1Vitor de Sousa_Auth0

As Regional Vice President, Vitor de Sousa supports Okta and Auth0's German customers in achieving their Identity and Access Management goals. With more than 20 years of experience in the consumer goods industry, as well as in technology and software sales, he develops strategically smart and creative solutions for the interplay of identity authentication, customer experience, and data protection.

Regional Vice President, Enterprise Sales - Germany

Vitor de Sousa

The pandemic accelerated digitization initiatives, a robust CIAM solution can assist in an iterative migration to the cloud

In the DACH region, trust is everything, and one of the first places you can build consumer trust is your login experience. German consumers say their main frustrations with signing up to a new app or online service are having to fill in long login or sign-up forms (42%) and entering private information (38%), followed by having to create a password that has to meet certain requirements (33%), and a new ID and password for every app or online service (31%). These statistics come from a [global research study](https://info.auth0.com/erwartungen-und-realitat.html) conducted by Auth0 and YouGov, including more than 2,000 consumers and 200 IT/marketing decision-makers in Germany.

One of the challenges organizations encounter when looking to launch new services or feature sets is the fact that many of these features are cloud-based while existing services that could benefit from integration are often legacy and hosted on-premises. Finding an [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider who can link those legacy systems and modern cloud-first platforms is an important step towards creating a future-proof service. However, many organizations in the DACH region are still building their own identity solutions. Or they’re misusing tools designed for managing employee identities for customer-facing needs. Both of these scenarios can introduce additional pain points when it comes to joining legacy and modern systems.

## Digitization Projects Are Resource Intensive

IT departments have spent the better part of the last 18 months establishing work-from-home protocols, migrating critical systems to the cloud for better access, and ensuring that everyone’s data stays safe and secure throughout the transition. Despite the acceleration in these digitization projects brought on by the COVID-19 pandemic, many of these systems have to remain housed on legacy on-prem servers due to a lack of alternatives. Bridging the gap between these and the convenient cloud-based tools your customers need access to is a large undertaking, especially for IT teams that are already stretched thin supporting ongoing internal needs.

Your IT and development teams support the organization’s goals by creating and maintaining the best web applications for your customers and by keeping your infrastructure running smoothly. That way, everyone, both inside and outside of the company, has the best experience possible. Partnering with an IDaaS provider like Auth0 will free those teams to continue focusing on their primary goals by taking the task of user authentication off their hands — and putting it in the hands of identity experts. This ensures your users get the CX they’ve come to expect while you maintain control over your data and privacy.

## Legacy Workforce Identity Solutions Are Not Built To Face External Threats

The workforce [Identity and Access Management (IAM)](https://auth0.com/blog/what-is-iam/) tool you’re using today may look like an attractive option for your customer-facing needs. There are several problems with this idea, starting with the simple fact that IAM solutions are not focused on user experience (UX). Their priority is security, keeping your company’s intellectual property safe and secure from bad actors. 

The threats facing customer applications can be vastly different in type and scale. Workforce IAM verifies employee identity in order to approve access to just the tools they need to do their job effectively, from primarily company-owned devices. [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/#:~:text=Auth0%20Docs&text=Customer%20Identity%20and%20Access%20Management,%2C%20customer%20experience%2C%20and%20analytics.) solutions, on the other hand, need to integrate protection against brute force attacks, password spraying attacks, along with other outside attack vectors. And they need to do that while maintaining identity verification across potentially millions of end-user devices and networks. Additional hurdles exist as well; for example, many IAM tools are on-prem only and unable to protect your new cloud-first infrastructure. 

## Growing Demand From Consumers for a Low-Friction Customer Experience

The acceleration and growth of online tools have increased consumer expectations for a safe and simple identity experience. They’re no longer willing to wait for slow pages to load or to endure lengthy and complex account creation flows. Your customers demand-responsive, intuitive design, or they’ll take their business elsewhere. In fact, 78% of German consumers say they have [abandoned an app or online service](https://info.auth0.com/erwartungen-und-realitat.html) due to an arduous login experience.

Addressing the systemic issues that need attention to keep up with this demand will put additional stress on your internal teams, pulling their attention away from those core goals we discussed above. You don’t need to sacrifice your user experience in order to create a user-friendly and trusted authentication experience. Auth0 provides a secure platform with a variety of cloud deployment options, including [private cloud deployments on Microsoft Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) or AWS infrastructure, and public cloud options using AWS facilities in multiple regions, including Frankfurt. Built by and for development teams, Auth0 is easily customizable to create exactly the low-friction experience your customers demand without sacrificing security and extensibility.

