carlos-aguilar

Carlos is a Customer Advocate at Auth0, where he helps guide users and developers to find the right solutions for their needs. He has an eight-year professional background in the SaaS and cybersecurity industries, with extensive experience in customer-facing roles such as account management and customer success management. In his free time, he enjoys hiking and actively seeks out opportunities for outdoor activities and sports.

Customer Advocate

Carlos Aguilar

Ready to scale your app? Learn how to choose between Auth0's Self-Service and Enterprise plans, based on your team's need for speed, autonomy, and predictable pricing.

From Building to Scaling: How to Choose the Right Auth0 Plan

Brian Smith

Group Product Manager

Linda Gong

Linda Gong is a Product Marketing Manager for Orchestration at Okta, where she leads go-to-market strategy for Okta Workflows and Auth0 Extensibility. With a background in demand generations and marketing analytics, she brings a data-driven mindset to messaging, product launches, and driving adoption. When she’s not crafting product narratives, you’ll likely find her hunting down the best local coffee shops or planning her next travel adventure.

Product Marketing Manager

Help enable your systems to respond to user lifecycle changes asynchronously, at scale, and across your entire tech stack.

Imagine knowing the exact moment when a user signs up, updates their profile, or deletes their account—and being able to instantly react to them. With Auth0's new** Event Streams**, now in Early Access, that level of near real-time identity awareness is finally possible!

As a new addition to the [Auth0 Extensibility](https://auth0.com/platform/extensibility) offering, **Event Streams enables developers to subscribe to user lifecycle events—delivered as they happen—via Webhooks or Amazon EventBridge**. Whether it’s syncing data to your CRM, triggering downstream processes, or keeping your user records accurate across platforms, Event Streams makes it easy to stay aligned with user identity changes. 

## The Challenge: Keeping Up with Identity Changes

Understanding user behaviors and ensuring your systems reflect user lifecycle changes is business critical. Each time a user-related event occurs—signing up, changing an email, or unsubscribing from a service—that change often needs to be replicated in your internal systems or used to trigger downstream updates in third-party platforms. Missing or delaying these signals can lead to issues such as out-of-date customer records in CRMs, missed billing updates, delayed onboarding or offboarding, and inaccurate analytics and personalization.

The challenge is that these changes don’t happen in just one way, making it difficult to capture user lifecycle events across every method Auth0 supports. Consider user creation alone, which can happen through a variety of ways, such as a signup page, the Management API, SCIM, JIT provisioning via Social, or Passwordless connections. As a result, developers often had to build workarounds and accept data latency or gaps in coverage.

## Introducing User Lifecycle Events Delivered via Event Streams

Auth0 Event Streams was built specifically to solve these gaps. Event Streams makes it easier than ever to **discover completed changes in Auth0 as they happen**, in order to **synchronize, correlate, and orchestrate** these changes to your broader technology ecosystem.

![Life Cycle Events](https://images.ctfassets.net/23aumh6u8s0i/23JW2qZlO2H0KwbVs3Vz05/fff7e13f9302ccae6d9dd641c2500d82/new-event-stream.png)

With Event Streams, customers can now subscribe to a set of clear [structured events](https://auth0.com/docs/customize/events/event-types#user-created)—`user.created,` `user.updated`, and `user.deleted`—that are triggered whenever a change to a user occurs in Auth0, regardless of how it was initiated. These Events can be routed to Webhooks or Amazon EventBridge, allowing you to build event-driven workflows around user identity. Whether you need to update your CRM, kick off a billing process, notify an internal system, or sync changes to a data warehouse, Event Streams provides a **reliable** and **scalable** foundation.

