diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to limit the damage during an infrastructure breach


The Capitol riot on January 6 was a dangerous moment on multiple levels, not least of which were the cybersecurity ramifications. The Capitol’s information infrastructure &mdash; laptops, documents, phones &mdash; were all in the hands of rioters for several hours. In one case, a woman allegedly stole a laptop or hard drive from Speaker of the House Nancy Pelosi’s office, though the woman eventually [turned herself in](https://www.nytimes.com/2021/01/18/us/riley-june-williams-emmanuel-jackson.html) to law enforcement.

The potential exposure of sensitive government information &mdash; especially coming on the heels of the devastating [SolarWinds hack](https://auth0.com/blog/the-nine-worst-recent-data-breaches-of-2020/) &mdash; is inspiring business leaders to examine their own cybersecurity vulnerabilities.

Many are asking: What would I do if my company’s tech was lost, stolen, or tampered with? How would we mitigate the damage from compromised hardware?

To start addressing those questions, it’s important to understand how a physical breach (of your offices or of your hardware) can have digital implications. Here are some of the cybersecurity lessons from the Capitol riot and how to protect your company in such an event.

## All Physical Access Is Risky

There’s a famous cybersecurity truism that states, “If a bad actor has physical access to your computer, it’s not your computer anymore.” In other words, just because a mugger hasn’t run off with your laptop, that doesn’t mean it hasn’t been compromised. In the high-stakes world of corporate espionage (not to mention traditional espionage), all an attacker needs is a thumb drive and a moment alone with your device to steal information or introduce malware.

What’s more, in today’s hyperconnected world, computers aren’t the only risk vector since every network-connected device can present an entryway for attackers. The proliferation of devices on which we work has made it much more difficult to assess the damage after a potential security incident. Case in point: In the confusion of the Capitol riot, it was initially unclear how much hardware had been stolen or otherwise compromised. As [Wired](https://www.wired.com/story/capitol-riot-security-congress-trump-mob-clean-up/) reported, “Rioters could have bugged congressional offices, exfiltrated data from unlocked computers, or installed malware on exposed devices.”

### What to do if your hardware may have been breached

Let’s imagine a scenario in which there’s been a break-in at your office. There’s paper scattered everywhere, you’re not sure what devices are missing, and you’re not sure if the remaining tech is compromised. Where do you start damage control?

#### Don’t overreact

Don’t try to physically destroy every piece of hardware that could potentially be infected. That’s like ripping up all your floorboards to locate a single mouse.

#### Focus on securing user identity

The single greatest security threat of 2021 and beyond is a bad actor with stolen credentials. So make sure you’ve implemented [multi-factor authentication](https://auth0.com/learn/get-started-with-mfa/) (MFA), preferably using a strong method like biometric authentication or a hardware token.

In the wake of a breach, you should also change all your passwords. MFA will protect you from a password-based attack, but it isn’t foolproof, especially if an attacker has physical access to session cookies to perform session hijacking. But combining strong MFA, password rotation, and limited session lengths will help purge any bad actors from your system.

In all likelihood, your business will never face a physical breach like the capitol riot. But in the age of [remote work](https://whatfix.com/blog/remote-work-policies/), your organization’s physical assets are constantly in motion and exposed to risk. Given that fact, your network’s true perimeter is built into your networks: user identity.

#### Conduct an asset inventory

Maintain an [asset inventory](https://www.axonius.com/blog/when-asset-inventories-become-incident-response-exercises) of all work-connected devices, and their vulnerability level is breached. Ideally, this is something you will have done prior to a security event, but if not, it should still be a priority. Establishing ownership of each device is a crucial part of asset inventory because without it, tracking down devices is much harder. Have every member of your staff report on the status of their own devices and whether or not they followed security protocols on those devices.

This will let you quickly determine if something is missing and help you figure out where to start looking for intrusions. For example, if Debra from accounting’s laptop is missing, and she had the password taped to it with a sticky note, that’s the first hole you’ll want to patch up.

<NonAmpContent>
<blockquote class="twitter-tweet"><p lang="en" dir="ltr">My heart goes out to the unsung IT heroes at the Capitol tonight. My guess is they've never had to run asset inventory IR before - a daunting, stressful task in a tabletop exercise - and they're running one (prob w/o a playbook) following a full on assault of the Capitol.</p>&mdash; socially distant, mask wearing bat (@mzbat) <a href="https://twitter.com/mzbat/status/1346983709786976257?ref_src=twsrc%5Etfw">January 7, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</NonAmpContent>
<AmpContent>
<amp-twitter
  width="375"
  height="472"
  layout="responsive"
  data-tweetid="1346983709786976257"
>
</amp-twitter>
</AmpContent>

## Enterprises Need Standardized Data Security Policies

Within large organizations, data handling policies can vary from department to department and even from team to team. Some variation is inevitable since people use different devices and different applications and have different data sharing needs. But if your company doesn’t have some shared fundamentals of data security, fixing a breach becomes a daunting task. Large organizations need to establish a shared definition of what sensitive data means to them and what their legal obligations are under [data privacy laws](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/).

One of the biggest challenges in assessing the cybersecurity damage of the Capitol riot is that Congress has no standardized cybersecurity policies. Instead, Senate staffers [told CNN](https://www.cnn.com/2021/01/07/tech/capitol-riots-cybersecurity/index.html) that “while some IT protections exist across the organization, many decisions about information security practices are left up to individual lawmakers’ offices.” They report that some staffers do not use VPNs across all their devices, and some stored data locally on their desktops.

Capitol staffers also don’t seem to have had a shared definition of “sensitive data.” While elected officials are prohibited from sharing classified information outside of specific networks, it sometimes gets out anyway. [Wired](https://www.wired.com/story/capitol-riot-security-congress-trump-mob-clean-up/) reports that “congressional staffers are not subject to Freedom of Information Act obligations and are often much more candid in their communications than other government officials.”

Even seemingly innocuous data can be dangerous in the hands of attackers, who can weaponize a high-ranking official’s (or executive’s) travel schedule. Bad actors can use personal information in spear-phishing attacks. Even device metadata can be extremely revealing if it shows who leaders are communicating with and when. 

Protecting yourself and your company requires developing both technological safeguards and a shared culture of security.

### How to implement tougher data security policies

Improving your organization’s cybersecurity requires C-suite supervision and buy-in at every level. Automate security whenever possible, instead of expecting your workforce to manage it during an emergency when they have other concerns. But while technical protections are crucial, don’t ignore the human element. Strong cybersecurity requires the active participation of an entire workforce and a shared awareness of potential risks.

#### Empower your CISO
Your head of security needs the support and resources necessary to implement top-down guidelines for the whole organization. This should take place in a larger context of the CISO’s evolving role and increasing responsibilities. To quote [Andreessen Horowitz](https://a16z.com/2020/12/18/security-in-2020/): “From its initial focus on securing on-premise servers, the Chief Security Officer (CSO/CISO) role has sprawled to include not just the cloud, but the physical workplace, individual laptops and phones, and data privacy and compliance.”

Part of the CISO’s role is to put security protocols in place so people can focus on their work. The CISO is also responsible for building an internal security culture that makes it easier for humans to choose security best practices whenever possible. Ideally, the rest of the C-Suite strongly supports them in all these efforts and models a commitment to security for the rest of the organization.

#### Have separate devices for work and personal use

This is a real challenge at companies with remote workforces and bring-your-own-device (BYOD) policies, but it’s one of the most effective ways to minimize damage in an attack. To convince your workforce to be disciplined about their device usage, emphasize the privacy benefits to them. 

