make sweeping changes without support. In addition, many are concerned, particularly in an era of [increased scrutiny around customer data](https://auth0.com/blog/cambridge-analytica-and-facebook/), that a system overhaul could threaten measures they've already taken to protect sensitive information.

Despite these real challenges, customers increasingly expect cutting-edge solutions. Other industries, like [healthcare](https://auth0.com/healthcare/) and [financial services](https://auth0.com/financial-services), are quickly incorporating digital methods, raising the bar for everyone. Eventually, insurers will be forced to change. Early adopters will gain an edge, and those who are slow to transform will lose.

While it's possible to begin a digital transformation in many ways — from creating a new claims platform to simply delivering online quotes — starting with an identity and access management (IAM) strategy is a clear, easy-to-implement step that allows managers to attack several core functions at once.

## Legacy Systems in a Changing Environment

In industries such as [retail](https://auth0.com/retail), many teams are able to rely on consumer data pulled from public sources like [social media profiles](https://auth0.com/learn/social-login/) to underpin their strategies. This might include compiling current and potential customer interests, events they've attended, and pages they've liked. In insurance, it's more complicated. Agents work with higher-touch information sets, like health records and credit scores.

![Legacy, old insurance systems example](https://images.ctfassets.net/23aumh6u8s0i/1T3qVEXkTfn8vpmFRHZyqX/35117cf6090d3668e1aacab3d062734a/legacy-systems-struggle-to-keep-up-with-digital-transformation)

[Source: Electronic Medical Records & Electronic Health Records Software](http://www.emr-ehrs.com/mental-health-electronic-health-records.php)

This data is the foundation for building customer risk profiles, determining premiums, and completing claims. Most teams have developed processes over decades that continue to work well. Although a lot of this data exists on legacy insurance softwares and systems and may not be intuitive for new hires to find and work with, more-seasoned agents understand the process and don't feel an urgent need to change.

With such fixed methods, it can be challenging to know why and how to begin to make updates. Tweaking any aspect of an established insurance company's model, even something as simple as market research or reaching out to new prospects, could skew the whole.

Yet if teams don't start somewhere, they risk becoming irrelevant in markets that are quickly evolving. Home insurers, for example, are facing variables such as interconnected home security and heating systems, like the Google Nest; auto insurers are having to factor in autonomous vehicles and the changes that ride-sharing programs like Uber and Lyft bring; even health insurers are seeing stiff competition from newcomers, like Oscar, that have a strong focus on UX and more-affordable plans.

Just because many insurance teams have succeeded with business-as-usual for decades, it doesn't mean they don't need to revamp for the future.

## Organize Your Users for Greater Security and Efficiency

For insurance teams facing a daunting set of changes, developing a clear [identity and access management - IAM](https://auth0.com/app-modernization) modernization strategy of legacy softwares is a concrete first step. IAM is a simple, initial fix that can form the basis for more updates down the line. It is a single solution for organizing and tracking customers, employees, and even business partners who are working with critical data in your system.

IAM often begins with a portal that collects, organizes, and protects customer data at the login stage. This starts with a simple welcome screen on the front end:

![Customer acquisition starts with a secured, basic identity management](https://images.ctfassets.net/23aumh6u8s0i/6skPK5VXzplAOaOIG2mXAW/d4cc7731371771ffcd5576d3fcf99044/transforming-customer-acquisition-starts-with-a-basic-identity-management-strategy)

Behind this screen, the technology tracks customer logins and platform behavior and enriches their profiles with personal details and historical records. This can be information that the insurer manually uploads or automatically pulls from public sources. Some features also include additional options, such as [progressive profiling](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/), to help build customer data over time (e.g., location, age, and gender).

For administrators, certain features allow for a bird's-eye view of all users in a given system, noting growth in users over time, ratio of new to returning users, who is accessing what levels of information at any time– even what device(s) they're using:

![Customer data visualization in Auth0 reports allows for better reporting and analytics](https://images.ctfassets.net/23aumh6u8s0i/5iw0moRjxmuV8bvOeZ9t16/e39d7192b9ca429b294a43df722dd491/organizing-customer-data-in-a-single-location-allows-for-better-reporting-and-analytics)

Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights on customer histories and current behavior. This approach will make your company more efficient at building risk profiles, communicating with customers in a more personalized way (particularly if and when they are in distress and need to make a claim), and understanding your target audience at a granular level.

<include src="TweetQuote" quoteText="Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights."/>

## Outsourcing IAM to the Experts

While you can try to update your IAM system on your own, most insurers don't have the in-house capacity to do so — at least not at the level needed to meet future needs. This would require building a portal that is a one-stop solution for all users — yet is still flexible enough evolve alongside your business. The advantage of outsourcing IAM is having a dedicated team of experts whose entire job, 24/7, is to build and deliver these solutions — as opposed to adding it to a pile of tasks your IT team is currently balancing.

A provider like Auth0 makes sure all of its [features adhere to the highest industry standards](https://auth0.com/security), including LDAP, SAML, OAuth, OpenID, OpenID Connect, and JSON Web Tokens (JWTs). In addition, it is GDPR, EU-US Privacy Shield, and HIPAA compliant.

![Auth0 compliance and certifications](https://images.ctfassets.net/23aumh6u8s0i/35nsnoblygw4XlOUwuocQ6/c02f2b95ba00c2410da392fe049e68c4/auth0-adheres-to-the-highest-industry-standards)

[Source](https://auth0.com/security">Auth0 Security)

This eliminates the need for your team to do additional research to ensure any changes are up to code in your geographic area or industry.

Top-notch identity and access management providers like Auth0 will offer even more tools, like 2FA options, to help ease the customer experience. These features can provide a clear measure of safety that customers will immediately appreciate. Each step along the way allows your team to move further away from lagging competitors by gaining user trust, invigorating your brand, and creating more-efficient internal processes.

## Be an Early Adopter

If you're an insurer, now is the time to make bold changes to your current strategy. The early digital adopters in the industry will gain sharper insights and win and retain more customers.

No teams will be able to hide from change. With new products constantly coming to market, the industries in which insurance teams operate are themselves being revolutionized. Taking the first step to develop and implement a tight IAM system will open the door for full digital change.

<include src="asides/AboutAuth0" />


How the Right IAM Tools Will Help Insurance Teams Make the Shift to Digital

kerry-ok

Kerry is a marketer that loves to partner with the sales organization. As our SVP for Marketing, she is focused on sharing the Auth0 narrative across the globe. Before Auth0, Kerry spent many years working in B2B Tech at Skytap and F5 Networks. She spends her spare time with her family, dog, working in the yard, and enjoying fantasy football.

Chief Marketing Officer

Kerry Ok

Watch this recorded webinar with Garrett Bekker, principal analyst at 451 Research, where he discusses the current state of the IAM industry and the benefits of Universal Identity Management



Recently 451 Research’s Principal Analyst Garrett Bekker and Auth0 CMO Lewis Carpenter sat down to discuss solutions to the fragmented identity and access management marketplace. A variety of solutions aim at solving authentication and authorization, but each tends to focus squarely on a single audience, whether it’s consumers (B2C), business partners (B2B), employees (B2E), or IoT devices. This siloed approach makes the process both confusing and costly for those needing identity across the entire organization and beyond.

Fortunately, enterprises are realizing that a universal approach to identity is saving money, time, and most importantly, giving developers the freedom they need to focus on product innovation rather than security. Today’s marketplace demands a more adaptable solution that can handle the rigors of identity, and anticipate the needs of the future.

In this [recorded webinar](https://auth0.com/resources/webinars/need-for-universal-identity-management-webinar), you’ll learn Bekker’s take on the current state of the IAM industry and its evolution, where he believes it needs to go, as well as gain an overview of Auth0’s universal approach to identity.

<include src="asides/AboutAuth0" />


Webinar: The Need for Universal Identity Management with 451 Research

Our IAM Platform Noted as an Innovative Defense Against Rising Tide of Cybercrime


We believe that fighting cybercrime can begin with your IAM solution.

Looks like Cyber Defense Magazine agrees.