Here’s an example of how you can receive the `user.created` event and store it in a database. 

```js
const express = require('express');
const app = express();

// Authorization middleware
app.use((req, res, next) => {
  const token = req.headers["authorization"];
  if (token !== `Bearer ${API_TOKEN}`) {
    return res.status(401).json({ error: "Unauthorized" });
  }
  next();
});

// Webhook endpoint
app.post("/webhook", async (req, res) => {
  console.log("Webhook received:", JSON.stringify(req.body, null, 2));

  const eventData = req.body;
  const { id, type, time, data } = eventData;
  const user = data.object;

  try {
    switch (type) {
      case "user.created":
        await handleUserCreated(user, time);
        break;
      case "user.updated":
        await handleUserUpdated(user, time);
        break;
      case "user.deleted":
        await handleUserDeleted(user, time);
        break;
      default:
        await handleDefaultEvent(id, type, time, data);
    }

    console.log(`Webhook event of type '${type}' committed to the database.`);
    res.sendStatus(204);
  } catch (err) {
    console.error("Error processing webhook:", err);
    res.status(500).json({ error: "Internal server error" });
  }
});

// Specific function for handling the user created event
// In this example we're making sure users are also created in our own database
async function handleUserCreated(user, time) {
  const { user_id, email, name, nickname, created_at, updated_at } = user;

  const query = `
    INSERT INTO users (user_id, email, name, nickname, created_at, updated_at, raw_user, last_event_processed)
    VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
  `;
  const values = [
    user_id,
    email,
    name,
    nickname,
    created_at,
    updated_at,
    user,
    time,
  ];

  try {
    await getPool().query(query, values);
  } catch (err) {
    if (err.code === "23505") {
      console.error(`Duplicate user_id=${user_id}, skipping insert.`);
    } else {
      console.error(`Database error while creating user_id=${user_id}:`, err);
      throw err;
    }
  }
}

```

A key part of this is the event delivery behavior. Event Streams sends events in near real-time—typically within milliseconds or seconds of occurrence. Importantly, it also allows customers to **visualize delivery failures and recover asynchronously**. If an event can’t be delivered, Event Streams will [retry automatically](https://auth0.com/docs/customize/events/event-testing-observability-and-failure-recovery) for a period of time without interrupting the delivery of new events that follow. Customers can monitor the status of these retries and initiate manual retries if needed, without the need to make synchronous API calls to recover.

Event Streams allows customers to:

* **Enhance identity data consistency and system resilience:** Maintain a single source of truth by synchronizing identity updates across connected systems.
* **Improve end-user experience:** Help ensure users have the right access, permissions, and up-to-date cross-channel experiences
* **Increase developer agility:** Faster time-to-market and reduce operational burden

![event-flow](https://images.ctfassets.net/23aumh6u8s0i/2NBMmiVzNXdOoInjIyjTCL/48b3f5b9f51a525a8fad9cb2d59d3453/User_Events.png)

> To learn more, visit the [Auth0 Docs](https://auth0.com/docs/customize/events).

## Getting Started

Watch this demo to see how to use the Auth0 CLI to subscribe to user lifecycle events, deliver them via Webhook, and test the stream by creating a user via the Manage Dashboard or Management API. 

<AmpContent>
<amp-youtube
    data-videoid="Pn6Z1Y4i63g"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/Pn6Z1Y4i63g' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

<AmpContent>

The feature can be configured via [API, CLI](https://auth0.com/docs/customize/events) and front-end through the Auth0 Management Dashboard. In addition, we’re actively enriching Event Streams features to better support user needs, including:

* Upcoming events: organization and session events
* Upcoming event destinations: Auth0 Actions, Azure Grid, and integrations with other developer platforms
* New features to streamline integration and monitoring of Event Streams, such as event delivery metrics, Terraform-based Event Stream provisioning, enhanced event testing tools, etc.

Discover User Lifecycle Changes via Event Streams – Now in Early Access

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

For developers tasked with building global applications, choosing the right authentication solution is crucial. Auth0's ability to bridge the gap between enterprise and consumer needs makes it a standout choice in the crowded authentication landscape.

In today's multi-platform world, identity management isn't a one-size-fits-all solution. As developers, we need an authentication system that not only secures enterprise-level applications (B2B) but also delivers a seamless, user-friendly experience for consumer-facing products (B2C). That's why developers across the world turn to Auth0 when they feel it's time to delegate the task of building and maintaining ***authentication and authorization*** to a vendor with deep security expertise and adaptable technical capabilities. 

## The Challenge of Global Scale

Global companies with multifaceted portfolios face a unique set of challenges:

- **Multiple Platforms:** Users access their services via smartphones, PCs, consoles, and more.

- **Diverse Regulatory Requirements:** Compliance with international data privacy and security regulations is non-negotiable.

- **Customization Needs:** Every organization has its own unique workflows and integration requirements, such as compatibility with legacy authentication systems or [support for protocols like SCIM](https://auth0.com/docs/authenticate/protocols/scim).

For developers building at a global scale, the solution needs to be robust enough to handle high security and regulatory demands while remaining flexible for rapid development and global expansion.