[Brandon Maxwell](https://auth0.com/blog/authors/brandon-maxwell/), a Detection and Response Manager at Auth0, says, “If your device gets compromised by malware, an incident response engineer is going to have to analyze your downloads, your internet history, all those kinds of things.” In the case of a physical breach, an investigator may inspect the device for company data to ensure it wasn’t modified or accessed. While personal data would not be in scope, the analyst would likely see filenames and other metadata that an end-user may not be comfortable sharing otherwise. Emphasizing both privacy and security helps motivate employees to keep their devices separate.

#### Automate device lockouts

Institute centralized protocols to automatically lock devices after a short period of activity or if the hardware is missing. ([Apple products include this capability](https://support.apple.com/en-us/HT204756) as part of the “Find My” feature.) In an emergency, you can’t expect employees to lock their screens &mdash; it should happen automatically. Yet in the Capitol riots, numerous screens were left open, as you can see in this [deleted tweet](https://www.law.com/therecorder/2021/01/08/will-the-cybersecurity-vulnerabilities-during-capitol-rioting-spur-litigation/) from one of the rioters.

![Elijah Schaffer Tweet](https://images.ctfassets.net/23aumh6u8s0i/RJsOz4VRyoHwF2xznCuQa/6810ff2d9ddfcc741b240a2ae13b043a/elijah-schaffer-tweet)

Just as importantly, [limit session length](https://auth0.com/blog/balance-user-experience-and-security-to-retain-customers/) for employees. Just like your mobile banking app automatically logs you out after a brief period of inactivity, do the same with your sensitive data and applications. This can be useful even if you’re never the victim of an attack since locked devices also protect employees from their kids ordering $100 worth of apps while their back is turned.

You may also want to reconsider checking that “remember me for 30 days” box in your login screens since a bad actor who steals an unlocked or unencrypted device can then easily access that account.

#### Standardize physical, administrative, and technical controls across the organization

Practicing basic cybersecurity hygiene should be as deeply embedded in your company culture as your code of conduct. These expectations include things like requiring all remote workers to use full-tunnel VPNs on all devices. You should also implement strict password policies, guided by current NIST recommendations, and require all employees to use password managers to ensure strong and unique passwords.

#### Assume you’ve already been breached

Adopting this mentality will help you when going through monitoring logs for unauthorized access. Better yet, use an [identity and access management](https://auth0.com/blog/what-is-iam/) (IAM) platform that adopts this mentality on your behalf and proactively demands MFA for users who exhibit suspicious behavior or for employees who use compromised credentials.

## You Can Secure Your Data in a Chaotic World

The U.S. Capitol was put at risk not just by a failure of planning but a failure of imagination: the idea that “it can’t happen here.” Unfortunately, many organizations and businesses have the same attitude about their own cybersecurity, and it puts sensitive data at needless risk. By taking a sober look at the value of your own data and the threats to it, you can start building your defenses in case the unthinkable happens.

To learn more about how centralized identity and access management can be a part of your organization’s security posture, reach out to the team at Auth0.


Cybersecurity Lessons From Capitol Riot

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

There are valuable lessons to be learned from the cybersecurity stories of a challenging year.

The 9 Worst Recent Data Breaches of 2020

dave-wilner

Dave Wilner is the Chief Revenue Officer for Auth0, responsible for all field teams including Sales, Marketing, Professional Services, Support and Customer Success.<br /> Dave has spent the last two+ decades in executive roles at high growth, highly successful software companies.<br /> In another life, Dave was also a litigation partner at AmLaw 100 international firm Cozen O’Connor. In this life, Dave lives in Issaquah, WA with his wife Brenda and their two sons, and their adopted pit bulls Bo and Mona.

Chief Revenue Officer

Dave Wilner



Back in 2003, I was a young sales manager leading a small but solid team for a startup. After we were acquired by a large multinational company, I found myself reporting to an SVP of Worldwide Sales; we'll call her Marie, who was responsible for over $500MM in revenue. This was next-level for me, and my time reporting to her taught me an important lesson &mdash; how NOT to manage up.

## How Did I Screw This Up?

I reported to Marie for around 12 months. During this time, my team absolutely killed it. We were the top-performing go-to-market team across the entire $6B global business. We were never at less than 120% of the plan in any quarter and were the envy of teams across the org. I was doing nothing but making life easier for my new boss.

Or so I thought.

Despite all the success, I never felt like Marie enjoyed talking to me. She canceled at least half of our weekly 1:1s, citing travel or scheduling conflicts (once her exec assistant told me she was out of town literally 20 minutes after I walked past her in the lobby &mdash; that one hurt). 

When we did connect, she was brisk, all business, and very short. I wasn't expecting to be best friends. I didn't envision sipping martinis after work, grabbing dinner with our spouses, or joining her family at their Christmas party. 

But I also didn't expect to be treated like I was slathered with fish entrails. 

## Virtually Unmanageable

After finishing my one-year earn-out period, I gave my two weeks' notice and began looking for another early-stage company to jump into. During my exit interview, the HR business partner confided in me that my boss had said I was "virtually unmanageable" and "the most exhausting direct report" she'd ever had. 

Ouch.

Did I mention I crushed my numbers? Like CRUSHED my numbers? How on earth could my boss have thought of me as anything other than a beacon of light? A pillar of go-to-market excellence? A reliable watercraft on otherwise tumultuous seas?

It turns out that I was completely and utterly terrible at "managing up" or managing my relationship with my boss.

Looking back, there's a ton that I should have done differently. When I had more time under my belt managing teams of my own, I came to appreciate the art of managing up and how important it is to be intentional in how you manage your relationship with your boss. 

To pack it up, here are my biggest lessons:

## Lesson #1: Keep It Positive 

Anyone that works closely with me knows that I'm an Eeyore. I can be a little surly and a bit of a grouch. Apparently, I tortured Marie with dozens of grumpy paper cuts each week. Any random negative thing I noticed led to a grousing, whining email (this was 20 years before Slack, mind you). 

* "It's been ten days, and I still haven't received the slide templates Marketing promised."
* "The Solution Engineering org here is really weak."
* "Don't you agree that our new HR business partner is an @sshat?"

I was a stream-of-consciousness communicator and communicated with my boss like I would with a colleague, a friend, or someone sitting next to me on the bus. 

Venting is no problem, but don't do it to your boss. Find a peer, a friend, a spouse, a dude in line with you at Walmart, whatever &mdash; just not your boss.

## Lesson #2: Pack It Up

One way to tell the difference between a relatively new manager and a seasoned exec is the efficiency of their communication. Newer managers provide too much information, too much detail, and tend not to set expectations about what they need from a given conversation. In short, they ramble or babble. 

On the other hand, more seasoned executives are typically much more efficient &mdash; and effective &mdash; at quickly getting what they need. 

It's tough to give this lesson the right level of detail without turning this piece into a 3,500-word essay (I appreciate the irony that I cannot pack up how to pack it up). I will save that degree of detail for another blog post; however, some quick guidelines to consider:

* Set expectations for any 1:1 or meeting with your boss at the outset.

 → _We have 30 minutes, yes? I have two things I need your feedback on, and two requests I hope you can approve today._

* Layout what requests or needs you have.

→ _I'd like your support for a new initiative to drive more page views on our site. It requires a $250,000 unbudgeted investment._

* Share what information you have to support your request.

→ _I shared the context and math behind the request with you by GDoc last Friday. Have you had time to review it?_

* Ask what other information they need to make a call.