<p align="center">
<img src="https://images.ctfassets.net/23aumh6u8s0i/63ziNMNUXpt5DsNRF5MetE/5c72a79756dd2e7e6b0c74971112017d/winner-logo.png"
  alt="Auth0 Wins InfoSec 2018 Editor's Choice Award">
</p>

Today they announced the winners of their [2018 InfoSec Awards](http://www.cyberdefensemagazine.com/infosec-awards-2018-winners/), naming Auth0 as “Editor’s Choice” for Identity and Access Management. Reaching a growing audience of more than 1.2+ million, Cyber Defense is considered a premier source of IT Security Information.

“With Cybercrime continuing to gain momentum, surpassing global drug crime last year and reaching over $600B in theft and damages, we are proud to see Auth0 as an award-winning innovator, offering a new approach to defeat these criminals,” said Pierlugi Paganini, Editor-in-Chief, Cyber Defense Magazine.

Nearly 3,000 companies globally competed for InfoSec recognition in categories ranging from _Advanced Persistent Threat to Wireless, Mobile, or Portable Device security_. To narrow the selection to just 200 winners, Cyber Defense looked for innovation, as well as ability and drive to help customers “get ahead of the next data breach.”

_“Auth0 takes security and identity and access management seriously,”_ said Auth0 CISO Joan Pepin. _“In this evolving cyber crime environment, we will continue to keep our focus on innovating to address the latest attacks. Our main concern is producing secure, high-quality products for our customers and their customers.”_

You can find more cutting-edge knowledge, real-world stories and awards on the best ideas, products, and services in the information technology industry, from Cyber Defense’s [free online magazine](http://www.cyberdefensemagazine.com/) or pick up a limited print edition exclusively for the RSA conferences and paid subscribers.

If you’d like to know more about how Auth0 can help safeguard you and your customers with our secure Identity-as-a-Service platform, please reach out to [sales@auth0.com](mailto:sales@auth0.com).


Auth0 Wins InfoSec 2018 Editor’s Choice Award

The risks of legacy authentication and why you should migrate to IAM



Many businesses, especially those that appeared online in the 1990s, invested large amounts of time and money deploying complex identity authorization systems across their business.

A large number of these systems have web access management, or WAM, as their central design metaphor. At one point, WAM was one of the most common ways for large companies to handle identification and resource access inside their businesses.

As time passed, however, these kinds of systems have grown increasingly expensive to maintain, and most are unprepared for the kind of threats and issues that businesses need to worry about today. In other words, legacy WAM solutions leave your business exposed.

<include src="TweetQuote" quoteText="Web access management systems are expensive to maintain and unprepared for the threats of today."/>

## What Is Web Access Management?

Web access management systems are focused on providing security to web-based tools and applications, and they focus on two main identity operations:

* **Authentication**: Ensuring a given user is who they claim to be
* **Authorization**: Ensuring a given user has permission to access a particular web page/area of a web product

First appearing in the 1990s, most WAM products also permitted the use of limited single sign on (SSO)—allowing users to sign in with their credentials on one domain and then use those same credentials to access data on other domains without signing in a second time.

WAM products were generally deployed using one centralized authentication server and as many individual agents as necessary to cover all of a corporation's web servers.

![Web access management](https://images.ctfassets.net/23aumh6u8s0i/4viWMdhEKfHNvATKktZeo6/67741ffba4aff26a6821f85dd6229c18/web-access-management)

In this traditional on-premises setup, requests for access went from users to the agents on individual servers, each of which would call back to an external server to either approve or deny access.

Web access management systems could also be set up using proxy servers (in which all requests would flow through a single proxy server) or tokens (in which users use individual tokens to gain access to the resources they need).

![Proxy server request flow](https://images.ctfassets.net/23aumh6u8s0i/5qY4OYbXcSqgrmxp9k2inR/4fc16ecef828aea7cdfe6649d6d8540a/proxy-server-request-flow)

_How a proxy server works. Requests flow from servers within the library (network) to a proxy server on that local network, and finally out to the external internet._

All of these types of deployments were complicated, expensive (and even more expensive to maintain) and rooted tightly in an “on-premises” model—where the perimeter of your network is limited by the perimeter of your building.

Today, most organizations are moving on and migrating to more integrated identity management (IdM) and identity and access management (IAM) solutions.

## What Is Identity Management (IdM)?

Identity management (IdM) is an umbrella term for all  of the core logic around identity in a corporate environment.That means:

* **Provisioning**: Assigning identities to users
* **Account management**: Maintaining those identities
* **Identity governance**: Assigning them to groups and roles and adjusting permissions as needed

IdM is often used interchangeably with IAM, or identity and access management. IAM, however, is most often used to refer not just to identification but to the whole suite of practices that a corporation needs to manage their users and data, including:

* **Authentication**: Ensuring that a given user is the user they identify as
* **Authorization**: Ensuring the given user has the proper permissions to access a certain piece of data
* **Identity federation**: Ensuring users can use the same identification data to access resources on related domains

In other words, [IAM](https://auth0.com/learn/cloud-identity-access-management/) is the entire set of practices around identity that an organization needs to allow “the right individuals to access the right resources at the right times for the right reasons.”

## The Difference Between Web Access Management and Identity Management

The primary difference between legacy web access management and more modern identity and access management is the comprehensiveness and flexibility of the solutions they offer.

Web access management systems don't generate user identities, provision them or maintain those identities over time. They rely on an identity provider—an IdP—to do that.

![Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/64i4SsBi0aDhSWZzvjmlOZ/daf5e5b93ef9b80af42355f62f170563/auth0-dashboard)

_The Auth0 web management dashboard._

At the same time, because their standards are often a few years behind, legacy WAM providers generally don't allow for the use of technologies like Google Authenticator, multifactor authentication, and Touch ID. And that's just the tip of the iceberg—other shortcomings of WAM solutions include:

* **Slowed development time**: Maintaining interoperability between your IdP and WAM—and maintaining your network architecture requirements more generally—means you'll be slower to push out new applications, both internally and for your customers.
* **Security vulnerabilities**: Because of the maintenance needs of legacy WAM setups, and their general inflexibility to new technologies, they can leave both you and your customers vulnerable to security breaches.
* **Customer engagement**: Modern marketing and analytics tools that can help you leverage customer data in powerful ways to retain and acquire new revenue require modern, integrated identity solutions.

An IAM like Auth0, on the other hand, can serve as an IdP or identity provider (although you can use your own IdP as well, of course), an identity manager (for provisioning/maintaining user identities) and an access manager (for your native, mobile or web applications).

It can connect to a wide variety of social and enterprise identity providers and APIs and applications—and provide single sign on, granular user management, extensibility with JavaScript and the most up-to-date security protocols.

![IAM in the cloud](https://images.ctfassets.net/23aumh6u8s0i/3gOKNMTjm9Z8HhVWMOuk0D/759807fea82ab299abe4d56b83976ec4/iam-in-the-cloud)

The biggest reason why IAM is surpassing the role of WAM in the modern day is the cloud. The traditional on-premises identity management that many enterprises have used for decades served its purpose. Today, however, more and more of the activity in the workplace is not literally in the workplace. It's in the coffee shop, or at a co-working space, or at home, or on the road—and no matter where your employees are, they will most likely need to access some kind of privileged resources every day.

<include src="TweetQuote" quoteText="Identity management is surpassing the role of web access management because of the cloud."/>

The cloud makes identities more complex because it removes the on-prem notion of “perimeter security.” You can no longer protect your company's network by just securing your four walls—your notion of security must extend to all the BYOD devices and public wireless networks that your employees are using to do their work.

## Identity Management in the Cloud

Legacy authentication tools sold themselves to their customers with the promise of airtight, long-term security. But the world those authentication tools must live in has changed.

Auth0 is [SOC 2 Type II certified](https://auth0.com/why-auth0) and offers HIPAA BAA agreements to healthcare companies that must comply with HIPAA regulations as part of their business. Auth0 also conforms to the OpenID Connect protocol and the new EU-U.S. Privacy Shield Framework for data privacy.

Whether you're migrating from a WAM provider, looking to extend your current system of [enterprise federation](https://auth0.com/learn/identity-management-matters-finance-2/), or just looking to learn more about what identity and access management looks like today, [read more about us here](https://auth0.com/learn/).


The Difference Between Web Access Management and Identity Management

When your data isn't organized, you lose your competitive advantage as an organization


Imagine your customer support (CS) team receives an angry complaint from a particular user, R. Michaels. R. Michaels was charged for your company’s service although he was sure he canceled it. He says he's going to file a chargeback with the credit card company, at additional cost to your firm — and complain on Twitter.