## Why Auth0 Stands Out

Auth0's strength lies in its ability to effectively serve both B2B and B2C needs across geographical regions. Here's what makes it a compelling choice:

### Dual capability

Auth0 is built to handle both enterprise-grade integrations and consumer-friendly interfaces. While many competitors specialize in one or the other, Auth0 offers the best of both worlds.

### Robust security

With advanced features like multi-factor authentication (MFA), threat detection, and continuous monitoring, Auth0 meets stringent global security standards—critical for protecting sensitive user data and adhering to mandatory compliance requirements. Don't let regulation get in the way of expansion.

### Scalability

Whether you're serving thousands or millions of users across different regions, Auth0 scales seamlessly. This is vital for companies that operate in a global marketplace.

### Flexible customization

Auth0 allows extensive customization through robust APIs that support multiple programming languages and frameworks. This flexibility means you can tailor the authentication process to meet your specific needs, ensuring a smooth user experience regardless of the platform. Whether you are building the next top-ranking mobile game, a desktop AI application, or a streaming service, Auth0 has a solution that adapts to the user experience you want to attract, convert, and retain paying customers.

### Comprehensive support
 
Transitioning to a new authentication system can be complex. Auth0's professional services and support ensure that even challenges like regulatory compliance or cloud infrastructure migrations (e.g., AWS) are managed efficiently.

## Auth0 Is Ahead of the Competition

While there are strong contenders in the IDaaS space, they often excel in more niche areas. A competitor may be a strong option for enterprise integrations but may require extra effort to tailor it for consumer-facing applications. Some competitor platforms often focus on streamlined, developer-friendly solutions for either simple consumer apps or internal enterprise tools. However, they might not offer the same depth of customization and B2B/B2C functionality required for complex global environments or operations.

Auth0's proven track record in both B2B and B2C scenarios makes it uniquely suited for organizations that need a versatile, scalable, and secure authentication solution.

## See Auth0 in Action

Seeing is believing. Experience Auth0's power firsthand by diving into our developer resources. There, you can quickly set up secure authentication flows for both business and consumer scenarios.

### Interactive demo
   
Try out [our reference B2B SaaS application](https://saastart.app/) to experience features of multi-tenancy support, user management and access controls, security policies, self-service Single Sign-On configuration, and more out-of-the-box. Follow our [guided walkthrough](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/) to see how easily Auth0 can secure B2B SaaS applications. If you prefer to learn while reading code, check out the [Auth0 B2B SaaS Starter open-source repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

### Step-by-step developer guides

Check out our [detailed developer guides](https://developer.auth0.com/resources/guides) on integrating strong authentication using Auth0 with different frameworks and languages. These guides will show you how to implement everything from simple login pages to role-based access control in Single-Page Applications (SPAs), APIs, and web applications. Once you are done with the basics, explore our [developer labs](https://developer.auth0.com/resources/labs) to learn how to extend your authentication solution to include features such as Single-Sign On (SSO) for end-users using Google, GitHub, or X/Twitter, as well as enhancing your authorization models with Fine-Grained Authorization.

### Code samples

[Clone any of our starter projects](https://developer.auth0.com/resources/code-samples) and see practical examples of how Auth0 streamlines the implementation of authentication and authorization. Experiment with the code, tweak it to suit your needs, and accelerate your development process.

## Conclusion

For developers tasked with building global applications, choosing the right IDaaS solution is crucial. Auth0's ability to bridge the gap between enterprise and consumer needs—coupled with its robust security, scalability, and flexibility—makes it a standout choice in the crowded authentication landscape. 

If you're developing a platform that must meet both B2B and B2C demands on a global scale, Auth0 is definitely worth a closer look. [Global companies like SEGA have chosen Auth0](https://www.okta.com/jp/press-room/press-releases/sega-auth0/) as a comprehensive and compliant yet flexible authentication solution that not only enhances security and user experience but also streamlines development and operational efficiency: by opting for a ready-to-use IDaaS solution rather than maintaining an in-house system, SEGA was able to lower development friction, allowing their teams to focus more on core game development and innovation.

Authentication and Authorization For Developers Who Build at Global Scale

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager

Introducing updated self-service plans and pricing that scale with your company

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>UPDATE:</strong><br> 
  This information was modified on December 11th, 2023. The new plans and feature offerings are now universally available for everyone.<br> 
</div>

We're excited to share with you our updated and revamped plan offerings for Auth0, which powers Okta Customer Identity Cloud.