→ _What other information do you need from me to make a decision?_

* Stop talking.

→  ...

Be respectful of their time, provide context, and confirm they have what they need. 

## Lesson #3: Don't Over-Index on HR Stuff

This is a big one.

I focused a lot of my 1:1 time with Marie on people management issues, taking her through the minutiae of each personnel issue in my organization. Since I was a relatively new people manager, the people aspect of the job was the hardest for me, and the one most often on my mind.

Here's the thing: people issues that seem significant to an entry-level manager are par-for-the-course for executives that have managed people for much of their careers. Focusing communication on "lower-level issues", therefore, makes you seem like a "lower-level leader," and implies you're incapable of dealing with those issues.

_But Dave isn't part of my boss's job to coach me and help me become a better people manager?_ 

Of course. To be clear, this is **not** me telling you never to bring up people issues. It is a reminder that if you are a relatively new manager, people issues might be keeping **you** up at night, but that will **not** be the case for your boss. Lead all conversations with business issues &mdash; issues that tie to your boss's success &mdash; and save tightly-framed HR stuff for the end. Consider also leveraging a mentor, someone you can bounce ideas off of in a more relaxed environment.

## Lesson #4: Set the Cadence

If your boss is overloaded, your regular weekly/monthly meetings with them may feel harried, like an afterthought or a check-box endeavor. Take control of the communication, both the cadence and the subject matter. Suggest a regular time to meet, and propose a regular set of key performance indicators (KPIs) to review. If those KPIs just happen to be metrics upon which your boss herself is measured, even better. 

If you're stuck on how to structure the meetings, try something simple like "The 3 P's":

* Performance: a review of a dashboard of some sort that objectively tracks the performance of your team.

* People: the status of any headcount to be filled, restructuring plans, or other team-related items.

* Potpourri: any other random odds and ends.

Taking control over the cadence and agenda shows confidence, takes an item off your boss's to-do list and ultimately makes their lives easier.

## Lesson #5: Don't Hide the Gnarly

NOBODY likes delivering bad news to their boss. But if there's a problem brewing in your business, it is far wiser to bring that problem to your boss's attention than risk them discovering the issue on their own.

This runs counter to many new managers' instincts. It's often easier to convince ourselves that things will work themselves out, that the tides will turn, or engage in other acts of aggressive denial than admit dark clouds are on the horizon. 

If your boss identifies a problem in your business you have not discussed with them, they are likely to assume that (1) you're not aware of the problem, or (2) you're aware but have no idea what to do about it. 

Neither reflects well on you.

Bringing a potential wrinkle to your boss early, in fact, reflects **positively** on you as a new manager, even if the wrinkle never materializes. Consider:

* If you identify the problem first, you're on top of your business.
* If you bring a solution as well, then you are not only on top of your business, _you know how to manage through challenges._ 
* If you identify the problem but aren't quite sure what to do about it, you're _displaying good judgment_ and striking the right balance between working independently and seeking guidance.

Some of the worst breakdowns between managers and their direct reports occur when people don't identify or take responsibility for mistakes. Identify potential problems in your business and share them early. 

## 360 Degrees of Responsibility 

My ["Careful What You Wish For..." blog post](https://auth0.com/blog/careful-what-you-wish-for/?utm_source=linkedin&utm_medium=sc&utm_campaign=whatyouwish) looked at the difficulties of managing those on your team. But it's just as important to learn how to manage upwards if you are going to succeed. You might have the best objective results every week, but it doesn't mean a thing if you deliver those results alongside poor communications, a lack of understanding about the bigger picture, and 20 minutes of "I can't believe marketing messed that campaign up" chatter.

Like anything in leadership, be intentional about your communication strategy with your boss. Put in the time to plan, and review your progress regularly. 

Also, don't call co-workers @sshats.   

**The End**

<include src="asides/AboutAuth0" />


When Your Boss Is Just Not That Into You

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Companies of all sizes are pivoting quickly to remote work. Here are seven lessons from our remote-friendly culture


Due to recent events, hundreds of thousands of people globally have found themselves having to work from home. But what happens when someone now finds themselves out of their daily routine, without structure, and alienated from a lack of social interaction?

Auth0 has been a remote company from Day 1, with our two founders starting the company seven years ago while living in the USA and Argentina. We grew and scaled our workforce by hiring people from all around the world. Below are the key lessons for employers and employees to smooth the transition to remote working.

## 7 Lessons for Successful Remote Working


### Lesson 1: Trust Your Peers

There are two essential components for the success of remote working. Trust is one of them — when you can't work next to each other, trust becomes primordial. You have to trust your peers will continue to give their best while working from home,  that they are doing what they say they are doing, and will deliver quality work on time.

Trust will empower them to thrive.

### Lesson 2: Clear Communication

Communication is the other essential component. Without face-to-face interactions, ensuring clear, constant, and transparent communication is of utmost importance. Maintain regular communications with your peers, whether it's via chat or video, by setting up weekly syncs, 1:1s, or brainstorm sessions.

Tools play a key role in making this an enjoyable and efficient experience. There are plenty of options, but our communications trifecta is [Slack](https://slack.com/), [Zoom](https://zoom.us/), and [Confluence](https://www.atlassian.com/software/confluence) for chat, video, and documentation. We also use [Mural](https://mural.co/) for whiteboarding, [Figma](https://www.figma.com/) for real-time collaboration between our designers, and [Lattice](https://lattice.com/) for feedback, surveys, and 1:1 conversations, just to name a few more.

![The important of clear and constant communication when remote working](https://images.ctfassets.net/23aumh6u8s0i/1a1S0WICPdXHF78I3S3ysT/23b698a239d8a43d7d800794cae2620f/0_hero)

### Lesson 3: Respect Others' Time

Meetings can be tempting when working remotely (it's an opportunity to see a face!) but think twice before scheduling one. Ask yourself, can this be managed via message/email or maybe even a short video call? If yes, then there is no need to schedule a meeting. The meeting is needed? Ok, but make sure to set up an agenda and respect the starting and ending times.

Don't expect instant responses from colleagues. Your messages/emails don't have to be answered instantly. Everyone needs time to focus on their projects, so take into account that your requests can't be answered right away and learn to respect the 'Do Not Disturb' status.

### Lesson 4: Manage Your Time

Making the switch to remote is not easy and can have an impact on your productivity, but many things can help:

* Start by organizing your day — structure is key.
* To-Do lists are your friend.
* Plan in advance.
* Implement a time management technique — we recommend the [Pomodoro technique](https://en.wikipedia.org/wiki/Pomodoro_Technique).
* Block your calendar with focus sessions.
* Setup the don't disturb status.

### Lesson 5: WorkSpace

"It will be amazing to work from my bed or couch" is a common first thought when starting to work from home. Although the idea is very tempting, having a dedicated space for working is essential.

It doesn't have to be a fancy office with 3 screens and full of gadgets, it's about having a space that suits you, where you feel relaxed and happy, and which enables you to focus and set your creativity free.

Tips to set up a quick workspace: find a space in your house close to the internet (you don't want to lose connection during a video call) where you can work without disruptions, take your most comfortable chair and desk, order nice headphones, and you are ready to work.

### Lesson 6: Work-Life Balance

Working from home can blur the lines that divide personal and professional time. The most important thing is to set up boundaries by implementing office hours. Forget about the typical 9-5 (you are free from that), but choose what suits you best. The important thing is to divide your two lives.

Remember to take breaks during your office hours. Taking breaks doesn't come as easy when working from home, but they are important for your mental health and productivity. Try planning and scheduling your breaks in advance and most importantly: *get away from your desk*.