Meanwhile, your growth team is preparing an email to a segment of its most active and engaged users, of which one is “Ronald Michaels.” The email has the cheeky subject line, “How's our favorite customer doing this morning!?”

Unfortunately, the email meant for Ronald Michaels—thanks to a data integration error—goes instead to R. Michaels (angry CS case).

Since your CS team still hasn't gotten back to R. Michaels, this sets him off even more and leaves your CS team frustrated that they've been put into an even worse position with the customer. R. Michaels goes ahead and publishefs his scathing online review of your team's incompetence.

<include src="TweetQuote" quoteText="With proper data management and integration, you don't need to worry about mixed messages."/>

With proper data management and integration, you don't need to worry about such mixed messages. But the true benefits of strong data integration go far beyond avoiding embarrassing situations—used right, a strong data integration plan can be the foundation of better customer engagement and higher revenues for your business.

## What is Data Integration?

Data integration is the process of combining information from separate databases into a usable form for sharper analysis. When you have a strong data integration plan, you can get a [true 360 view](https://auth0.com/blog/360-view-of-customer-by-managing-identity/) on your customers without having to pay an expensive outside agency or rebuild all of your infrastructure from scratch. That's not all, however—a strong data integration plan can also help you get users engaged with your product faster.

Imagine you're a young fintech company rolling out a big new feature update on your advisory platform. You're particularly interested in how your female millennial customers use it, so you email every user enrolled on your platform as a woman, A/B testing your emails to see which combination of value proposition and headline get the most click-throughs. Once that test is done, you analyze the user response, segmenting by social channel and user activity types:

* Did your Facebook fans or Twitter followers use your new features more often?
* Were users who are more active on your help forum more likely to share the news of the new features with their friends, or less?
* What about users who submit more or less help tickets?

Every team at your company uses this data to understand something about your user base:

* Finance: which user cohorts are the most valuable to pursue in the future?
* Growth: which kinds of future experiments could be most powerful?
* Marketing: which future promotional campaigns could be most effective?
* Customer Service: how to create better documentation for new users.

A full picture of a single user includes data from her Facebook likes, Twitter mentions, Instagram posts, along with other pieces of her life the Web has captured, including college or university major, graduation date, shopping history, and more.

It also includes every action they take on your app, and when; how long
they've been using it; and/or how long they've been churned for. It includes every email they've received, and whether they've opened them or clicked through or not.

Each of these pieces of data lives in a different format—once you can bring them all together, however, you unlock a world of huge possibilities.

## Why Data Integration Is Critical

As both examples illustrate, a data integration strategy is key to deeply understanding your user base, along with avoiding miscommunication and other costly errors. With the right tools in place, a myriad of new opportunities will open for your organization.

<include src="TweetQuote" quoteText="A data integration strategy is key to deeply understanding your user base, along with avoiding miscommunication and other costly errors."/>

You can:

### Personalize your experience

A data integration plan, working alongside a tool, such as social login, can have enormous benefits. While many see social login as just a simpler method for logging in, the real power of this approach lies in the data, which social login pulls at each step of the process to tailor the experience to the individual user.

<p>
<img alt="Personalize your experience" src="https://images.ctfassets.net/23aumh6u8s0i/5Acu0OjZF9a18zijtnbRyP/1fe70cf82e9dc972b351fd9c7b37dcfb/messenger-and-chat-bot" style="width: 500px; display:block; margin: auto;" />
</p>  

A well-functioning social login process can help improve customer conversion rates, rapidly move users to activation, and drive down any churn to help re-engage and retain existing users. The ability to expand and enhance the quality of your user base is critical to sustainable growth and building your brand.

### Smooth any onboarding friction

Users don't feel like making yet another account with yet another password. You need sign-up that reduces friction and helps people get directly to your product.

<p>
<img alt="Smooth any onboarding friction" src="https://images.ctfassets.net/23aumh6u8s0i/6RHgVvj7xNihIN2yzgyNyj/4034e9407c8a9e65647554530ba47eba/what-is-social-login" style="width: 200px; display:block; margin: auto;" />
</p>  

Social login has the ability to boost your conversion by up to [20%](https://www.quora.com/What-impact-does-social-login-have-on-conversion-rates). With [Auth0](https://auth0.com/docs/identityproviders), you can pull data from someone's social profile directly into their user profile. This bypasses people filling in arduous questions about their location and birthday, for example. A strong set of data integration tools is essential to create this transition.

### Increase internal data security

Data integration ensures that the information your organization collects is accessible in digestible forms to the right people. Yet do thousands of company employees need access to a select batch of sensitive files? If your identity and access management (IAM) processes are poorly controlled, can you prove that your company data is not at risk?

<p>
<img alt="Increase internal data security" src="https://images.ctfassets.net/23aumh6u8s0i/4fDg1ZbuaJA2akaGBwOhYL/4cb0af9e46c3a489a1365aaf7302e0d9/data-security-in-the-information-age" style="width: 700px; display:block; margin: auto;" />
</p>  

The right data integration strategy will be built on IAM tools, such as those belonging to [Auth0](https://auth0.com/learn/cloud-identity-access-management/). With these, you can authenticate, authorize, and track users of your data at all times, and set [rules](https://auth0.com/docs/rules/current) to comply with your usage policies. For example, you can create rules that define specific times, locations, and devices your users may log in.

## Tools For Data Integration

The data integration process requires standardizing multiple forms of information. This often breaks down into:

* Extracting the data: pulling it from its source system and converting it into a single, consolidated data warehouse format.
* Transforming it. This can involve cleaning (e.g., mapping NULL to 0), filtering, splitting columns, and/or applying business rules to calculate new dimensions.
* Loading transformed data into a  repository for analysis.

The below are a sample of popular tools for integration (although by no means an exhaustive list).

### Segment

[Segment](https://segment.com/) is a single platform, which quickly collects, stores, and routes user data to hundreds of tools with a simple click. It can be critical for all segments, which rely on this data, including analytics, marketing automation, email, user testing, error reporting, and support.

![Segment Flow](https://images.ctfassets.net/23aumh6u8s0i/2AtqnBruaeY7xroq5ykjYS/360ed268431bff8649e305d6b79079c8/segment-auth0-flow)

With Segment, engineers can eliminate time spent installing and maintaining analytics tools, marketers are able to quickly test campaigns, and BI teams have the capacity to export raw data into their internal systems and databases.

### mParticle

As with Segment, [mParticle](https://www.mparticle.com/) collects data from a range of inputs, such as the Web, mobile apps, and feeds from external SaaS providers, and forwards it to output services for audience targeting and push notifications, attributions, storage, and further analytics.

![mParticle](https://images.ctfassets.net/23aumh6u8s0i/2lchvs0bqj1qGtBeR3ZolS/b9c7ca905271e35eeb708f1e6045c28d/mparticle)

mParticle focuses on two types of inputs: events (how users interact with an app) and audiences (a focus on a specific segment of app users, such as women who have invested more than $10,000 on your app). mParticle’s creation of Connections between these inputs and outputs facilitates the enrichment and transformation of data prior to being put to use.

### Clearbit

[Clearbit](https://clearbit.com/) has provided its services to a range of tech companies, such as Asana, Braintree, Slack, Stripe, Zendesk, and more. It offers its customers nearly a dozen APIs to mine publicly available data sources  for information on individuals and companies.

![Clearbit](https://images.ctfassets.net/23aumh6u8s0i/1dSy9DGvaBJRy8D1nKjQ4b/c48562ed0d1768d221a412e73da33da9/clearbit)

Clearbit allows developers to incorporate this data from a variety of sources into their organization’s apps and build customized tools. In addition, marketing teams are able to easily integrate these points into a fuller picture of their target audiences.

## To Secure and Hone Your Analysis, Employ An Excellent Data Integration Plan

Data management and integration can both help ensure regulatory compliance if you hold sensitive user data and support your teams in developing sharper insights. In turn, this can allow more targeted marketing and other forms of direct engagement with your community, leading to stronger sales and better overall growth.


3 Reasons Your Data Integration Plan is Important

avatar

Jared has worked alongside founding teams to define and deliver products which are critical to Fortune 500 enterprises and small businesses, enjoyed by consumers, and depended on by developers. Along the way, he's helped grow multiple companies from a handful of people to hundreds of employees, financial stability, and successful acquisitions. Additionally, Jared is an active contributor to open source software. He is the lead developer of Passport.js, the popular authentication framework for Node.js. Downloaded over 2 million times per month, it powers authentication for innumerable applications on the Internet. He has a portfolio of over 300 repositories freely available on GitHub.