Effective November 1st, 2023 we launched changes to our plan offerings and pricing structure. Changes listed below:

* **Our free plan now supports up to 7,500 MAUs vs the previous 7,000.**
    * More than 65,000 active tenants enjoy this plan today.
    * Our always-free plan continues to offer social login, DB connection for securely storing identity information, branded login, extensibility and security capabilities (brute force and suspicious IP throttling), and support for 5 regions (US, UK, EU, JP, AUS). 
    * We also recently added [passkeys support](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) to the free plan.
* Our pricing structure has been updated to more predictably scale as you grow:
    * B2C Essentials pricing now starts at $35/Mo for 500 Monthly Active Users (MAUs)
    * B2B Essentials pricing now starts at $150/Mo for 500 MAUs
    * You can now purchase 20,000 MAUs on B2C Essentials with your credit card.
* [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard), a new feature that aggregates usage across all tenants for seamless oversight that includes updated tenant limits with the ability to consolidate tenants.
* The below capabilities that can be added to your plan through our “[Let’s Chat](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales)” form. You will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024:
    * New multi-factor authentication (MFA) add-ons, expanding access to MFA capabilities that were previously only available to enterprise customers.
    * Increased enterprise connection limits on the B2B Professional Plan.
    * We have increased our maximum MAU tier limit on our self-service plans.

> It’s important to note that we are not making changes to any existing plans as a result of this update. However, if you make changes to your subscription, the new plan and pricing structure will be applied.

## Pricing & Payment Updates

We last updated our Essentials and Professional plan pricing in May of 2021. With the above changes the following pricing updates became effective on November 1st, 2023. **Keep in mind, this only applies to new sign ups and any subscription changes.**

* B2C Essentials pricing will now start at $35/Mo for 500 MAU, up from $23/mo for 1,000 MAU. 
* B2B Essentials prices will now start at $150/Mo up from $130/Mo for 500 MAU
* B2C Professional prices will stay the same, starting at $240/Mo for 1,000 MAU
* B2B Professional will now only be available by invoice, via our sales team, rather than credit card. 

The price adjustment on B2C Essentials creates increased transparency and price predictability as your MAUs scale on our platform, reducing the risk of customers who grow from B2C Essentials into higher plans being shocked by a price change. While the scaling rate of B2C Essentials is increasing, we’re committed to enabling customers to stay on their chosen plan for longer by making it possible to remain on a self-service plan when surpassing the previous MAU limit of 10,000.

In addition to the above plans, check out the [Auth0 for Startups program](https://auth0.com/startups), our [Auth0 for Non-Profits](https://auth0.com/nonprofits) offers, as well as our always-free plan.

### Payment options

With the above changes, we are committed and will continue to support customers that want to pay us monthly through their credit cards on plan tiers that previously supported this functionality. We will now also allow customers with a yearly spend over $10,000 to contact our sales team to purchase an annual contract paid via invoice. 

Keep in mind, any new tenants created will be subject to the new pricing structure outlined above.

![Payment options](https://images.ctfassets.net/23aumh6u8s0i/7trs7tiGY0Ea5rQ2GmU0D3/952fb21eac9f2306c58d1a3e1bb4a14a/pricing-02.jpg)

`*` Can only be purchased by contacting our Sales team directly or via the ["Contact Sales"](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) form. Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.<br> 
`**` Previously, each tenant was a separate subscription, so only one tenant of any type was allowed per plan.

## Introducing Auth0 Teams:

We understand at times it’s difficult to manage resource access, keep track of and juggle multiple tenants. Auth0 Teams aggregates usage across all tenants for seamless oversight. The addition of this feature will enable the management of administrators and multiple tenants from a single, centralized location.

### Increased tenant limits

Tenant limits are being increased as part of this update.

These new limits will be displayed on both our [pricing page](https://auth0.com/pricing) and in your tenant’s [subscription settings](https://manage.auth0.com/#/tenant/billing/subscription). 

![Increased tenant limits](https://images.ctfassets.net/23aumh6u8s0i/6c62XnCJPnWmP72v55PIlY/f33f1ad5bf8c52375a25c92f74bd73db/pricing-01.jpg)

**With the launch of Auth0 Teams, you can now link existing tenants together under one account. It’s important to note that:**

* The owner of a team and/or the admin on the tenant are the only individuals that can group tenants.
* Tenants cannot be unlinked without the assistance of Auth0 Customer Support. If you linked a tenant and need to unlink it, please contact Support by submitting a ticket in the [Auth0 Support Center.](https://support.auth0.com/)

> Keep in mind, if you choose to stay on your current plan, you will be allowed a single tenant.