Another big one is exercise. Sedentarism is one of the few cons of remote working, but there are plenty of great routines you can do right there in your house.

Now you can't justify not doing exercise because of the lack of time... you have hours free because you are not commuting anymore.

![7 lessons from beignn remote working for 7 years](https://images.ctfassets.net/23aumh6u8s0i/1823ottXfMNiYotVUDWb32/8b1944d65d45be3594d1f386ddbfb79f/culture2)

### Lesson 7: Don't Overlook Security

The sudden growth of remote working comes with an increase of cybersecurity challenges: new devices to be hacked, networks to be probed, credentials to be stolen, and targeted phishing attempts, to name just a few

Here are 3 tips that can help overcome these challenges:

- *Cybersecurity Guidance*: education is the main way to overcome these challenges. Educate your organization about security by creating best practices guides and setting up training sessions.

- *Single Sign-On*: reduce password fatigue, mitigate credential theft, and make life easy for everyone by [setting up Single Sign-On](https://auth0.com/single-sign-on).

- *Multi-factor Authentication (MFA)*: the much needed extra layer of security. [Implement MFA](https://auth0.com/multifactor-authentication) and safeguard your data from unauthorized access.

## Conclusion

Welcome to the remote club. We hope these lessons based on our experience of 7 years as a remote company can help you get the best of your remote time and maintain the same productivity as working from an office.

Are you a remote worker specialist and want to share some of your lessons? Or you just started remote work and have some questions? Please go ahead and leave a comment.


Welcome to the Remote Club: 7 Lessons From 7 Years

Enterprise SSO ensures better productivity, user experience, and security for employees through single-click access.



Leading up to the 2016 U.S. presidential election, Russian hackers allegedly attacked the Hillary Clinton campaign and the Democratic National Committee with [spear-phishing](https://www.pcmag.com/article/354240/spear-phishing-attacks-what-you-need-to-know) efforts to trick users into providing their usernames and passwords to fraudulent websites.

As cybersecurity concerns continue to mount, user credentials demonstrate a universal weak point in corporate security, and the more accounts and logins employees and IT departments must manage, the more hackers can find valuable openings. 

So how do companies navigate these risks in a world constantly pushing for more SaaS application use as they grow in size?

One answer lies in SSO, a way to enable single-click credentials and secure identity verification while also improving user experience. 

## What is SSO?

SSO—Single Sign-on—acts as a holistic, single login point where users enter one set of authentication credentials that grant access to a suite of other applications, regardless of the platform, technology, or domain used. 

Picture an office building with unique offices for a variety of related but separate businesses, each with their own key. 

But if it were using an SSO-like system, authorized personnel would instead use one key to get through the front door, sparing them the hassle of using separate keys to get into the individual offices. 

This is the general idea behind how SSO systems work for services like G Suite — where your Google account login gives you access to a variety of individual applications — and Slack. 

### How does SSO work?

Users begin their SSO experience by logging into a gateway, which can be displayed in a variety of ways, depending on the application a company uses. 

With Auth0, users are redirected to a login page with username and password fields, and may include Social Identity Providers such as LinkedIn, GitHub, Google, etc.

![Example Auth0 login screen - SSO in background](https://images.ctfassets.net/23aumh6u8s0i/3nHe9HYJtL71aEhJwAmUms/cbb668c190ab9abca22db8642f6b0084/enterprise_sso_auth0_example)

From there, the users go through the following steps: 

1. They enter their master username and password
2. The credentials are run through the Identity Provider (IdP) for verification, where the authentication server checks the credentials against the directory that contains stored data
3. If the credentials check out, the authorizing server will set an SSO cookie 
4. Users are then redirected to the application they want to access

In the future, users won’t have to see a login screen when accessing any approved application integrated with the SSO setup. 

Instead, when users want to log in:

1. the IdP checks to see if there is an existing SSO cookie; 
2. if necessary, the provider updates the cookie; and 
3. the IdP returns an ID token containing the users' identity information and logs them in. 

Note: During this process, users don’t see a login screen and are seamlessly directed to the dashboard of the application they’re looking to use. 

## 1. Enterprise SSO Improves Employees' User Experience

By using [enterprise SSO](https://auth0.com/single-sign-on), companies save employees time and effort by asking them for only one login and one set of credentials. 

These credentials work for all cloud, on-premises, and mobile applications and provide a hub for all company applications, rather than requiring employees to remember usernames and passwords for each tool.

SSO also provides employees with a more personalized experience by bringing all of their tools and resources into one hub. 

## 2. SSO Provides Multiplatform Access

<include src="TweetQuote" quoteText="Universal access provides employees with the flexibility they expect in the modern workplace and ensures IT security against the threats inherent in modern digital life"/>

By giving employees a single point of login, companies seamlessly provide their teams with multiplatform access. 

With recent studies showing that small companies use a mean of [13.4 different applications](https://www.intermedia.net/assets/pdf/Osterman_-_Survey_on_Application_Use_Within_Organizations.pdf), and large companies boast an average of [more than 15 applications](https://www.intermedia.net/assets/pdf/Osterman_-_Survey_on_Application_Use_Within_Organizations.pdf), SSO allows companies to reduce the chance of employees losing, reusing, and sharing passwords across a multitude of accounts.

That means employees aren’t limited to accessing key tools and resources only at work: They can also securely log into these applications from their homes and mobile phones or access them while traveling.

![Google G Suite apps panel](https://images.ctfassets.net/23aumh6u8s0i/yEX0HHdnz6XJUO4aPYhpj/c97ba95f168fe8d8d41061f18a5dd93b/enterprise_sso_google_apps)

[Source: [Google](https://gsuite.google.com/)]

This universal access provides employees with the flexibility they expect in the modern workplace and ensures IT security against the [threats inherent in modern digital life](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/).

## 3. Enterprise SSO Ensures More Secure Passwords

While employees objectively know they should create hard-to-guess passwords, the impracticality of remembering complex credentials often results in the reuse of weak passwords over and over again. 

In fact, [nearly 90% of people ages 18–30 use the same password_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) across multiple accounts. 

When employees give in to the demand for increasingly complex passwords in order to thwart hackers, the frequency of password recoveries skyrockets. Because of these complex password requirements, [_60% of people need to reset their passwords every 60 days_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) — a practice that also [_costs companies an average $179 per employee_](https://www.pingidentity.com/en/company/blog/2015/11/13/passwords_will_die_a_slow_death.html) [_per employee_](https://www.pingidentity.com/en/company/blog/2015/11/13/passwords_will_die_a_slow_death.html) and is largely avoidable with SSO.

When companies embrace enterprise SSO, team members have to remember only one master set of credentials. This prevents them from creating unique, complex sets of passwords, reusing weak passwords, or [_keeping physical records of all passwords_](https://keepersecurity.com/assets/pdf/Keeper-Mobile-Survey-Infographic.pdf) — all of which are inconvenient, costly, and insecure. 

<include src="TweetQuote" quoteText="Companies looking to save their employees time and provide peace of mind while improving individual and network-wide security can set up SSO with the help of Auth0."/>

## 4. Enterprise SSO Boosts Employee Productivity

Utilizing SSO for employees boosts productivity by reducing the time teams spend locked out of key tools while waiting for password resets and getting set up on new applications. 

Employees are also much more likely to know about and take advantage of resources and tools that make their jobs easier and faster and answer common user questions when those applications are linked to one hub, as SSO allows. 