Former Auth0 Employee

Jared Hanson

From basic website authentication to implementing an OpenID Connect server and API authentication: This article covers 3 IAM examples to support your Digital Transformation.



**TL;DR:** We recently [hosted a webinar](https://resources.auth0.com/webinars/3-iam-examples/) that covered modern identity management and what it takes to implement both Authentication and Authorization to support your Digital Transformation. In this article, we'll cover these implementations ranging from basic authentication, to an OpenID Connect server, and API authentication.


## Introduction
Identity and Access Management (IAM) encompasses the security protocols and processes that allow the correct users to access the correct content, at the correct times.  Cloud-based IAM providers, such as _Auth0_, have created simpler and more intuitive ways of managing user access, and they form an important part of **digital transformations.**

<include src="TweetQuote" quoteText="Identity and Access Management (IAM) is the security and process that allows the correct users to access the correct content, at the correct times."/>

Digital transformation, for those unaware, is not just a buzzword. It encapsulates the process of heavily utilizing modern, digital technologies to radically change businesses.

> Look beyond the hype and you'll find a daunting task at the heart of digital transformation. Rather than focusing on any single IT project, digital transformation describes a series of projects that, together, change every facet of an organization, from back office operations to customer interactions, often with the end goal of making these different processes intrinsically linked.

[http://www.itpro.co.uk/strategy/28047/what-is-digital-transformation](http://www.itpro.co.uk/strategy/28047/what-is-digital-transformation)

As we go through this article, we will cover three _IAM_ use cases. Firstly, we will cover implementing authentication on a basic website. This is the situation most people will find themselves in and the most common use case of the three. Once we've covered basic website authentication, we will move onto standard federated logins.

The second scenario we will cover is _**Enterprise SSO**_. We shall create a fake example company named _Acme,_ whos enterprise customers demand a way of logging into Acme's various services without having to remember a range of username and passwords. By using OpenID Connect, we will show how they can allow their customers' employees to log in with corporate credentials.

Finally, we will cover API integration. When we want to allow our customers to integrate our service into their line-of-business applications in custom ways.


## A Basic Website
Something we're all familiar with is the basic user registration and login that we find on our favorite websites. To access various areas and features of most websites, we usually have to create an account with them. From a high level, all this consists of is a database containing our usernames/email addresses and a complex hash of our passwords (hopefully).  Throughout this article, we'll use an example data model in which crucially, the core Users table will never change the schema, only the data references will change. The basic data model looks like this:

![Basic Data Model](https://images.ctfassets.net/23aumh6u8s0i/74wMh29yR35x1gyeASUrmv/9e037c843a6ff03b59be3420a7945677/basic-data-model)

Our sample data model is that of a simple project management tool, in which Users own Projects. Very basic. Now, what we need is a way for our users to register their details for our application.

![Basic Registration](https://images.ctfassets.net/23aumh6u8s0i/3L7FmaYEjSOGrUdOexyRdw/9e8c66dd6e21383e06694f5db8490da6/basic-registration)

As you can see in the image, our app now contains a standard sign up for new users to register for our service. From a back end perspective, the form uses a `POST` action to submit the form data to our `/signup` resource. Our back end then writes this data to our chosen database and forwards the user onto the specified route upon successful completion. Once we have a user signup implemented, a user login is the next thing we need to address. The basic login flow for our simple web app looks like this:

![Basic Login](https://images.ctfassets.net/23aumh6u8s0i/1Ku7YSRGdgbf5xOoEpUnxQ/55c563b1aaa309b085de6fcfa8a72b6f/basic-login)

In our login flow, users submit their email address and password, which issues a `POST` request to our `/login` resource. Our application back end takes the credentials supplied, issues a database lookup and ensures the details are correct. If so, our app will issue a HTTP forward request onto the specified resource, containing a Session Cookie.

In the image above, you can see that the Session Cookie is set as a HTTP Header, and is actually the most important factor in this flow. The Cookie will contain tokenized information about our users perhaps including metadata such as the user's name and avatar, so as to reduce database hits going through our web app. Besides containing the user's metadata, the Session Cookie is (more importantly) also the authorization credential for all subsequent requests as the user browses our application.

With this implemented, our application now has a basic user authentication system set up. Being basic, there are many features that we haven't addressed here, but that would really need implementing. Password hashing, password complexity verification, password reset functionality, and multi-factor authentication to name a few. Luckily, by using a system such as [Auth0's Hosted Login](https://auth0.com/docs/hosted-pages/login), we save the worry of having to implement these, as they come as standard. Out of the box, Auth0 offer the features mentioned above plus many more. You can have a fully functional user management system setup in minutes.


## Single Sign On (SSO) for Enterprise
If you've used services such as Amazon Web Services, Slack, GitHub or Salesforce, you will notice that they all have a Single Sign On (SSO) implementation so that users can access those services with their corporate credentials. As we add SSO federated capabilities into our sample application, we do have one constraint in that (as mentioned above), we do not want to change the data table schema.

![SSO Data Model](https://images.ctfassets.net/23aumh6u8s0i/6M9ZrX0pYtMQlLySKJ7j0r/fd0e804720e293fda0d1c9c2f1026740/sso-data-model)

Our `Users` and `Projects` tables do not change, but the relationships evolve to include our external identity providers.

For our Federated SSO implementation, we're going to implement an _Identifier-first_ login prompt. Our application will only ask for an email address for the user:

![SSO Login Prompt](https://images.ctfassets.net/23aumh6u8s0i/5uaqLWmRI3n3Z0TKysWTcg/dfb0e87190ced85da967c708cb216f31/sso-login-prompt)

The point of this is to look up the SSO identity provider associated with this email address, which in this case is **_cotoso.com_**, so the user will be redirected there to log in.

![SSO Flow](https://images.ctfassets.net/23aumh6u8s0i/4ovSoo6JhxjhQnaDBYNRcv/b1a5209e2608147b29e1cfd70fe7b5cc/sso-flow)

As shown in the image above:  once the user _(sally@contoso.com)_ enters her email address, our application determines that _contoso.com_ is our Identity Provider and redirects her there. Sally then logs into her _contoso.com_ corporate account, and _contoso.com_ verifies it. She is then redirected back to our application with access granted.

As part of this OpenID Connect authentication response, the `code` returned in the OpenID Connect Auth Response above is exchanged for an `ID Token`. The `ID Token` is what conveys the identity information from _contoso.com_ to our application, and looks like this:

``` json
{
  "iss": "https://id.contoso.com",
  "sub": "2482899761001",
  "name": "Sally",
  "email": "sally@contoso.com"
}
```

As with all ID Tokens, there is an _Issuer_ and an _Identifier_.  The Issuer being `https://id.contoso.com`, and the _Identifier_ being the subject `"sub": "2482899761001"`. In the auth flow above, our application (acme.com) will now look at this ID Token, identify Sally, and forward her onto our Dashboard, setting a Session Cookie for future requests.

From a database point-of-view, this SSO flow will look like this:

![SSO Database Flow](https://images.ctfassets.net/23aumh6u8s0i/3l5n9ubTlVC3BL9zbbmZJe/7d8aeb7f309d3477d96a3313d9b47748/sso-database-flow)

Firstly, our application will perform a lookup for the identity provider _contoso.com_, and redirect Sally to that login. Once Sally has logged in on _contoso.com_ and has been redirected back to our application, one of two things will happen. If Sally has never registered with our application before, a User record will be created for her, with the information returned from _contoso.com_. This would replace the sign up step we implemented in the basic example above. Our application will then associate the external identity with the new user record for find operations on subsequent logins.

![SSO Final Step](https://images.ctfassets.net/23aumh6u8s0i/20d076SSRPax813EDFIfYO/3f23fac0b59109b8a9d04c8a68faeb46/sso-final-step)

Similar to our earlier basic example, upon successful login, a _Session Cookie_ is set to portray the information required for subsequent requests.

With the above, we now have Single Sign On implemented on our acme.com sample application. Worth noting here is that in this SSO implementation, we have chosen an identifier-first login prompt with no option for a password. In reality, we would need to implement a password option for users that have existing non-federated accounts. Beside this, we should also implement a SAML integration, and support for account linking an unlinking.