## Auth0 Lets You Find the Right Mix of Security, Privacy, and CX

We’ve discussed three pain points organizations in the DACH region are likely to encounter when looking to deploy a new identity and authentication solution across both legacy and cloud-based systems. The Auth0 Identity Platform has a robust feature set designed to address these challenges and any others you may encounter as you embark on your own identity project.

### Extensibility allows you to quickly adapt your digitization project

Auth0’s founders wrote the book on identity management at Microsoft while helping development teams remove barriers to building applications in the cloud. The Auth0 Identity Platform is designed with developers in mind, with multiple [extensibility](https://auth0.com/extensibility) points that allow you to configure the exact authentication flows you want.

### Exhaustive integrations mean you can bridge the legacy/cloud gap easily and iteratively

No matter what systems you have housed on-prem or on legacy infrastructure and what you have already migrated to the cloud, our [Application Programming Interfaces (APIs)](https://auth0.com/docs/api) and [Software Development Kit (SDK) libraries](https://auth0.com/docs/libraries) mean, you can use one CIAM solution to bridge the gap. That allows you the flexibility to continue your deployment iteratively, knowing that your customer experience won’t suffer any negative impacts as you migrate more services to the cloud on your own schedule.

We’re able to integrate with most existing cloud-based SaaS services via our APIs and SDKs but can also integrate with your on-premise environments as long as they’re accessible via API or otherwise. We are also up to date with the [General Data Protection Regulation (GDPR)](https://auth0.com/docs/compliance/gdpr) enacted by the European Union in 2018, so we can help and support our customers in meeting their compliance requirements.

Additionally, [Auth0 Marketplace](https://marketplace.auth0.com/) and [Actions](https://auth0.com/actions) provide access to a wide array of out-of-the-box integrations with most line-of-business software and services. That means you can quickly connect your CMS and ERP to your new web app, and your users won’t see any change in their experience as it’s serverless, so there won’t be any interruption to your services.

### No-, low-, and pro-code options for creating a low-friction user experience

Between the pre-configured integrations in [Auth0 Marketplace](https://marketplace.auth0.com/) and our low-code [Actions](https://auth0.com/actions) capability, your development team can easily customize Auth0 to meet your customers’ expectations for a secure and low-friction authentication experience. For even more control, we still offer pro-code customization, as always, via our JavaScript editor.

The ability to have all your identity needs up and running quickly means your team can focus on serving their primary functions. Your developers can continue delivering top-quality experiences for your customers, and IT support can maintain your internal employees’ work environment, no matter where they’re working from.

## Partnering With Auth0 Ensures a Secure, Customizable CIAM Experience

You can rely on the identity professionals at Auth0 to help:

* focus your development team on innovation
* deliver the identity experience consumers have come to expect
* protect customer data with a deployment option that works for your business

That’s how you deliver an excellent user experience without compromising security or privacy along the way. Read more about our [compliance and certifications](https://auth0.com/docs/compliance), then [reach out to an identity expert](https://auth0.com/contact-us) to continue the conversation about how partnering with Auth0 can help your organization. 




Bridging Legacy Systems and Digital Transformation with CIAM

RichardSchwabacher

Richard brings an extensive track record developing digital strategies, best-in-class products, services, and personalized solutions that offer superior digital consumer and physician experiences as BioReference’s Senior Vice President, Digital Health and Chief Digital Officer. He is adept in building high-performing teams and leading colleagues through a shared purpose and vision, and creating customer empowerment through human-centered design, technology, innovation and digital solutions.

SVP for Digital Health and Chief Digital Officer

Richard Schwabacher

BioReference Laboratories SVP for Digital Health and Chief Digital Officer Richard Schwabacher on how the pandemic will make virtual health the default

_ EDITOR’S NOTE: During a recent case study interview, Senior Vice President, Digital Health and Chief Digital Officer, BioReference Laboratories, Inc., an OPKO Health company, [Richard Schwabacher](https://www.linkedin.com/in/rschwabacher/) said that responding to COVID-19 has accelerated trends in the digital health by 7-10 years. We asked Schwabacher, a veteran of Pfizer and Quest Diagnostics who had left diagnostics only to return due to COVID, to expand on his perspective in this guest author post. ([Learn](https://auth0.com/case-studies/bioreference/) how BioReference used Auth0 to quickly scale to meet pandemic requirements.)_

There has not been an event that has impacted humanity as intensely as COVID-19. It has exacted a heavy toll, and it is clear that we will be confronting the effects for years to come. 