## How Does a Company Set Up Enterprise SSO?

Companies looking to save their employees time and provide peace of mind while improving individual and network-wide security can [set up SSO with the help of Auth0](https://auth0.com/learn/how-to-implement-single-sign-on/).

Beyond the technical aspects of the switch, companies should keep in mind the following rollout tips to help their teams adjust to an SSO setup:

* Make sure to carry over login information so team members don’t have to reenter everything.
* Provide clear direction for users.
* Identify key applications that employees often use, including key software, cloud accounts, and social media. 


4 Vital Ways Enterprise SSO Saves Your Employees Time and Provides Peace of Mind

3 lessons business leader can learn from the T-Mobile data breach to protect their teams and customers.


On August 20, T-Mobile discovered that a hacker had gained personal information from unauthorized access to its system. Over 2 million of its 77 million customers were exposed.

Although T-Mobile quickly reported the incident to authorities, it's apparent that the cybercriminal is [aiming to sell the data](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420), including names, ZIP codes, phone numbers, email addresses, and payment information.

While it's still too early to determine the financial consequences T-Mobile will face from the incident, a recent [study](https://blog.kenan-flagler.unc.edu/risky-business-the-impact-of-data-breaches/) from UNC found that data breaches can cost companies as much as 3% of their market value. Dashlane estimates the average dollar cost at [$7.35 million](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) in the U.S., 60% of which is customer (revenue) loss.

 What can business leaders learn from this incident to protect their teams and their customers going forward?

## Lesson 1: Hackers Go for Weak Points, So Protect Yours

Understanding how hackers get in is the first step. There are [four common ways](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/) that hackers access systems:

1. Malware infiltration (placement of malicious software, including ransomware and spyware)
2. Phishing (emails that trick recipients into giving away sensitive data or downloading a file that installs spyware)
3. USB traps (a hardware device that contains a HID spoof)
4. Mobile attacks (attacks specifically designed for mobile software)

In all cases, hackers look for the simplest vulnerability they can possibly use to compromise your system. That means they're not necessarily going to try to waltz in the front door. In the T-Mobile data breach, the thief was able to access the system through a hole in an API.

It's critical to plug your leaks. Since APIs run on web servers, they are available to all internet users. Like websites, hackers can crawl APIs.

### Authorize Your Users

To be sure you know who is working within your system at any one time, implement a strong user management system. You can build one in-house or outsource it. Many choose to outsource their identity management since the field is increasingly complex and time-intensive — a challenge for in-house teams to manage with the rest of their workload.

Auth0's [user management](https://auth0.com/user-management) dashboard, for example, lets administrators grant permissions for certain users to access sensitive customer information.

![Auth0's user management dashboard](https://images.ctfassets.net/23aumh6u8s0i/QocoCmdAqGCxzA9wCSqsp/c0f08f478e78129808dea8aa38477077/authorization-permissions)

With this powerful web interface, they can add or remove users, modify their profiles, and identify any root-cause login issues.

With APIs, it's also important to remember to authenticate your apps in addition to authorizing users. You can use a [standardized protocol](https://auth0.com/docs/api-auth) for both authentication and authorization.

## Lesson 2: Update Your Password Practices

A 2017 Verizon report found that [81%](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) of hacking-related breaches were due to stolen and/or weak passwords. While for years teams relied on the MD5 (message-digest) algorithm to hash passwords (create mathematical representations of plain text), today it's not considered the safest method.

<include src="TweetQuote" quoteText="A 2017 Verizon report found that 81% of hacking-related breaches were due to stolen and/or weak passwords."/>

Although originally MD5 hashes were designed to prevent anyone from working backwards from the hash to determine the real password, it's now possible to rapidly generate MD5 hashes to eventually find a matching password.

[Evidence](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420) points to T-Mobile password hashes being MD5, which suggests the company may have been using outdated password practices.

To prevent the risk of password hacking, many providers are using bcrypt instead — a more resistant algorithm. bcrypt uses a salt, an additional layer safeguard for passwords in storage. Over time, users can increase bcrypt's iteration count to slow the process. This makes it more resistant to brute-force search attacks.

### Implement Two-Factor Authentication

Two-factor authentication or 2FA is an alternative verification method. In addition to requiring users to type in a password, 2FA can also request a TOTP (a time-based one-time password algorithm) that it sends to the user's cell phone or other hardware device.

2FA can also require the second form of identification to be a biometric, such as a thumbprint or Face ID.

![iOS 11 iPhone X Face ID](https://images.ctfassets.net/23aumh6u8s0i/i6mkIBMKzZboV96MAaR8I/a18fc7a031c9f5660c611d89a7e52de0/ios11-iphone-x-face-id-hero)

[[Source](https://support.apple.com/en-us/HT208109)]

While none of these solutions are foolproof, a second method of authentication has been found to prevent breaches in [80%](https://www.slideshare.net/cheapsslsecurity/vip-strong-authentication-no-passwords-infographic-by-symantec)of the cases.

## Lesson 3: Improve Communication with Customers After a Data Breach

Although T-Mobile did attempt to notify customers whose accounts might have been compromised a few days after they discovered the incident, many of these recipients were put off — thinking the text message itself was a form of phishing.

![T-Mobile Data Breach Tweet](https://images.ctfassets.net/23aumh6u8s0i/1mspiKVeO2GUD8nXvUZw8z/7ba4d36cdc43e5edbcdbcf60907236b0/tmobile-tweet)

[[Source](https://techcrunch.com/2018/08/24/t-mobile-says-hackers-stole-customer-data-in-data-breach/)]

Texting can be a tricky form of communication for something so sensitive (particularly from a large, impersonal corporation). Organizations like [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) and Equifax have succeeded with well-crafted PR campaigns and explanations on their websites:

![Reddit data breach press release](https://images.ctfassets.net/23aumh6u8s0i/KD5ZLDwuM8UeOKhP3UW2K/bcb28aeb0eda8d90b2a6daee7e69f580/reddit-breach-release)

As a portion of the full announcement (which you can read [here](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)), Reddit clearly defines the scope of the breach, including details of what information the hacker accessed and how to know which users were affected.

Reddit also lets users know ahead of time that they will be contacting them through email to verify if their account has been compromised.

This is in stark contrast to T-Mobile's [vague description](https://go.skimresources.com/?xs=1&url=https%3A%2F%2Fwww.t-mobile.com%2Fcustomers%2F6305378821&xguid=85UTUFk2RzAa&id=66960X1514734&checksum=fc5d6ea7126bb8e6a7af56a7049975e787946c4e625ac9ceef083a8513bb04da) that their team shut down “an unauthorized access to certain information.”

![T-Mobile data breach press release](https://images.ctfassets.net/23aumh6u8s0i/3di8OI1TiR8WKlOTKzEIX3/560aff9c400227387f70fbc291cfad36/tmobile-breach-release)

Being as specific and transparent as possible (as quickly as possible) will help your customers trust that you are handling the situation and keeping them safe.

## Recent Data Breaches by the Numbers

It seems like every week there is a new catastrophe for personal data in the headlines. [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), Saks, Ticketfly, Panera, Lord & Taylor — these are just a handful of the major incidents so far in 2018.

The first half of 2018 saw nearly 700 breaches, on pace to equal 2017's staggering 1,579 breaches.

![T-Mobile Data breach chart](https://images.ctfassets.net/23aumh6u8s0i/2zNkiAn1hkY4MHzNlS1usB/28808e7918247c784def7780f80ae734/data-breach-chart)

The total number of exposed records from these incidents in the past five years tops 580 million.