### How is this different than current Auth0 offerings?

As a part of this pricing change, customers will have the opportunity to link multiple tenants to the same subscription. Usage will be aggregated across tenants and will be billed at the subscription level. This allows customers with development and staging tenants to have access to the same features within said tenants, without having to purchase additional subscriptions. Along with these changes, we’re also introducing official tenant limits that align with the positioning of our various offerings. 

### Steps on how to migrate to Auth0 Teams

Information about this process can be [found here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams). If you want to migrate to Auth0 Teams, you must upgrade your plan in your tenant’s[ subscription settings](https://manage.auth0.com/#/tenant/billing/subscription) to have Teams automatically enabled for you.

## Additional Feature Offerings:

### Enterprise MFA Add-ons:

Multi-factor authentication ([MFA](https://auth0.com/docs/secure/multi-factor-authentication)) can block 99.9% of account hacking attacks. So, without being too obvious, implementing MFA within your Identity solution is pretty important. It’s imperative to prevent credential based attacks, and we want to make this easier for our customers to have access to this security feature. And so we’re introducing** Enterprise MFA Lite.**

Auth0 now allows you to use additional MFA capabilities that were previously only available to enterprise customers. Enterprise MFA Lite allows you to add any MFA factor to [Professional Plans](https://auth0.com/pricing) for an additional fee. This includes the support of [SMS](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) and push & voice notifications (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. However, this enhancement will give broader access to additional MFA protocols to support a wider range of use cases. 

### Enterprise Connection Limits:

**[Enterprise Connection](https://auth0.com/docs/authenticate/enterprise-connections)** limits are increasing from three connections to five connections on the B2B Professional Plan. This will allow for more of our SaaS customers to scale better. As a reminder, there is no limit on Okta Enterprise Connections for customers on all of our B2B plans. 

### Monthly Active Users (MAU) Tiers:

We are introducing [Essential](https://auth0.com/pricing) and [Professional](https://auth0.com/pricing) MAU tiers above the previous 7,000 and 10,000 MAU limits on B2B and B2C Plans, respectively. This change will allow you to better evaluate cost as you anticipate scaling on the Auth0 platform. 

Again, if you would like to take advantage of these options, please contact our team by completing this [form](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales). Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.

If you have further questions, please reach out to the [Auth0 Community](https://community.auth0.com/) (free plans) or submit a ticket in the[ Auth0 Support Center](https://support.auth0.com/) (paid plans).

## FAQs

* **Will the free plan still be available after November 1st, 2023?**
    * Yes, the free plan will continue to be available.
* **What’s the benefit of grouping tenants?**
    * All of your tenants can be managed in one place.
    * Entitlements, usage, etc. will be viewed together.
    * Increased security.
* **What is an Auth0 Team?**
    * Provides a single point of visibility and control over your Auth0 resources by providing centralized governance, compliance, and secure collaboration at scale. More information about Auth0 Teams can be found [here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard). 
* **What if my tenants are already grouped?**
    * Nothing changes unless you make changes to your subscription.
    * If you make changes to your current plan, you will need to regroup your tenants since the plan structure differs.
* **What if I have multiple plans?**
    * Tenants will need to be grouped via [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard).
* **What if my company is a development agency (dev shop)?**
    * Contact [Support](https://support.auth0.com/) to request an exemption. 
* **Can I stay on my current plan?**
    * Yes, assuming you are using one tenant and are within your usage limits you can stay on your current plan.
    * We will provide you with at least 90-days notice if we decide to move existing customers that are within their usage limits to the new plan structure.
* **Where can I find the new Terms of Service?**
    * Our updated Terms of Service can be found [here.](https://www.okta.com/auth0-pss-self-service/)
* **I’m on an enterprise plan and I have a self service tenant(s) as well. Do I have to move those to my enterprise plan?**
    * Yes, and it will be more beneficial for you to manage all tenants under a single account that has enterprise capabilities.
* **Can I pay by invoice now rather than credit card?**
    * Yes, for plans above $10,000/year you can sign a contract and pay by invoice rather than by credit card. To take advantage of this, please [contact us](https://auth0.com/contact-us).
* **What happens if I have more than 7 admins?**
    * New plans released on November 1st will only get up to 7 admins.
* **Can I get more than 10K MAUs on a self service plan?**
    * Yes, we now include MAU tiers beyond 10K MAU
* **Which MFA factors can be used with the Enterprise MFA add-on on professional plans?**