In terms of digital health, we already see COVID-19 accelerating trends that were thought to be a decade or more away. Trends like telemedicine and remote patient monitoring, to name just a few, were just starting to take hold when the pandemic hit and are now experiencing rapid adoption. 

Responding to COVID-19 has created a moment when patients, physicians, and insurers are more open to new ways of thinking and working. What this means for the future of healthcare is not just exciting but potentially profound.

## FinTech as a Proxy for HealthTech

Today, most of us bank from our smartphones. This is, in part, because the financial services industry has done a relatively good job balancing customer experience and data protection within their digital solutions. FinTech companies that focused on micro journeys within the space, like peer-to-peer exchanges, led to consolidation in the sector as large institutions clamored for ways to attract new customers and delight their existing customers through thoughtful digital experiences. 

Take Zelle’s peer-to-peer payment technology. Zelle, now integrated into several of the traditional banking institutions, focused on simple peer-to-peer transactions. They appealed to a segment of the [population increasing in value to the banks as customers and offered a treasure trove of data on consumer behavior](https://www.paymentsjournal.com/peer-to-peer-payment-apps-are-diversifying/). Although peer-to-peer [can be prone to additional risk](https://www.wfmynews2.com/article/news/local/2-wants-to-know/what-you-dont-know-about-cash-apps-like-venmo-zelle-cash-app-consumer-reports-says-apps-dont-work-like-a-bank-there-are-no-protections/83-4157e228-c6f0-484c-b239-23119a44f3f5), the big banks incorporated Zelle into their user interface, knowing that customers would seek out this functionality and might leave their old bank behind. It’s a degree of personalization that is aligned with customers’ needs. The fear of a devaluating customer, or worse, one who's about to leave, is a powerful incentive for innovation. As consumers, there’s virtually nothing stopping a consumer from trying or switching banks entirely if not satisfied. We can do that with relative ease and without asking permission. We can just make the change frictionless. 

Not the case when it comes to healthcare. Don’t like your insurance company? Not so easy to jump ship. If you receive your health insurance from your employer, like most Americans, you’ll have to wait for annual open enrollment to make a change. And even then, you’ll have only a handful to choose from.

## Experience Will Shape Future Digital Health Solutions

We have become conditioned as consumers to expect all experiences to generally be the same, often judging an experience against those that immediately preceded it, especially a personalized experience. When it comes to healthcare, personalization is difficult. Pre-COVID, the patient experience would weave from analog (i.e., in-person experience) to digital (i.e., telehealth) and back, all the while attempting to silo data and protect privacy. The protection and safe transportation of data in healthcare is an industry in and of itself. The patient, or consumer’s, expectation is that when they show up at a healthcare institution, that experience is going to be consistent with what they get at their bank, and they are frustrated when it’s not. [Healthcare accounted for 17.7% of the gross domestic product (GDP)](https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-Reports/NationalHealthExpendData/NHE-Fact-Sheet) in the U.S. in 2019, and given the amount of interaction behind that large a number, we’re seeing a high degree of general dissatisfaction within healthcare. When so many of us are interacting with a sector that’s antiquated and unable to keep pace with consumer expectations, dissatisfaction is expected.

Pre-COVID, the solution to personalizing experiences was to create healthcare institutions that are oriented horizontally so that experience would be tailored to patient circumstances. For example, if you were receiving treatment for cancer, the cancer center's physical layout would be orchestrated literally around a patient’s journey. 

As digital experience continued to grow in other sectors, patient’s expectations seemed to outpace healthcare experiences. After all, there’s only so much that a building layout can accomplish when you’re still working off a clipboard every step of the way. Patients began to expect their medical records would simply travel with them. For the patient, this might mean a combination of an analog and digital experience that might not feel seamless due to the rigor required to protect sensitive data.

## Post-COVID Norms

The shift we see from analog to primarily digital experiences is driving three main trends: the decentralization of healthcare, improving physician acceptance of telehealth, and where I think we’re headed; virtual care will become the default.