<include src="TweetQuote" quoteText="The first half of 2018 saw nearly 700 data breaches, on pace to equal 2017's staggering 1,579 breaches."/>

In addition to data breaches, data exposures — when data is improperly defended and open for access on the internet — are on the rise. Instead of a malevolent hacker getting through a protected system, a data exposure occurs if a database isn't correctly configured or doesn't require appropriate authentication. In 2018, Exactis, for example, exposed [340 million records](https://www.wired.com/story/exactis-database-leak-340-million-records/), putting 2 terabytes of personal information at risk.

You don't have to be as large as T-Mobile to take powerful steps to secure your company. [Small businesses](https://www.godaddy.com/garage/online-security-advice-small-business/), for example, can still implement multi-factor authentication and improve their password practices. Taking steps to secure your customer data — whatever your size — will help you avoid becoming an easy target for hackers.

## Bolster Your Security in Order to Scale

Data breaches and exposures can quickly erode customer and investor trust — particularly at critical times in a business's lifecycle. For example, T-Mobile is currently in [a $26 billion merger agreement](https://www.zdnet.com/article/t-mobile-and-sprint-to-merge-finally-strutting-5g-clout/) with Sprint. The deal, which has already been subject to regulatory scrutiny, could face even more hurdles if parties see T-Mobile's lack of updated security practices as a liability.

On the flip side, if you strengthen your defenses and clearly communicate your progress, you have a better chance of emerging from any issues with your reputation intact.

Make sure you are on top of the latest security practices and protocol to avoid worst-case scenarios that could obstruct progress.



3 Critical Lessons from the T-Mobile Data Breach

No two apps are identical, and so no two user onboarding processes should look the same. However, there are universal lessons to help you onboard new users.



Everyone knows that retained customers are more valuable than acquired ones. With mobile apps especially, where only 2.3% of customers remain after 30 days, your loyal customers are the most important thing to your business.

There are many theories about why customers churn so quickly in their early days, some believe downloading is so easy it’s basically noncommittal, while others believe that competition between apps drives users to switch frequently.

The less-discussed and more obvious reason is this: Most apps suck at onboarding new users.

<include src="TweetQuote" quoteText="Most apps suck at onboarding new users."/>

It doesn’t matter how much long term value your app provides, and it doesn’t matter how many customers your marketing strategy brings on, if you can’t get users from day 1  to day 30 without losing their business, your business has no chance.

With this in mind, we compiled the seven most important lessons for onboarding new users.

## 1. Real World Use-Cases Are All Your Users Care About

The goal of onboarding is to show your users how to get value out of your product. While it can be tempting to explain the technicals of your product, the various features you spent hours developing, this doesn’t help users find value. You need to show them the direct benefits your product gives them, and how to use your product to achieve them.

A great example of focusing onboarding around real life use-cases is Spring, the mobile shopping app that recently raised [$25 million](http://fortune.com/2015/04/16/spring-raises-25-million/) off of a $90 million valuation. As a shopping app, Spring doesn’t have the most complicated UI: You scroll through and click what you want. But through clever onboarding, they show users the particular, real-life value Spring gives:


![Spring Onboarding](https://images.ctfassets.net/23aumh6u8s0i/6PRzXMfhMISEpiuoJDqkku/996503dcd13b27c2ef3ca2dfae6435b5/spring-onboarding)

Spring’s onboarding could detail the behavioral analytics behind their recommendation engine, or the infrastructure behind their daily updates, but instead they focus on how users actually get value from their app.

### Key takeaway:

Always focus your onboarding process on showing users how your app makes their lives better. If they can’t see a direct connection between the problems they face and the solutions your app provides, everything else is irrelevant. Your app's technical specs, development innovations, and success metrics should all take a backseat to the actual benefits it provides your users.

## 2. Your Product Itself Is Your Best Onboarding Tool

Your onboarding process should educate users by making them use your app. Think about the video games you played as a child (or last night). The early levels always introduced the basic building blocks of gameplay, before asking you to put it all together in harder levels later on.

Your onboarding process should operate along these same lines. You want to get users engaged in your app, and slowly introduce more complexity. You want them to learn your app by actually using it.

A great example of this sort of onboarding is Quartz, a news app that gives users the news through a texting format. Their onboarding looks like this:

![Quartz User Onboarding](https://images.ctfassets.net/23aumh6u8s0i/5fB2Q7TYviwEmAVx4VERnv/1db7cb5b10f3149bcffdc791ec2ce05b/quartz-onboarding)

Just by using the app, users are seamlessly onboarded.

### Key takeaway:

The best way to learn an app is to use it. Reading articles on how an app works gives you some cursory knowledge, but doesn’t come close to the familiarity you develop by actually exploring it.

## 3. Personalization Is The Fastest Route To Your “Aha!” Moment

Your “Aha!” moment is the point in onboarding when users finally “get” your product’s value. One of the fastest ways to do this is to tailor their onboarding experience to their personal information, by using social authentication.

Think about social apps like Instagram, that onboard users by connecting them with friends from other social networks. When users log into Instagram for the first time, and immediately see the photos of their best friends, they quickly internalize the value of the platform.

With Auth0’s social authentication, you can pull any information stored on their social accounts (friends, location, birthday, etc.). In your “Connections > Social” dashboard, you can pick which social platforms to support just by toggling a switch:

![Socual Connections](https://images.ctfassets.net/23aumh6u8s0i/4VGoq2xRks7Yvvek1XcWAk/c4bacedff3f6dd5114ee2c3669a54538/social-connections)

### Key takeaway:

The whole point of onboarding is to teach users how to get value from your app. Make it easier for them to relate the process to their own life by building it around their personal information, which easily attained via Auth0’s social connections. With Auth0, you can easily integrate information from over [30 social platforms](https://auth0.com/docs/identityproviders) by clicking a button.

## 4. Successful Onboarding Takes A Human Touch

Every startup knows the importance of automation. It’s how you service 10,000 customers with a team of 20. It is for this reason that so many companies onboard users just by using their documentation. It scales well, but it takes away any personal connection. This doesn’t have to be a trade-off.

Kristen Craft, director of business development for [Wistia](http://wistia.com/), a video platform for businesses, [explains that with video](http://wistia.com/blog/video-familiarity) “You can express the full range of human emotions, explain things in great clarity, and generally appeal to the viewer's humanity.”

The benefit to this, in her words, is that “One video can speak to thousands of customers.”

<include src="TweetQuote" quoteText="One video can speak to thousands of customers."/>

Wistia’s own onboarding process reflects this. Instead of just giving you a series of articles to read, they give you this 5-minute video at the beginning of the [onboarding process](https://wistia.com/community/posts/jaio/are-you-using-video-in-your-new-user-onboarding):

![Wistia Onboarding](https://images.ctfassets.net/23aumh6u8s0i/7a6pJrsvwuWPdlqaP40wqb/53c1bfc116416a11b09b9c51bccd3bcb/wistia-onboarding)

Users have someone personally walk them through the product, and it scales to any size.

### Key takeaway:

The idea that you must sacrifice personal interaction for automation and scalability is a false dilemma. By including video instruction in your onboarding, you can scale human connection infinitely. Using video also allows you to demonstrate how your product works, condensing a ton of information into a relatively short period of time without overwhelming your users.

## 5. Users Need You To Meet Them Halfway With Targeted Email

Just because a user is in the onboarding process, it doesn’t mean you’ve locked down their business. According to a study by Oracle, within the first 90 days of the customer lifecycle is when they are [most likely to churn](http://conversionxl.com/onboarding-emails/). The best way to get out in front of this problem is with targeted email.