By choosing to use an IDaaS provider like _Auth0_, we can get all of these features, plus many more straight out of the box.  Using [Auth0 for SSO](https://auth0.com/single-sign-on) allows us configuration of any enterprise connection, including Active Directory, LDAP, ADFS, SAML, and more with just a few lines of code.


## API Authorization
For the final implementation example of this article, we're going to look at API Authorization. We need to implement API auth so that our customers can integrate our service into their applications in ways not offered as standard, and to allow them deeper integrations. Once again, let's take a look at our data model, now including API auth:

![API Auth Model](https://images.ctfassets.net/23aumh6u8s0i/4NRyLQsRvkuyFmq64xuNeN/d0b5238abf314ac3f4051da5db971a17/api-auth-model)

Although the model now looks slightly more complex, following our aforementioned constraint; our `Users` and `Projects` schemas have not been changed. The schemas for SSO providers have not changed either. What has changed are the tables on the left, which introduce support for other people getting access to _Acme's_ APIs. If you are familiar with Facebook sign-on or GitHub etc, the terms above are fairly typical. `Clients` are the applications a user may build/use to access APIs and services, `Resource Servers` are the APIs themselves, and the Authorization Grants `(AuthZ Grants)` track the permissions that have been granted between the users and the applications.

For our API Authorization example, we are going to imagine that our sample company (Acme.com) have a customer named _Fabrikam.com,_ who wish to allow their customers to pull a list of their `Projects` from the _Acme_ API to display on their own dashboard.

From a simple button on the _Fabrikam.com_ website, their customers will be redirected through an OAuth2 Authorization request to the _Acme_ website, returning an Auth code on successful submission. Using the OAuth2 auth flow of [Client Credentials Grant](https://auth0.com/docs/api-auth/tutorials/client-credentials), this Auth code will then be swapped for an **Access Token** and used in the web application's _Authorization Header_ using the `Bearer` protocol.

Let's take a look at how the API Auth flow works visually:

![API Auth Login](https://images.ctfassets.net/23aumh6u8s0i/49pbvFGduF9VwuFevWGf66/e5c9bc8dc3632dbb826ff32e02b5cb46/api-auth-login)

As you can see from the image above, the customer of _Fabrikam.com_ clicks on the 'Connect to Acme' button on their Dashboard.  This click then issues a GET request to the `/connect/acme` route, which from the back end initiates an OAuth2 request to the _Acme.com_ server. The _Fabrikam.com_ customer is then prompted to log in using their _Acme_ credentials. On success, the _Acme.com_ server issues the OAuth2 Authorization Response to the `callback_url` specified in the initial request. In a similar manner to the _OpenID Connect_ example above, this response contains a `code` that will be exchanged for an **Access Token:**

![API Auth Login Response](https://images.ctfassets.net/23aumh6u8s0i/36WBGudxJpP0g6U9RaRb32/0dfc5f2e368f90c40054592d672aabcb/api-auth-login-response)

Following the [Client Credentials Grant flow](https://auth0.com/docs/api-auth/tutorials/client-credentials), the _Fabrikam.com_ back end swaps the above code for the Access Token needed for subsequent API requests.  The Access Token returned will have the following appearance:

``` json
access_token = eYJ0eXAi0...

{
  "iss": "https://www.acme.com",
  "aud": "https://api.acme.com/v1/",
  "sub": "501",
  "scp": [ "read:projects" ]
}
```

This _Access Token_ is similar to the _ID Token_ shown in the previous example, but instead of just identifying the user, it is also responsible for allowing _Fabrikam_ to make API calls subsequent to this Authentication event happening. This Token contains _Acme_ as the issuer, the API route to be used, the `subject` referring to the user id of "502", and the request _permissions_ in the `scope`. With the _Access Token_ now available to _Fabrikam.com_, it is used with requests for the customer's `Projects` from the _Acme.com_ API.

![API Auth Authd Reqs](https://images.ctfassets.net/23aumh6u8s0i/59HhtjSyKjTQST9ItgwwoL/8e3d373768fb5cfcb94297f2395ff731/api-auth-authd-reqs)

As the image shows, _Fabrikam_ sends the encoded token in the `Authorization` Header of the request, using the `Bearer` protocol, in all subsequent API requests.  The _Acme.com_ API successfully returns the customer's `Projects` which are listed in the Dashboard, as shown. That brings to a close the OAuth2 Client Credentials grant for API Auth example. However, we can take this a step further still. What if we wanted to combine this API Auth with the Enterprise SSO implementation in our previous example?

There may arise a scenario in which  _Fabrikam.com_ want to integrate with _Acme's_ APIs, but a user at _Acme_ authenticates with corporate credentials for _Contoso.com_ (who is an enterprise customer) as within our previous example. The flow becomes a multi-step process, with the first request coming from _Fabrikam_ to _Acme_, then _Acme_ to _Contoso_, with the responses flowing back in the opposite direction, back to _Fabrikam._. The interesting point of this scenario is that _Acme_ is acting as both an Identity Provider (when providing API authorization), and a Relying Party (when it's consuming identity information). This pattern may sound complex, but it is a very common scenario. Most SaaS companies both provide services, as well as authenticating users from other companies, meaning they have to implement both sides of the protocol (client and provider). The following diagram shows this implementation layout:

![OAuth OpenID Combine](https://images.ctfassets.net/23aumh6u8s0i/6WZAjqTn3OMo2eRyuLgvCS/1d678ed2c67c51061ddb1dfbb8773e90/oauth-openid-combine)

<include src="TweetQuote" quoteText="OAuth 2.0 and OpenID Connect have the same protocols because OpenID Connect is just an extension of OAuth."/>

Happily, as you will have noticed throughout this article, OAuth 2.0 and OpenID Connect have the same protocols, because OpenID Connect is just an extension of OAuth. This saves us a lot of hassle on implementation. At this point, with Authentication becoming a more prominent feature, it might be worth setting up a single, centralized server to handle all of the Auth requests coming through our app _(Acme)_.

If we revisit our data model, we can see that all of the tables in our model, except for the `Projects` table, can be treated as a separate concern, and become our authentication server:

![API Auth Model Pattern](https://images.ctfassets.net/23aumh6u8s0i/6jcNbD9NpTsH1E5Z9JcNtL/fd08c21e843f5af8e3944886aa3047af/api-auth-model-pattern)

We can take advantage of this in our architecture by creating the aforementioned centralized Auth server on a subdomain such as `id.acme.com`, and piping all of our Authorization / Authentication requests through there. The applications authenticating and being granted authorization through this centralized server may be third-party applications, such as _Fabrikam.com_ or _Contoso.com_, but also internal applications such as `app.acme.com`. Setting up this single centralized server is a nice and clean way to solve a lot of Auth challenges, with a single protocol and a single implementation. The architecture for this server could look like the following:

![Centralized Auth Server](https://images.ctfassets.net/23aumh6u8s0i/2hj6ZSI6wVtHmguWHPlEHq/8180c2f0e4abff657db1f05cb9536ecb/centralised-auth-server)

So with this, we have a fully functional OAuth 2.0 server implementation. Whilst this implementation is entirely functional, there are a few extra features not included in this example, that you would want to implement in the real world. One of the biggest is a _Consent Prompt_ ensuring users have the options of granting the application access, such as the following:

![OAuth2.0 Consent Prompt](https://images.ctfassets.net/23aumh6u8s0i/71FwyIRzi8zepAO1e0g4fu/388e0dfbe33ab932a3467b5e7fc3b142/consent-screen)

Besides this, consent and token revocation is also a must-have feature that would need implementing. Lastly, token introspection and JWTs for stateless authorization are both desirable features one would ideally implement.

If you wanted a fully-featured OAuth 2.0 server with all of the functionality mentioned above, it is definitely worth checking out an IDaaS provider to save you all of the implementation hassles. [Auth0](https://auth0.com/docs/protocols/oauth2) offers out of the box, fully featured OAuth 2.0 implementations that take care of all of the architecture above, plus offer more features and functionality; and all implemented without having to build and manage it yourself.



<include src="asides/AboutAuth0" />


3 IAM Examples to Support Digital Transformation

Cut through all the GDPR noise with Auth0's GDPR Assessment Tool that will measure your readiness across 26 specific areas governed by GDPR.