* **Decentralization of healthcare:** One of the important and immediate impacts of COVID was an attempt to keep most patients that didn’t need to be in a healthcare setting at home for care. This change started with the most at-risk patients for [COVID co-morbidities](https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/people-with-medical-conditions.html). 
If you have chronic kidney disease, going into a healthcare facility puts you at a higher risk, even if you’re taking all the precautions. But assuming greater risk by having the patient physically enter a facility is not just about protecting the individual patient. 
With the pressures of COVID, hospitals are trying to manage available ICU beds. For a small hospital operating at a typical capacity, two to four additional ICU patients mean they go from having an ICU, that’s at 40- to 50%-full to 90%-full pretty quickly. By keeping high-risk patients at home, they not only protect those more vulnerable to COVID they also can focus limited resources on those who need it most. 
Adoption typically follows payment structures and incentives. In November, the U.S. government released new reimbursement schedules for asthma patients, another at-risk group, to receive in-home treatment. That probably would have happened at some point. The trend line was there, but pre-COVID, it certainly wasn’t at the degree that it is now. 

* **Physician’s more receptive to telehealth:** Having a human in front of you is very different from observing them via a computer screen. In person, physicians notice things and investigate and interrogate them in a way that can lead to a diagnosis. There’s nothing that will ever replace that level of care, which is one of the reasons many physicians were reluctant to shift to a primarily virtual model. 
Most physicians tend to follow the practices learned during medical school. We have a large physician population that didn’t learn how to diagnose via an electronic tablet. For them, this may feel like a hindrance. However, doctors who came through medical school more recently were more likely to use electronic tablets during their much more receptive. Again, the trend lines for telehealth there, but COVID has forced acceleration. 

* **Virtual care will become the default:** Patients typically aren’t willing to pay for care that isn’t covered by insurance, and many virtual care services weren’t reimbursable. These virtual services are now seeing insurance coverage. Alongside payment, we are also seeing massive investment in the telehealth model. 
In the first three quarters of 2020, $1.6 billion was [invested in telemedicine](https://rockhealth.com/reports/q3-2020-digital-health-funding-already-sets-a-new-annual-record/)—more than twice what was invested in all of 2019. 
Based on this investment and the behavioral changes amongst patients, physicians, and insurers, I think we’ll see virtual care increasingly become able to perform primary care visits. Hopefully, this will increase both the access to care and the frequency in which it occurs. 
Now that people are more comfortable with a secure video conferencing experience, we may start to see connected devices like an Apple Watch or other bracelets feeding data to the physician’s computer or tablet. This allows the patient and the physician to have more of a shared experience while providing the opportunity for the data to aggregate because it’s being collected for a specific reason within the bounds of privacy regulations. 

These accelerating trends also underscore the need to address the Digital Divide, the noted difference between those that have access to and can afford Wi-Fi, computers, and smartphones, and those that don’t. Data has a tremendous opportunity to increase understanding, but only if we are able to provide access.

## Connecting the Dots Is Key

A major concern among patients and physicians is how to secure all this new information, and data is collected and aggregated for patient care. There’s never enough that you can do to protect personal health data, but there are important tools that can be put in place — like identity verification — that can help. 

The truly transformative unlock will occur when data transportability connects important behavioral and clinical dots to form a horizontal view. Think if all of the actors in any particular set of clinical settings could actively manage and engage with patient data. 

The CDC and other health organizations formally recognize that “[how we live, work and play affects a wide range of risks and outcomes](https://www.cdc.gov/socialdeterminants/index.htm).” The ability to connect disparate data is an incredibly powerful tool to understand the progression of social determinants of health. This is why there are entire healthcare verticals spending so much time trying to figure out how to connect the dots. If you can connect the dots, outcomes should become more positive. 

The global pandemic has made it easier for policymakers to see the clear connections between things like housing, food insecurity, and COVID outcomes. Many are hopeful that this will continue to drive social determinant conversations that could have substantial impacts. The key to this will be the successful protection of health data and patient identity. 

## What This Acceleration Means for Diagnostics

It doesn’t matter where you are in this world; you’ve been impacted in some way, shape, or form by COVID-19. Directly or indirectly, diagnostic testing is at the core of being able to manage what’s happening in the world and understand it. Healthcare diagnostics is like the zeros and the ones that create the binary code of healthcare.