Auth0’s [Segment rule](https://auth0.com/docs/monitoring/sending-events-to-segmentio) allows you to segment your email list according to whether a user is logging in, or has just signed up. It's as easy as copy + pasting a block of code:

```js
function (user, context, callback) {
  if (context.protocol === 'delegation') {
    return callback(null, user, context);
  }

  const request = require('request');

  if (context.stats.loginsCount > 1) {
    sendEvent('Logged in');
  } else {
    sendEvent('Signed up');
  }

  function sendEvent(e) {
    const sioTrack = {
      userId: user.user_id,
      event: e,
      properties: {
        application: context.clientName
      },
      context: {
        ip: context.request.ip,
        userAgent: context.request.userAgent
      }
    };

    // Segment API returns 200 OK for all its request. For possible errors
    // you must use Segment's Debugger (https://segment.com/docs/libraries/http/#errors)
    request({
      method: 'POST',
      url: 'https://api.segment.io/v1/track',
      headers: {
        'Content-type' : 'application/json',
        'Authorization': 'Basic ' + Buffer.from(configuration.SEGMENTIO_WRITE_KEY + ':').toString('base64')
      },
      body: JSON.stringify(sioTrack),
    });
  }

  callback(null, user, context);
}
```

From within the Segment dashboard, you can toggle on the [Customer.io](http://customer.io/) integration to leverage Customer.io’s email automation. Engaging customers at the beginning of user onboarding will boost retention without you spending any extra time.

### Key takeaway:

Personal engagement early in the useronboarding process lets users know you are invested in them, and increases the chances they’ll stick around. With targeted email automation, you can do this affordably and at scale. You can even take things a step farther and create a [custom rule](https://auth0.com/docs/rules) to target users based on more specific attributes, like recent activity or personal information.

## 6. Decision Fatigue Is The User Onboarding Killer

Asking users to make too many decisions early in the onboarding process will mentally exhaust them, until they’re not interested in your service anymore. This tiring process, called “decision fatigue” is the reason judges grant [65% ](http://healthland.time.com/2011/04/14/when-lunch-is-served-so-is-justice/)more convicts parole in the morning, when they’re fresh, than in the evening, when they’re exhausted.

With your app, you have to strike a balance between collecting necessary information and wearing your users out. The key to this is to figure out what the most essential information you need to collect is, and to ask for it incrementally. The app that is perhaps the best at this is Duolingo:

![Duoling User Onboarding](https://images.ctfassets.net/23aumh6u8s0i/2atrcN3janLc19z3yrv7Kk/831f832214de10ce8d264756e3dd6ed8/duolingo-onboarding)

After you click to sign up, these are the first three screens you see. You make three decisions, and you are all set up to start learning a new language with a complete plan.

This gradual collection of information is called [progressive profiling](https://auth0.com/blog/2016/04/18/progressive-profiling/). With Auth0, you can easily implement it with our [Users API](https://auth0.com/docs/api/v2#!/Users/patch_users_by_id). The API collects user metadata in a “bucket” conveniently called “user_metadata” which you can update at any time throughout the customer’s lifecycle.

![Progressive Profiling](https://images.ctfassets.net/23aumh6u8s0i/35hTUTdyiyzxsKjMoBVKdm/3131c86834139591e46b16df5911be21/progressive-profiling)

### Key takeaway:

If you force users to make too many decisions up front, you will mentally exhaust them. That tiredness will translate into inactivity. Avoid this by collecting information progressively, on an as-needed basis. Not only will this boost retention, but it will improve the quality of the data you collect, as users are less likely to hurry through and submit fake data if they’re only filling out a couple forms.

## 7. The Door Must Be Left Open For Users To Come Back

In an ideal world, building an user onboarding process would be a streamlined affair:

1. Identify what customer behaviors lead to retention
2. Build a process that encourages those behaviors and educates users
3. Sit back and enjoy your diminished churn rate

The reality is that no matter how well designed your process is, you can’t completely stop users from leaving during your user onboarding process. People get busy, life gets disrupted, and they bail on your onboarding process midway through.

The trick is this: They haven’t churned. In many of these cases, they’ll be coming back eventually, and you want to make sure when they do they aren’t completely lost. Your user onboarding process doesn’t just have to make it easy for new users to learn your product, it has to let returning users relearn your product quickly.

The way to do that is by centralizing your information somewhere users can easily reference. [Close.io](http://blog.close.io/), a sales CRM, does this with their “Getting Started” email:


![Close.io Getting Started](https://images.ctfassets.net/23aumh6u8s0i/dLeBJfdODzj0z5Tt2Xzja/6b5d78352eeae5112fc4fafd6ad7cc46/closeio-getting-started-emails)

Instead of making returning users restart the whole onboarding process, they give them a map to the various resources they might need to brush up on.

### Key takeaway

Users are going to go away and come back. If you don’t make it easy for them to transition back into using your app, you’re making it easy for them to walk away entirely. Store your onboarding information in a format that allows returning users to go straight to the parts they don’t remember, and doesn’t force them to re-study the parts they already know.


7 Crucial Lessons That Will Save Your User Onboarding

27396b3fa24389198ef5d3e7e410e9c4?size=60 avatar

27396b3fa24389198ef5d3e7e410e9c4?size=60

Former Auth0 Employee

Ricky Rauch

Our lessons in defining a cohesive design language <br /> across all our products.



For the past year, Auth0 has been growing at a fast pace and, naturally, so has the number of fronts that the Design Team has had to tackle.

In this post, we’ll explain what we've learned as we’ve implemented practices that help integrate design into our products, guarantee consistency, and optimize design choices.

![Auth0 design process](https://images.ctfassets.net/23aumh6u8s0i/5ekkYcvh13pEbE8iA9JwTi/105d9aae129b931385c61c0bf06f77fd/process)

## 1. Blueprints

The first practice we introduced was design from blueprints. A blueprint is just a monochrome draft of the final product, with as little focus on styling as possible.

![Design process blueprints](https://images.ctfassets.net/23aumh6u8s0i/5FuxxzraFKWNJlOWpEqNu8/7460f5608279a68310127f6904fe4263/blueprint)

We go through a lot of feedback from different company stakeholders, including engineers, marketers, analytics, and our own clients. By taking subjective factors like color and embellishment out of the process, blueprints help us get better feedback and achieve simpler solutions in a shorter length of time.

## 2. Frontend

### Asset production

We constantly review previous work when producing new assets to check for consistency and understand how they have evolved over time so we don’t repeat mistakes.

Our website is mapped out on a 1:1 scale with design files and is available to the whole team on Dropbox.

![Design process Dropbox usage](https://images.ctfassets.net/23aumh6u8s0i/1zAKxMtgDA21IoRLFBPvr9/c24b3209362d5ef65412e6f4fa91ddbd/dropbox)

Using Sketch has dramatically improved the way we create and export assets. We think it’s the best tool for the job because it was designed with the Web in mind.

### Mobile first

Most of the HTML and CSS at Auth0 it handled or refactored by a designer at some point. We’ve set [clear guidelines](https://github.com/auth0/code-conventions/blob/master/frontend/README.md) for front-end code, and we’ve chosen [Stylus](https://learnboost.github.io/stylus/) and [Jade](http://jade-lang.com/) to optimize our productivity. As a result, we write concise, clear code much faster.

Over the past year, we have started to migrate all of our pages as part of a mobile-first strategy.

The rationale behind this strategy starts with the design perspective: we set out to present only information that we can make available in a way that works on any device. This simplifies our approach to information architecture by getting rid of unnecessary elements and solving problems in the simplest way, which also reduces the potential for errors during development.