If you're struggling to cut through all the GDPR noise so you can figure out where your organization stands on changes to the EU's personal data regulations, you're not alone. In a recent [UK government survey](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2018-preparations-for-the-new-data-protection-act), less than half of the businesses surveyed were even aware of GDPR and its impending May 25, 2018 deadline, much less GDPR-compliant.

![GDPR - General Data Protection Regulation](https://images.ctfassets.net/23aumh6u8s0i/1TWFcNwmXWjBsj2kZUcYiB/9b7cf20f83478bafa60b8a7f4cfbf73f/gdpr-flag)

<include src="TweetQuote" quoteText="Less than half of recently surveyed UK businesses were even aware of GDPR, much less compliant. Test your readiness with Auth0's GDPR Assessment Tool: https://auth0.com/gdpr-assessment"/>

Launching a new product, managing a digital transformation, or handling day-to-day business is tough enough without the threat of GDPR's massive fines. Even though May is only months away, if you're already doing business in the EU or just have expansion plans, there is still time to moves towards compliance.

While we can't remove all the complexity (or work), Auth0 can help you streamline your identity strategy with a simple, flexible (and fast) solution that can help you meet GDPR compliance—and beat your organizational deadlines.

We've partnered with Cordery Compliance, a bespoke legal compliance company based in the UK, to create a self-serve **[GDPR assessment tool](https://auth0.com/gdpr-assessment/)** that will measure your readiness across 26 specific areas provisioned in GDPR.

<include src="TweetQuote" quoteText="Struggling to hit GDPR’s May 25 deadline? Auth0 can help you streamline your identity strategy with a simple, flexible (and fast) solution that can help you meet GDPR compliance."/>

We'll send you a personalized report, detailing where you're GDPR-ready and where you still have specific areas of need.


Are You GDPR-Ready?

While it's hard to show direct returns on investment from an IAM solution, companies can't risk 2018 without one. Here are the most salient benefits to help you make a business case for an IAM budget.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

No one needs to tell you how important Identity Access Management (IAM) is to your company. You are well aware of the security risks, operational inefficiencies and missed growth opportunities that the business will suffer without a modern IAM solution.

There's only one problem. Budgets are tight and no one wants to add a new line item to the budget that doesn't provide a guaranteed return on investment. The good news is that most IT budgets are increasing in 2018. How can you convince your company that a modern IAM solution is worth the money?

![2018 corporate IT budgets](https://images.ctfassets.net/23aumh6u8s0i/1w0HX9wIMXBulBSkgvO9p3/ccb19436f6514dc9a25536689d18c9a0/2018-it-budgets)

[Source](http://www.zdnet.com/article/infographic-2018-it-budgets-are-up-slightly-spending-focus-is-on-security-hardware-and-cloud/)

You need to have a killer business case that the budget committee can't ignore. It needs to clearly and concisely illustrate how IAM will save the company money and directly impact growth.

Here are three ways to grab management's attention and have them sipping the IAM cool-aid.

## 1. Don't Increase the Security Budget, Reallocate It

Mobile devices and cloud computing have changed the way companies approach security, yet most budget allocations have not evolved to address the new risks associated with these off-premise assets.

The reality is that most companies need to increase their overall security budgets to deal with the current barrage of cyber attacks, but if that is unlikely, you need to adjust the budget to prioritize based on threat.

For example, the average IAM spend currently represents [about 5 percent](https://www.gartner.com/newsroom/id/3836563) of the security budget, yet compromised identity and access is the cause of over [80 percent](https://www.cso.com.au/mediareleases/29642/hacked-passwords-cause-81-of-data-breaches/) of breaches. Year after year, companies invest most of their security budget in network perimeter protections.

Cybercriminals don’t care about the [Fort Knox perimeter](https://auth0.com/blog/how-poor-identity-access-management-equals-security-breaches/) you spend millions on to maintain. They simply go phishing to steal credentials or infiltrate a vulnerable web app outside the firewall. The security strategy must change, and the budgets align with this new reality.

### Major Security Breaches Start with Stolen Credentials

Equifax, Target, Deloitte, and Yahoo are just a few of the huge companies with multi-million dollar security budgets who fell at the hands of compromised usernames and passwords.

Many of these data breaches could have been prevented with a simple [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) protocol from an IAM solution. Instead, hackers caused billions of dollars worth of damage. Unfortunately, 2018 is expected to be even worse.

![Data breaches due to compromised credentials](https://images.ctfassets.net/23aumh6u8s0i/4WAKZGWTrAn9sEKIjoscpr/347e6c3511666a13f4fe7e0ba5860b11/data-breachs-due-to-compromised-denials)

Criminals are becoming more sophisticated in their phishing schemes, even using [artificial intelligence](https://www.csoonline.com/article/3244924/data-protection/2018-cybersecurity-trends-and-predictions.html) and automation to collect intelligence that will get them through any firewall.

IAM companies like Auth0 spend their time staying one step ahead of hackers who target identity and access. From [encryption](https://auth0.com/security) to [password breach detection](https://auth0.com/blog/announcing-password-breach-detection/), IAM solutions offer several layers of protection to keep your logins secure. When your login is secure, your data and customers' information is in a safer place.

### Secure Your Applications Before You're Exposed

Most enterprises have over 700 apps in use that are operating on personal mobile devices all over the world. When you have so many apps with company data outside the traditional security perimeter containing, you are extremely vulnerable to an attack.

IAM is becoming more and more complex as authentication and access to all of these applications must be managed and protected. Companies without a comprehensive IAM solution are failing with an estimated [25 percent](https://www.sans.org/reading-room/whitepapers/application/2016-state-application-security-skills-configurations-components-36917) blaming their apps as the source of breaches. The reason for [95 percent](https://blogs.gartner.com/anton-chuvakin/2015/05/18/highlights-from-verizon-data-breach-report-2015/) of these app attacks is stolen passwords.

![IAM is becoming more and more complex as authentication and access to all of these applications must be managed and protected](https://images.ctfassets.net/23aumh6u8s0i/32lcneRfrCoBVbNtsk8CnO/01ff394135754482b1db75f70e209123/how-enterprise-app-stores-work)

Auth0 offers several approaches to secure your apps without losing the convenience of accessing them on the go. Solutions like [single sign-on](https://auth0.com/learn/how-to-implement-single-sign-on/), [social login](https://auth0.com/learn/social-login/) and [passwordless](https://auth0.com/passwordless) add the necessary security to credentials and allow you to monitor login behaviors to flag suspicious activity.

It is clear that IAM is a critical piece of your company's security strategy. [Juniper Research](https://auth0.com/learn/social-login/) predicts that cybercrime will cost businesses over $2 trillion by 2019. If the past is the best predictor of the future, the majority of those crimes will come from inadequate IAM.

## 2. IAM Creates Efficiencies That Lead to Cost-Savings

IAM solutions are usually thought of as solely a security expense, but the reality is that IAM contributes to other facets of the organization that help drive efficiencies and save money. If you can quantify these cost-savings, you are more likely to secure an IAM budget.

The largest line item on an IT budget is often for utilities, which include things like hardware, help desk, network costs, and maintenance. These costs make up over 60 percent of most[IT spending](https://www.cio.com/article/2439252/budget/how-to-present-your-it-budget.html), and they cause frustration for budget managers because the numbers are huge and it's hard to explain the value.

Anytime you can reduce these dead costs, managers will listen. IAM tools can automate several labor-intensive processes that currently put a strain on IT and drive their utility budgets through the roof.

### Self-Service Access Reduces Help Desk Resources

Imagine you are locked out of your company's analytics application and you forgot your password. If your organization has an updated IAM solution, the process is easy. You reset the password and verify your identity with multi-factor authentication.

If your company does not have the right IAM solution, resetting passwords or verifying a device can be a long and frustrating experience. It usually involves emails and calls to a help desk. IT then has to waste time updating access on their end to get you back into your application. The process is unproductive and incurs unnecessary costs.

![If your company does not have the right IAM solution, resetting passwords or verifying a device can be a long and frustrating experience](https://images.ctfassets.net/23aumh6u8s0i/61BDc9hkyiQNSWITxfulTc/4dedba6f4549f54406728292e30c37b6/auth0-reset-password)

You can do a quick calculation of current help desk costs and determine how many hours were dedicated to helping customers or employees regain access from an interrupted login experience. Even a small drop in the percentage of help desk tickets might create an ROI that pays for the entire IAM investment for the year.