<include src="TweetQuote" quoteText="Humanity’s collective understanding of the value of diagnostics has never been higher than it is right now." />

When you consider the number of people that have been tested for COVID-19 around the globe, it is incredible. And for every person that’s been tested in the United States, they probably created a patient portal account with whoever performed their COVID analysis. This means that not only these patients see their COVID-19 test results, but likely every other test that that institution performed for them previously is now in front of the patient. That’s millions and millions of patients interacting with their diagnostics data directly.

The conversations that are happening with healthcare providers, municipality leaders, and companies offer the possibility of lasting change because they’re not stopping at COVID-19 testing. They’re asking questions that go beyond it. I came back to this industry because I do believe in all of the trends that we’re talking about are going to lead to a significant shift. 

I’m fortunate to have the opportunity to work with a team of like-minded individuals who are approaching these problems, knowing that technology, digital in particular, is going to help us solve them. And, for my colleagues and me, this is exciting, but it also comes with responsibility because we understand the opportunity that we have, and we want to make sure to make the most of it.

COVID-19: The Great Digital Health Accelerator

adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

How biometrics are facing the pandemic and the world after

Biometric authentication has long been a polarizing subject: some see it as the key to a frictionless and secure future, while others imagine a dystopian nightmare. The coronavirus pandemic has brought this conversation to the fore as governments and corporations explore how to use biometrics as a way to track disease, even amid fears that traditional forms of biometric authentication may be disease vectors.

Below, we’ll discuss the potential and the pitfalls of biometrics, as well as how they are likely to evolve once the pandemic has passed.

## Contact-Based Biometrics Suffer

Before the coronavirus, entering a building by pressing your fingerprint into a scanner seemed futuristic. But these days, the notion of hundreds of people touching the same scanner seems like it belongs to the pre-pandemic past.

This shift has rocked the biometric world, and a [recent report from ABI Research predicts](https://www.abiresearch.com/press/covid-19-pandemic-pummels-biometrics-market-causing-device-revenues-drop-us2-billion-while-forcing-investment-surge-ai-face-recognition-applications/) that the biometric device market will lose $2 billion in 2020 due to the pandemic. This loss is coming chiefly from contact-based biometrics used in public settings, like fingerprint and palm readers used to access buildings. The [NYPD has halted](https://findbiometrics.com/biometrics-news-nypd-hq-ceases-use-fingerprint-authentication-slow-coronavirus-031107/) its fingerprint security procedures for officers, [New York City municipal workers](https://nypost.com/2020/03/14/nyc-municipal-workers-dont-want-to-touch-hand-scanners-to-clock-in/) have pressured employers like the MTA to stop using fingerprint-scanning time clocks, and [_CSO Online_](https://www.csoonline.com/article/3535194/new-coronavirus-era-surveillance-and-biometric-systems-pose-logistical-privacy-problems.html) reports that condo associations are dropping their biometric building-entry procedures.

But this damage to contact-based biometrics is not universal. ABI Research has clarified that fingerprint sensors for personal devices like smartphones and laptops will feel less of an effect from coronavirus, since those scanners are typically used by only one person.

<include src="TweetQuote" quoteText="Would you still touch a fingerprint scanner? Sr. Director of Governance, Risk, and Compliance Adam Nunn on how the pandemic is re-shaping biometric authentication."/>

If you’re a business considering using contact-based biometrics as a form of authentication, deciding whether or not to move forward is all about context. If you want users to be able to use the fingerprint scanner on their smartphone for [multi-factor authentication](https://auth0.com/learn/multifactor-authentication-customers/), you may not need to change your plans. But any form of biometric authentication that requires multiple people to touch the same surface may be a public health concern in the post-pandemic world.

## Using Contactless Biometrics to Fight the Pandemic

Contactless biometrics such as facial recognition and touch-free fingerprint scanners have come into prominence because of their ability to identify virus carriers and assist in contact tracing.

Biometric digital IDs may have a role to play in administering the (hoped for) coronavirus vaccine, especially for people with no other form of identification. [According to the Center for Global Development Senior Fellow Prashant Yadav](https://www.biometricupdate.com/202004/biometrics-could-help-identify-those-with-antibodies-and-needing-vaccines-as-coronavirus-lockdowns-lift), “The initial COVID-19 vaccine supply will be limited, so it will be essential to verify each dose reaches a real patient. Corruption, leakage, and even accidental duplication waste precious supply and are deadly,” he said. “Biometric digital IDs can be a gamechanger,” he added. “They can help governments target population segments e.g. healthcare professionals or elderly populations, verify people who have received vaccination, and have a clear record.”