![Design process mobile first approach](https://images.ctfassets.net/23aumh6u8s0i/5g9IkjRDtYNOx42VQ8tdDj/cc277baee7dc60539557f462a3007177/mobile-first)

To maintain stability, we are making these changes progressively. Each page that gets a redesign gets a mobile-first refactor to go with it.

A key factor in preventing Responsive Design from getting messy was abstracting all of our media queries to a [Stylus mixin](https://github.com/auth0/styleguide/blob/master/lib/mixins/index.styl#L11) and keeping them as close as possible to their relevant selectors, making them harder to overlook and easier to maintain.

```css
.hero-cta
  color: blue;
  border-radius: 3px;
  padding: 10px 20px;
  max-width: 100%;

  +breakpoint("tablet")
    max-width: 620px;
    font-size: 18px;

  +breakpoint("desktop")
    max-width: 740px;
    font-size: 20px;
```
### Styleguide for consistency

Styleguide is one of our most important projects. Its aim is to help maintain the same look and feel across all of our products and to make our front-end code reusable, no matter the specifics of any project's codebase.

<a href="https://styleguide.auth0.com"><img src="https://images.ctfassets.net/23aumh6u8s0i/6MeGqjQoXZ6tRtmbTvBMEr/99c0ae67861c3baf3ad871b6bb4d095a/styleguide" class="expand" /></a>

Styleguide holds values, patterns, and specific components that repeat across pages, enabling designers and engineers quickly to reuse them on any product without worrying about markup or CSS.

![Design process consistency](https://images.ctfassets.net/23aumh6u8s0i/4sd8BnI6idcPWNOqsbZbGD/be684bd6cc03a3a2845bad9e670b4ff5/consistency)

- Elements like our [header](https://github.com/auth0/web-header), footer, and other components are easily maintained on different projects by sourcing them directly from [Styleguide](https://styleguide.auth0.com).

- By reducing complex html structures and patterns to Jade mixins available through [Styleguide](https://styleguide.auth0.com) and passing only content as parameters, we optimize development time.

![Design process icons](https://images.ctfassets.net/23aumh6u8s0i/4o7gHKzr7lrNkTwymz8Wh6/0c05df02c1c3ed39e6ce8bf653f003ab/icons)

- Company [colors](https://styleguide.auth0.com/#colors), [typography](https://styleguide.auth0.com/#typography), and [icons](https://styleguide.auth0.com/#icons) are kept consistent by using the same set of variables and files for every project.

- We use [semantic versioning](http://semver.org/) to enforce certain versions of Styleguide across projects. This helps maintain stability in our sites when we're doing heavy updates.

Today, we can include Styleguide using [Bower](http://bower.io/) or [Component](http://component.github.io/) or by linking [directly from the CDN](https://cdn.auth0.com/styleguide/latest/index.css).

If you are interested, [check the live version](https://styleguide.auth0.com) or [view the code on Github](https://github.com/auth0/styleguide).

## 3. Publish

### Deep testing

Once we reach the final step in producing a deliverable, we start a rough path of tests by using Heroku or Github pages as staging deployments. The whole point of this task is to have a last ride before publishing to the open when there is no take-back of the first impression statement.

Some of the things we review here:

Mobile rendering and response times on different real devices, browsers, and networks’ SEO optimizations (title on each page, description, sitemap…) and social sharing media elements like OpenGraph and Twitter Cards.

This method has always preceded the finest look and feel, in our experience.

![Design process cards](https://images.ctfassets.net/23aumh6u8s0i/6nqS5hbMqY2DJYVSHoBxq2/ddbb8f6d08b4fb9d91da159b8c793c45/cards)


And we’ll keep improving our test process to deliver no less than the best.

## Design meetings

Though we’re still a small group, there are already different kinds of designers on the team, some more adept in usability or visual design and some more focused on prototyping and code.

<blockquote class="instagram-media" data-instgrm-captioned data-instgrm-version="4" style=" background:#FFF; border:0; border-radius:3px; box-shadow:0 0 1px 0 rgba(0,0,0,0.5),0 1px 10px 0 rgba(0,0,0,0.15); margin: 1px; max-width:658px; padding:0; width:99.375%; width:-webkit-calc(100% - 2px); width:calc(100% - 2px);"><div style="padding:8px;"> <div style=" background:#F8F8F8; line-height:0; margin-top:40px; padding:50% 0; text-align:center; width:100%;"> <div style=" background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACwAAAAsCAMAAAApWqozAAAAGFBMVEUiIiI9PT0eHh4gIB4hIBkcHBwcHBwcHBydr+JQAAAACHRSTlMABA4YHyQsM5jtaMwAAADfSURBVDjL7ZVBEgMhCAQBAf//42xcNbpAqakcM0ftUmFAAIBE81IqBJdS3lS6zs3bIpB9WED3YYXFPmHRfT8sgyrCP1x8uEUxLMzNWElFOYCV6mHWWwMzdPEKHlhLw7NWJqkHc4uIZphavDzA2JPzUDsBZziNae2S6owH8xPmX8G7zzgKEOPUoYHvGz1TBCxMkd3kwNVbU0gKHkx+iZILf77IofhrY1nYFnB/lQPb79drWOyJVa/DAvg9B/rLB4cC+Nqgdz/TvBbBnr6GBReqn/nRmDgaQEej7WhonozjF+Y2I/fZou/qAAAAAElFTkSuQmCC); display:block; height:44px; margin:0 auto -44px; position:relative; top:-22px; width:44px;"></div></div> <p style=" margin:8px 0 0 0; padding:0 4px;"> <a href="https://instagram.com/p/2HXZopiTi7/" style=" color:#000; font-family:Arial,sans-serif; font-size:14px; font-style:normal; font-weight:normal; line-height:17px; text-decoration:none; word-wrap:break-word;" target="_top">Design Meeting @auth0</a></p> <p style=" color:#c9c8cd; font-family:Arial,sans-serif; font-size:14px; line-height:17px; margin-bottom:0; margin-top:8px; overflow:hidden; padding:8px 0 7px; text-align:center; text-overflow:ellipsis; white-space:nowrap;">A photo posted by Ricardo Rauch (@rickyrauch) on <time style=" font-family:Arial,sans-serif; font-size:14px; line-height:17px;" datetime="2015-04-30T22:01:28+00:00">Apr 30, 2015 at 3:01pm PDT</time></p></div></blockquote>
<script async defer src="//platform.instagram.com/en_US/embeds.js"></script>

We have established weekly design meetings as a simple “show and tell” exercise to feed off each other's work and be in the loop of what’s been going on during the week with other projects. This adds a big-picture perspective to all the work that's been done and complements daily feedback by showing the whole team the impact of design on our products.

![Design process sites](https://images.ctfassets.net/23aumh6u8s0i/n1DUnXF6UJuQEcWCVuE6H/5a471cd69e9cb94ad6f12041187e28ae/sites)

We’re always looking for ways to improve and optimize our process. We hope that some of our practices can prove useful for anyone interested in collaborating on product design, and if you have suggestions or thoughts, we’d be glad to hear them.

Finally, processes are nothing without a great team. I am humbled to work every day with these amazing people: [Victor Fernandez](http://twitter.com/vctrfrnndz), [Benjamin Flores](https://twitter.com/beneliflo_), and [Nicolás Garro](https://twitter.com/evilrabbit_)

If this sparked some interest, [we are hiring](https://auth0.com/careers).


"lessons"