* **✅ Included**
    * SMS Notifications
    * Push Notifications
    * Voice Notifications
* **❌ Not Included**
    * WebAuthn with security keys
    * WebAuthn with device biometrics
    * Email Notifications

Pricing Changes for Auth0

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Customer Growth platform [Catalyst](https://catalyst.io/) helps their customers upsell and retain customers with precision. Their product includes tools that empower sales and success teams to analyze customer revenue, churn, and segmentation. Their [Customer-Led Growth](https://catalyst.io/customer-led-growth) (CLG) methodology enables revenue growth by focusing on current customers and embracing retention and expansion. 

<include src="QuoteCard" body="The best way to grow as a company is to take a look at the customers that you already have strong relationships with and expand on those..." name="Corey Finley" title="Engineering Manager" team="" company="Catalyst" />

In our sit-down with the team, [Corey Finley](https://www.linkedin.com/in/corey-finley-1403b165), Engineering Manager, shared more about how putting customer success (CS) at the center of an organization has been important to Catalyst, rather than looking at it as just the handoff in the post-sales cycle. He continued explaining that CS should play a central role in organizations in determining where product direction should go and by giving in-depth feedback on what customers are experiencing. “There’s a missed opportunity if you’re not focusing on the customers you already have.”

## Securing Future Growth Opportunities with Auth0 

Before Auth0, Catalyst had only one login method; utilizing OmniAuth to internally build a Google OAuth connection. As their prospect base grew and they targeted more enterprise-level companies, they encountered some that were not on Google Workspace and could not utilize Google OAuth. Authentication became a blocker in these conversations, and the team needed to take action.

With these new requirements and the need for additional login methods, Corey was tasked with finding a solution that wasn’t resource heavy and that would provide a wide range of options. He found that Auth0 could plug into the library they were already using, acting like a single provider while servicing many providers. 

> “If we could get this tool that will not only fix the Azure login problem but also leave the door open for future [SAML](https://auth0.com/docs/authenticate/protocols/saml/saml-configuration) implementations, then that would be perfect.”

> Corey will be providing more insight into Catalyst’s story and their implementation at [Developer Days 2023](https://developerday.com/), and we hope you’ll join us! Presented in-person and online on May 16, 2023, this event is free to attend. Please register [here](https://developerday.com/register). 

![Why Auth0?](https://images.ctfassets.net/23aumh6u8s0i/NbdrqE1lwkcJYIXb40vlz/72900ad7ccf2ddc065153edbcea03069/Catalyst_Checklist_-1.png)

## Join Catalyst and the Other 1700+ Startups That Benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Corey and the entire Catalyst team. If your organization wants to fine-tune your CLG strategy, schedule a demo [today](https://catalyst.io/lp/request-demo). P.S. Enjoy some excellent [CS memes](https://www.csmemes.io/) curated by the Catalyst team. 

_This profile is the third installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._

Startup Stories: Catalyst

MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

When it comes to SaaS applications, performance matters. Private Cloud SaaS helps you scale the performance of your growing SasS applications.

Performance matters. You know this, of course. Every second of additional latency translates into [lower conversions and tougher customer retention](https://businessmondays.co.uk/tackling-cart-abandonment-with-improved-login-experiences/). It's why you agonize over every individual detail, why your cloud infrastructure vibrates with the well-oiled efficiency of a Formula One engine.

As your business scales, staying fast becomes much harder. Essential SaaS (software-as-a-service) components that worked well when you were a smaller company now struggle to contend with your higher traffic volumes. 

Fortunately, there's an alternative. Private cloud SaaS offers the flexibility of a self-hosted application with none of the downsides. And, for performance-sensitive applications, it offers the boost necessary to deliver an incredible, slick user experience. 


## The Need for Speed 

Virtually every company and public sector organization uses SaaS in some form. Why? It's often the most practical and affordable option. Hiring and training someone to operate and provision a system takes time, money, and resources. With SaaS, the vendor handles long-term maintenance and upgrades. As most use a subscription model, there are no major upfront costs.