Facial recognition technologies are also undergoing a dramatic evolution during the pandemic, with [multiple companies](https://www.csoonline.com/article/3535194/new-coronavirus-era-surveillance-and-biometric-systems-pose-logistical-privacy-problems.html) touting software that can identify people even when they’re wearing masks. This could have major public-health benefits, such as the ability to quickly identify people and move them through security without packing them together in confined spaces, such as airports.

Even before the virus, China was in the midst of an aggressive rollout of [facial-recognition cameras](https://www.npr.org/2019/12/16/788597818/how-china-is-using-facial-recognition-technology) in public settings. China is now coupling that technology with infrared temperature scanning, allowing the government to identify and track individuals with COVID-19 symptoms. For instance, [public buses in Guangzhou](https://asia.nikkei.com/Business/China-tech/Coronavirus-gives-China-more-reason-to-employ-biometric-tech) are now being equipped with tablets that take passengers’ photos and temperatures, a step that is mandatory. Supporters of such measures argue that they have been instrumental in containing the spread of the virus.

## The Privacy Pitfalls of Biometrics

In a world still searching for ways to identify carriers of coronavirus and let healthy people get back to their lives, biometrics may be part of the solution. However, this type of data collection also raises a host of privacy concerns, including the troubling specter of biometrics being employed as a tool for authoritarian governments to quash dissent.

We’ve already seen the potential for data misuse during this pandemic, even without biometrics. In South Korea, the government has publicly shared updates on the activities of patients by using a combination of interviews, video surveillance, phone location tracking, and credit card transactions. The result has been a spate of online harassment, not just of suspected carriers but of people whose data caught them in a lie or an act of infidelity. [The BBC reports](https://www.bbc.com/news/world-asia-51733145) that in a survey of 1,000 South Koreans, researchers found that people were more afraid of the stigma associated with infection than of the virus itself.

Concerns over government overreach, unscrupulous corporations, or snooping neighbors mean that data collection efforts are likely to meet with resistance. A [poll by the Jean-Jaurès Foundation](https://www.telegraph.co.uk/news/2020/04/12/french-public-hostile-proposed-covid-19-contact-tracing-app/) found that over half of French people (53%) would refuse to download the proposed “StopCovid app” over privacy concerns.

## The Post-Pandemic Future of Biometrics

Without a doubt, the coronavirus has altered the balance between an individual’s right to privacy and the public’s right to safety. Now, governments and businesses must carefully consider what the “new normal” version of that balance will look like and what role biometric identification will play.

When it comes to government use of biometric data, it’s crucial to have a public dialogue about the level of surveillance citizens should tolerate once the crisis has passed. Toby Norman, CEO of Simprints, a UK-based biometric nonprofit, [addressed those concerns to Reuters](https://uk.reuters.com/article/health-coronavirus-tech/biometric-ids-can-be-gamechanger-in-coronavirus-antibody-tests-vaccine-idUKL8N2BV0BI): “National governments don’t have a very good record of giving up new powers once a crisis has passed. Technology we use for disease surveillance today should not become tools for state surveillance at a later date.”

In many countries, there are laws already on the books, which should act as safeguards against biometric abuse. For instance, many U.S. states, such as Illinois, have [biometric privacy regulation laws](http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57), which require consumers to consent to their biometric data being collected. This would rule out things like temperature scans on city streets but might still allow for voluntary participation in airport security.

<include src="TweetQuote" quoteText="What’s the post-pandemic future of biometric authentication? Sr. Director of Governance, Risk, and Compliance Adam Nunn takes a look at COVID-19’s current and potential impact."/>

In the EU, the [European Data Protection Board](https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032020-processing-data-concerning-health-purpose_en) (EDPB) has issued guidelines for app developers for using health data to combat coronavirus without violating the GDPR. The guidelines state that “data and technology used to help fight COVID-19 should be used to empower, rather than to control, stigmatise, or repress individuals.”

For companies that are interested in using biometrics to keep their workplaces safe, it’s vital to acknowledge and address privacy concerns. Implement transparent policies regarding how you plan to use biometric data, who will be able to access it, and how long it will be kept.