### Automate Certain IT Maintenance Tasks

IT departments are swamped. Some of the work they are doing can be automated, which would not only save the enterprise money on resources but also free your IT team up to focus on innovation and growth initiatives.

For example, IT routinely conducts access reviews to ensure the right employees have access to the right systems and unauthorized people are kept out. Without an IAM tool, IT managers have to do this manually which can take weeks of pulling user extracts, formatting files and going through all the data piece by piece.

![Automate Access Management with Auth0](https://images.ctfassets.net/23aumh6u8s0i/69vWW7XxWjouH6xMqmnHSW/bbc859b5e474bf89741961e590274eca/auth0-identity-access-management)

Auth0 [streamlines this process](https://auth0.com/blog/enhancing-productivity-with-identity-and-access-management/) by centralizing access control of every aspect of user ID including creating and provisioning users, password resets and blocking unauthorized employees. What once took weeks can be done in a few hours.

IT spends a lot of money on utilities that don't help drive growth for the enterprise. Showing your company how an IAM solution can remove a chunk of that budget will be well received.

## 3. Share the Budget with Sales and Marketing

There is an excellent business case to asking sales and marketing to chip in for the IAM solution. Why? IAM can help drive conversions and maintain customer profiles, driving up to [30% efficiencies](https://www.b10v.com/business-case-customer-identity-access-management-ciam/) in sales and marketing.

Successful sales and marketing rely on understanding your customers and delivering an experience that will lead to conversion. IAM solutions like Auth0 can provide customer profile data through [social sign-in](https://auth0.com/blog/customer-data-is-king-four-ways-to-know-your-customers-better/) to help improve targeting and craft [messaging](https://auth0.com/blog/5-killer-email-strategies-for-lifecycle-marketing/) around the customers' interests.

IAM also enhances the user experience by removing the barriers of registration or forgotten login credentials. In fact, when you implement a user-friendly login process, you can increase conversions by [20%](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/).

### IAM Tools Update Your Customer Contacts

Sales teams rely on their CRM to keep track of all their future and past customers. It is the salesperson's digital Rolodex and it is their lifeblood.

Unfortunately, every year about 30% of the customer data becomes outdated because people move around and change their info. When this happens year after year, your CRM becomes a big wasteland of stale information that makes tracking customer contacts a full-time job.

![Identity Access Management updates CRM data](https://images.ctfassets.net/23aumh6u8s0i/5qmLjDyVn57kabQqDMTx9f/4b8b879fced7cdfcf0610e4816df1541/auth0-identity-access-management-2)

An IAM system can help solve this problem by letting your customers manage their own identities. When a customer changes a job or a phone number, they will update their information in their single sign-on account, which is tied to your CRM system. This will ensure that you can keep track of your customers and not risk losing future sales because of bad data.

### Personalized Marketing Drives Sales

Every marketer knows the power of personalizing the customer experience. In fact, personalization affects all areas of marketing, reducing acquisition costs by as much as [50 percent](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/marketings-holy-grail-digital-personalization-at-scale) and increasing sales by up to [15 percent](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/marketings-holy-grail-digital-personalization-at-scale).

IAM tools help facilitate personalized marketing by aggregating your customer's data across various marketing channels to create a [single view](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) of your customer. This is achieved through [single sign-on](https://auth0.com/docs/sso/current), where the user logs into one account to gain access to their other application.

![Personalized website content  makes customers happy!](https://images.ctfassets.net/23aumh6u8s0i/2VNY8Lqz8SygPs9MUnjlBX/70f3e2d63a0606b7e04606b4bbaeb221/personalization-stats-updated)

[Source](http://blog.whereoware.com/wp-content/uploads/2017/06/Personalization-Stats-Updated-1024x382.png)

In addition to aggregated data, Auth0 enables [social login](https://auth0.com/learn/social-login/), where users sign into their apps through a social account like Facebook or Twitter. When your customers use social login, you are able to learn more about their interests and target based on location or special events like a birthday.

Personalization requires customer data that goes beyond demographics. When an IAM solution delivers the deeper profile data and helps keep your CRM system updated, sales and marketing will realize they need an IAM tool for more than security. If you can't find the money in the IT budget, you have a valid case for asking sales and marketing for help.

## IAM Affects the Entire Enterprise

As a security tool, IAM has an extremely compelling business case for an adequate budget. With $2 Trillion on the line from cyber attacks, IAM becomes a no-brainer.

But IAM is more than a security solution, it enhances productivity and improves how users interact with your company. These use cases have tangible benefits that can be quantified. Whether it is by saving costs within IT or driving revenue by supporting sales and marketing, IAM does have a powerful ROI story.


3 Ways to Get an IAM Budget in 2018

Give your employees flexibility without compromising security



Workers want mobility and flexibility and you want to give it to them. Young people, especially, have heard the siren song of flex time, and they've [made it a priority](https://www.forbes.com/sites/katetaylor/2013/08/23/why-millennials-are-ending-the-9-to-5/#1c17d54f715d) in their job search.

Even traditional workplaces are being liberated by technology to allow work to be done outside of the office — you no longer have to be a startup to have employees asking for [remote opportunities](http://money.cnn.com/2017/06/21/pf/jobs/working-from-home/index.html), or the option to stay at home when the mood strikes.

So yes, you want to keep workers happy and be attractive to the best and the brightest of the new generation in the workforce. But you also need security, which gets harder the more your employees move around and portable devices they use. Public wifi? Work computers that leave the office? Workers traveling with a personal *and* work cell phone — it's a security nightmare.

<include src="TweetQuote" quoteText="Millenials are ending the 9am to 5pm but this don't need to be a security issue."/>

Here's how you can give employees what they want *and* stay secure to the highest available standards.

## Outsource your security management

One of the most important things you can do to enable good security for your mobile workforce is [outsource your security](https://auth0.com/blog/5-reasons-your-company-needs-identity-and-access-management/). Your enterprise company has enough on its plate without adding a robust in-house identity management system to the mix.

Let's say you did set aside engineers to work on your IAM (Identity and Access Management), months to complete the project, and the money it takes to get your security fully functional. You'd still have to:

* Stay up to date on the latest security protocol, and make changes as necessary to continually keep your IAM at the cutting edge.
* Monitor and support your security system 24/7 to ensure that there's always a responder in the event of an emergency.
* Scale immediately to encompass the needs and numbers of your entire organization, and be able to keep pace with scaling up or down as your company needs.
* Add features as new identity management is developed and allows for easier use of biotech, etc.
* Maintain the entire system to make sure that all of it is always functioning optimally.

It's not easy to build and support your own identity management system when you *need* the best possible security but aren't service built to make it. That's why sophisticated IAM systems like [Auth0](https://auth0.com) exist. They can immediately scale to the enterprise. They'll have the features you need to keep your mobile workforce secure.

And they're backed up by experts who spend each and every day thinking about nothing else but how to keep you safe.

## Automate log out

Especially when employees are using mobile devices for work, triggering an automatic log out after a certain period of inactivity for any of your work systems is a must. If a work tablet gets left in a coffee shop or in a hotel on a work trip, there's an automatic layer of protection when no accounts have active sessions on a device. You can set up these [automated logouts](https://auth0.com/docs/logout) with your IAM of choice to kick employees out of your systems.

You should also force employees to use some form of authentication every time they want to access sensitive information. Employees might be able to log into their email and project tools and stay logged in without a problem. But even if they're still logged into your system, they shouldn't be able to access sensitive documents without logging in every time:

![Employees should log in every time](https://images.ctfassets.net/23aumh6u8s0i/hGneWXzQs28T6OostR615/f1b84a8937c73b9508e33ef5533efc21/iam-mobile)

*Depending on the system function, you may want your users to be able to access it without logging in anew every time. For others, you'll want to verify their identity each and every time.*

This complicates your identity management setup. Instead of just making sure the whole system is secure, you're now trying to enact different protocols for different items, which takes more time and energy to deploy. Still, you want to structure your internal systems to protect what is most sensitive without roadblocking employees who don't want to log in *every single time* they do anything at work.

Identity management can help you add this protective layering automatically, without the hassle. This will help your employees get work done wherever they are, but put up your best defenses for your most sensitive data.

## Partition users to protect data

When you're an enterprise company with employees at all levels working in the same system, it's important that you can identify each individual and their unique permissions. Interns don't need to see everything that your CFO does, and it's likely that you're going to need to partition users regardless of how mobile your employees are.