## Balancing Collective Safety With Individual Rights

Like most technology, biometrics are only as good or as evil as how we choose to use them. For many people, the thought of paying for lunch by smiling into a facial-recognition screen suddenly seems much more comfortable than making physical contact with a card reader. Likewise, a temperature scanner that knows you’re running a fever before you do may have broad appeal in office buildings and public transportation. But most people would be uneasy with an app that records your vital signs without your consent and then texts the information to everyone on your block.

The difference between biometrics as a public health boon and as a privacy nightmare is evolving, and the only way to make sure we wind up on the right side of that line is through continuous conversation with experts and the public at large. At Auth0, we will continue to explore biometric authentication by adhering to our core principles of security and transparency. To discuss how these precepts can play into your biometric strategy, please [reach out to our team](https://auth0.com/contact-us?place=blog%20post&type=link&text=reach%20out%20to%20our%20team).

<include src="asides/AboutAuth0" />

Biometrics and Coronavirus: Balancing Promise With Privacy

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Insights from giving our business continuity plan a COVID-19-induced update

What are the critical things your company needs to keep its doors open? 

Many companies have a Business Continuity Plan (BCP) in place that covers loss of facilities during things like floods and earthquakes, but it's primarily the really big companies (or those who provide critical services for health care) who’ve done more than download a pandemic plan template off the internet and call it good.

[Only 62% of 500 U.S. companies surveyed](https://www.techrepublic.com/article/business-continuity-plans-and-tech-are-lacking-during-the-coronavirus-pandemic/) by SaaS-based accounts payable vendor _AvidXchange_ at the beginning of March had business continuity plans – nearly half of those said they covered contingencies for only two to three weeks – and 10% have no plan at all. At Auth0, we’ve had a BCP in place for years, but [COVID-19](https://auth0.com/blog/business-continuity-at-auth0-our-response-to-covid-19/) prompted an immediate review. The process proved both necessary and revealing. And because we believe it can help other companies, we’re sharing our approach here.

## Ask Yourselves How Do You ‘Degrade Gracefully’?

The first time I heard of a Pandemic Plan was during the [Bird Flu Outbreak](https://en.wikipedia.org/wiki/Avian_influenza) in 1997, while working for the main security company. A large pharmaceutical company was a major vendor, so they required a plan. Unlike our current situation with COVID-19, the plan remained largely theoretical. That’s not the case now. Even if you have a theoretical pandemic response plan, now is the time to make it real. What are you actually going to do?

In computer science, if hardware or a network has been partially destroyed or rendered inoperative, there’s a limited function necessary to keep it going. That process of how the machine or system shuts down is called “graceful degradation.” So, in a pandemic where your people could be out due to illness or permanently gone, you can apply the same question to your business: How do you degrade gracefully? 

This is not what anyone wants to think about. What if half my staff is sick or permanently gone? But it is much easier to think about it now than when you’re in the middle of it rather than when it’s too late to remediate. Think about it now and you will be doing your future self a big favor. Your future self will be so thankful that your past self documented all these things and you don’t have to think about it while you’re worried about your team. You can just follow the plan that you’ve made.

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/6eWOAZSW8CT2gSGUHYWjix/af815dc9c1ab6e6e4b4036099e423c9b/plan_sep1)

## How to Create a Pandemic Business Continuity Plan
You’re going to start by assessing the most critical functions that need to continue to happen for you to remain in business. Or the way I’ve been thinking about it: what is the absolutely last thing that gets shut off? Then you’re going to work backward. What are the things that are required to make sure that thing keeps working? What are the dependencies?

In our case, maintaining service for our existing customers is our most critical function. (Yes, it’s going to be important to add new customers, but if we’re just talking about the absolute most critical function, that’s it.)

In order to keep our service running for existing customers, we need to continue to pay AWS and the employees who are directly responsible for keeping it running. So for us, that would be the very last thing to go before the end of the world when we put all the chairs on the table, lock the doors, and head for the hills. 

If you’re a consulting company, you’d end up in a different critical place. You need to keep shipping deliverables to your clients. The ability to email or transfer files would be a critical function. The key is to go to the end of the world, find the most critical business process, and then work back. 

At Auth0, we worked ourselves backward to an absolute worst-case scenario where our staff numbers became more and more constrained, taking us from our global staff of 660 to just 10% remaining and created a plan where we could continue serving our customers. You should review your specific needs to understand your minimum number of employees for critical functions.

### Defining ‘Mission-Critical’ Functions
This process isn’t going to be easy for everyone, but it is an opportunity to think about the bigger picture. This is an opportunity to think about what’s best for the whole company and your customers. Try and set any ego aside. It’s not an insult if your department is not a business-critical function. Just because something isn’t “mission-critical” doesn’t mean it’s something the company will stop doing even in a pandemic. 

As CSO, I know that my team's ability to monitor and respond to security incidents is by definition a mission-critical role even in a pandemic. But, I also know that if we're really down to 10% of staff across the company, I'm going to take whatever resources I have to help keep our core service running for our customers. That's how the BCP helps me, my team, and my peers prioritize. In a sense, even as CSO, I know my place in this chain.

Since creating a BCP plan can bring a lot of different priorities and perspectives into conflict across the company, our entire executive leadership team worked closely to define a set of business-critical priorities for their teams to work from when fleshing out the remainder of the BCP update. 

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/N21EflGpHem6FVAnIRzNa/9596f571f0021f037ab387287aac831a/plan_sep2)

Because human beings have egos and there may be disagreement about what your most essential business processes are, this is an exercise that the most senior level of leadership should do and agree on. It should not be up to the C-level to put the plan together, but it is their responsibility to have a unified voice because these are business-critical functions. We broke our functions into four categories:

* **Mission-Critical:** Loss of these functions would result in wide-spread loss of reputation, damage to the business, as well as potential damage to the general public.
* **Business Essential:** Loss of these functions would make it difficult, but not impossible to continue the business. Things like generating revenue, customers, following compliance regulations, and maintaining our external help desk fall under this category for Auth0.
* **Business Core:** Loss of these functions would have an indirect revenue impact. In the COVID-era that includes not attending conferences, which impacts both leads and indirectly, customer satisfaction.
* **Business Supporting:** These functions impact employees, not employee productivity. Auth0 examples include employee reviews, our internal help desk, and business support functions.

As things fail, how do we work from the bottom of the list to protect our mission-critical functions? 

If half of your people could be out at any given time and only two people know how to do a given thing that’s critical, that’s not enough.

Here are three questions to ask:

* What are the tools necessary for each business function?
* Who are the people who know-how and are authorized to perform that function?
* Is the process documented with screengrabs so that a smart person could figure out how to make it happen?

### The Hard-Drive Tolerance Approach to Cross-Training
There isn’t great guidance on how many people are needed for cross-training. If all your finance people are in Seattle and everyone in Seattle gets sick, well, that’s not going to work. So I based our approach on hard drive tolerance.

For a hard drive to be considered fault-tolerant, typically the data is backed up in five copies in different places. That’s what we’re doing with people — five people who understand how to perform the process and have access to simple documentation but aren’t all in the same place. As a globally-distributed company, multiple locations are an easily achieved standard for us. If you’re not able to rely on geographic distance, you might want to cross-train additional staff.

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/6pUwP72d4UnvgotPIDO5YP/954716e2549c226b4994e733066131fe/plan_sep3)

## Update 2x a Year, More in Crisis
We took five working days to review our plan and put this streamlined approach in place. Compared to other pandemic plans I’ve seen, ours is super-actionable — the kind of thing that leaders can actually lean on to help them make decisions.

Essentially it’s:

* A stack rank of priorities by team
* Documented instructions
* A Confluence page with who does what, down to five levels of people and their status
* And the instructions to print it out and store it

We are going to keep an eye on our plan and update it quite regularly through the evolution of this pandemic, likely on a monthly basis. Once we’re through the pandemic, we’ll dial that back to twice a year.

## Your Plan Will Make You Stronger
Your plan doesn’t have to take weeks. As I mentioned, we got our review done in five working days. Even if you’re starting with no plan at all, the effort is worth it for what you’ll gain. You’ll discover things you didn’t realize about your business like:

* Departments you didn’t realize were critical.
* Areas where you are under-staffed.
* Processes that need to be documented.
* People who need to be cross-trained.


Your teams will gain:

* A clearer understanding of how they function AND how they relate to the company’s overall mission.
* Likely every department will have an “aha” moment by going through this process.
* Clear direction on communication AND actions.
* Relief that they won’t have to make it up as they go along.

Like the 40 pounds of pasta I have in my garage, if this all blows over, it will get eaten, it’s not going to go to waste. And going through this process will make you a stronger team even when this situation disappears.

<include src="asides/AboutAuth0" />

"pandemic"