Here's an example of how much company sales and marketing information various members of a sales department might need, with Head of Sales having access to everything, and the rest of sales working off of slightly less:

![How much information different members of save have access to.](https://images.ctfassets.net/23aumh6u8s0i/778ZbWPqTFnY4YOGiqpvmH/4be6b733e3e3fbb9b187947344fe72ad/information-access-per-role)

It may not always be the case that the information that people don't need access to for their job is highly sensitive. Still, if you give everyone the same permissions as Head of Sales, you are needlessly putting that extra information at risk.

This is especially important when employees are taking work devices with them to get work done in their own space and time. Restricting access to tools and systems means you're also protecting yourself in case one person has their account compromised — instead of getting carte blanche access to everything, you're keeping at least some of your information safe.

Auth0's system is perfectly poised to help enact this partitioning because it keeps each user stored with a [unique profile](https://auth0.com/docs/user-profile). Each user holds unique attributes, so different users can be treated in different ways, which boosts your ability to restrict access through your IAM.

## Multifactor Authentication

The world is a-buzz with companies trying to get their users to enable [multifactor authentication](https://auth0.com/docs/multifactor-authentication) (MFA), and with good reason. MFA can help you safeguard your accounts from all sorts of threats by requiring that users submit multiple forms of proof that they are who they say they are when they try to login. You'll often see MFA implemented with a code that's sent to your mobile phone that you must enter alongside your username and password, for example.

This means that even if a computer is stolen, or someone gets the password for an account — two things that become much more likely with a workforce on the move — data remains secure because there's another layer of security added.

If you're trying to implement MFA yourself, you're tacking on extra time, energy and upkeep; robust IAM systems will have multiple forms of MFA ready for you so you can choose what works best for your business. Auth0, for example, offers MFA with SMS, one-time password services and push notification through our Guardian app, [among others](https://auth0.com/docs/multifactor-authentication).

You can also use MFA to add that extra layer of security where you want it, but not for everything. The Guardian app allows you to trigger MFA for some but not all of your requests. Want access to sensitive data? You'll need to authenticate with your Guardian app. Just want to log in for the day? You're free to go.

![The Guardian app allows you to trigger MFA for some but not all of your request](https://images.ctfassets.net/23aumh6u8s0i/6IEIMNQlG8haYqzmcD1vqJ/19606060b303c86ea3c79237e8f38cb8/step-up-flow)

(*An example of the Guardian app's capability on Fabrikam Intranet's system, where anyone can sign in without MFA, but a push notification is triggered when users try to access the employees page.* | [Source](https://auth0.com/docs/multifactor-authentication/developer/step-up-with-acr))

## Refresh (and enforce) good personal habits

Make sure your employees know the best habits to use when dealing with security. A good personal refresher is *[How Not To Get Your Identity Stolen](https://auth0.com/blog/how-to-not-get-your-identity-stolen/)*, which lays out some common sense advice to keep yourself secure online. While not everything is directly applicable to work, some of the most salient points that translate to the workplace are:

* Don't use unsecured public internet connections
* Set up a password for your home wifi network, especially if you're working from home
* Don't use shared device to access sensitive material
* Always sign out of your accounts when your session is done

These are easy, no-nonsense tips, but they often fall through the cracks, especially when workers are more frequently on the move or are working from home. Refreshing common sense security protocol regularly is important.

Some suggestions you can help enforce internally. Forcing sign out, as we've seen, is something that you can automatically initiate rather than relying on employees to remember. Wherever you can nudge along good behavior lessens the risk of having a security breach. After all, employee error accounts for [2/3](https://www.foley.com/employee-error-accounts-for-most-security-breaches-06-07-2016/) of security breaches.

## Don't compromise for anyone

You simply cannot leave your company's digital security up to chance. The best way to protect your identity data, especially in today's mobile environment, is to set yourself up for success by turning to experts in identity management.

Then, you need to foster a culture of safe cyber habits to keep everything that needs to say internal, internal.

With these plans in the books, you can offer flex time or remote opportunities to your workers' desire.


How IAM Can Help Your Enterprise Get Mobile

GDPR compliance is an opportunity to improve how you do Identity—whether it's improving customer experience, time to market or increasing revenue.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

Like the business trip that hits at an inopportune moment, [GDPR](https://auth0.com/gdpr) compliance can feel like a large inconvenience, even though it is business-critical. We believe that every security or compliance requirement has a silver lining. With GDPR, you have an opportunity to improve how you do Identity—whether it's in the context of improving customer experience, time to market, or increasing revenue.

<include src="TweetQuote" quoteText="We believe that every security or compliance requirement has a silver lining."/>

![GDPR - General Data Protection Regulation](https://images.ctfassets.net/23aumh6u8s0i/1TWFcNwmXWjBsj2kZUcYiB/9b7cf20f83478bafa60b8a7f4cfbf73f/gdpr-flag)

Many of our customers make the most of their investment in compliance by using Auth0 to upgrade their customers' experiences and achieve their business goals at the same time. Here are a few examples of how they've done it—and how you can too.

## Increase customer conversions and upgrade user experience

Your largest customer is often both the most demanding and rewarding. If you can redirect them to a customized page after logging into your application, you will be able to treat this customer differently from the rest—as you should.

Thank them. Make it easy for them to add to their subscription. Engage them with questions. Auth0 makes it easy to take an innovative approach to this page to increase customer conversions.

An unfriendly implementation of GDPR compliance could tarnish that interaction. Instead, demonstrate your respect for their time by automatically recording the date when explicit consent or agreement to new privacy terms was granted without any disruption to service. Using Auth0 to automatically record the data without adding anything to the login form means your biggest fan won't notice the difference.

Auth0 Rules and the Management API let you accomplish [the url redirection based on identity](https://auth0.com/docs/rules/current/redirect) while [recording when explicit consent was provided](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance), as well as new privacy terms and conditions agreed to at login.

## Turn leads into revenue faster

Every time a new user creates an account within your application, you can create an opportunity for your sales and marketing team. Ideally, they'll be able to convert that user from a contact into a lead and, eventually, into a customer. But success here is a numbers game. The percent of new accounts that turn into qualified leads is typically small, so automating this process can be key.

Automatically creating leads from new accounts in your CRM or marketing tools like Marketo or Eloqua frees your team to begin the customer nurturing process faster, shortening the time to potential reward.

Making lead creation contingent upon the user's explicit permission to create the account and receive marketing information at login allows you to easily automate one aspect of GDPR compliance.

Again, rules are the Auth0 innovation tool that allows our customers to [automatically create a Salesforce lead](https://github.com/auth0/rules/blob/master/rules/creates-lead-salesforce.md) or Marketo contact when a new person signs up with an account. Auth0 allows you to [provide an explicit consent option](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance) within the login screen, while custom logic within Rules could be created to make sure that lead doesn't get generated in an external system without gaining (and tracking) explicit consent.

## Optimize your users' experience

Everybody wants a great user experience for their apps' login to save on costs and increase customer conversions. But this especially applies to those organizations with a very complex group of application users faced with the challenge of providing an ideal user login experience across a large number of applications. In this case, 'out of the box' identity isn't enough. Customization is critical.

One of our logistics and transport industry customers had users who might be a driver for one company, a dispatcher for another company and a manager at yet another company. Same user signing into different applications, with completely different roles. We were able to seamlessly tie the customer's complex permissions scheme to the login process to convert users based on context and give them access to the appropriate applications right from the login screen, giving our logistics and transport industry customer the precise control they needed.

GDPR specifies confidentiality of customers' personal data—so if any of these applications contain personal data, it is also critical from a compliance perspective to be able to granularly control who is accessing what application and with which permissions.

With Auth0 Rules, our customer was able to easily verify user logins and specify further permissions within the app based on information from the customer—innovating their users' experience while achieving gains in GDPR compliance.

## Compliance can help grow your bottom line through innovation

When you invest in meeting your GDPR requirements you can also innovate identity for your applications. With Auth0, compliance and innovation are not mutually exclusive.

<include src="TweetQuote" quoteText="With Auth0, compliance and innovation are not mutually exclusive."/>

See how much innovating your identity with Auth0 can grow your bottom line with the[ Forrester Total Economic Impact assessment](https://resources.auth0.com/forrester-tei-research-case-study/).




"iam"