Most SaaS applications, by design, are multi-tenant environments. Multiple customers — whether individuals or organizations — share the same computational resources. This model is cheaper but has several trade-offs. Customers have little choice in where the application is deployed. They lose control. They can't make the subtle tweaks that ultimately result in faster, more responsive applications. 

Private cloud SaaS applications are different. They combine the benefits of a SaaS app (low costs, low maintenance, faster time-to-market) with the flexibility and autonomy of a self-hosted application. Customers can choose where, how, and with whom to deploy their application. They are the sole tenants, and they set the rules.

This control helps organizations comply with the ever-increasing number of data residency laws worldwide. But it can also deliver meaningful performance benefits, resulting in more responsive applications and better user experience outcomes.


## Reducing Latency One Millisecond at a Time

Have you ever wondered why Google only shows you ten results for each page? It seems counterintuitive, doesn't it? Google is a search engine. Its job is to show you relevant results for your queries. More is better, surely?

Not necessarily. In 2006, Marissa Mayer, then the company's Vice President of Search, [shared the results of an internal experiment](http://glinden.blogspot.com/2006/11/marissa-mayer-at-web-20.html) at the Web 2.0 Conference. Google asked a select group of users if they wanted to see more results with their queries. Most said yes. 

In response, Google provided random users (not just those in the focus group) with 30 results per page — triple the normal amount. 

What happened next? Frustration. Load times more than doubled for those in the test cohort, soaring from 0.4 seconds to 0.9 seconds. That 0.5-second delay had a measurable effect on user activity and satisfaction. Traffic and revenue from the test group dropped 20%. As Mayer said at the time: "Users really respond to speed." 

How does this relate to private cloud SaaS? Well, there are limits to how far you can optimize an application for speed with efficient coding and generous resourcing alone. 

If your primary application is located in Amsterdam but relies upon a component hosted in Los Angeles, you'll find a measurable delay as packets make their long journey through a network of submarine cables. You add 135ms to your load times – give or take 10ms.

You can't speed this process up. You are constrained by the speed of light. That's fast, but when you are trying to deliver an incredible experience to your customers, it feels like an eternity. 

You have only one solution: bring that component physically closer to your core application. 

The private cloud SaaS model lets you deploy resources in the same continent, country, and even data center. By eliminating performance bottlenecks in your product, your customers will benefit from a faster, more responsive experience. 


## How Private Cloud SaaS Can Help You Scale 

As your business grows, you may feel constrained by the limitations of multi-tenant, public cloud SaaS applications. Many vendors limit the number of requests that can be made per second (RPS) in order to preserve the quality of the service. While most SaaS companies are prepared to oblige larger customers with bespoke plans, this isn't always a given. 

And you cannot always predict when demand will spike. Take lab-testing and diagnostic services provider (and Auth0 customer) [BioReference Labs](https://auth0.com/case-studies/bioreference), for example. BioReference had begun transitioning to a patient-centric model, where customers could access their lab results without going through an intermediary — like their physician. As a result, it invested in Auth0's multi-tenant customer identity and access management (CIAM) platform. 

At the start of the COVID-19 pandemic, demand for its services jumped 25 times. Its monthly active users increased from 8,000 to 148,000. In response, the company migrated its identity infrastructure to a private instance of Auth0's Identity Platform, giving it essential breathing room to meet existing demand and add more customers in the future.

By opting for a private cloud SaaS application, you can provision your environments with the resources necessary to meet existing demand. And you have the flexibility to change your environment as circumstances dictate. 


## Becoming Resilient with Private Cloud SaaS 

Nobody likes downtime. Not your customers, who rely on your product. And certainly not you. 

Performance issues can devastate your bottom line. As load times and instability increase, conversion rates drop. Unfortunately, these problems are often beyond your control. In a multi-tenant SaaS environment, seasonal demand spikes — like those during the holiday shopping season — can result in longer wait times and instability for your customers. 

The private cloud SaaS model can insulate your business from any disruption in the public cloud SaaS application. With control over the environment, you can structure your SaaS infrastructure to be highly resilient, with custom disaster recovery protocols and redundant failover systems. 

You can establish custom backup and restore procedures. Mitigating against data center-level disruption becomes easy. Should the underlying cloud infrastructure fail, you can automatically switch operations to an unaffected environment, keeping downtime to a minimum. And with bespoke update rules, you can deploy patches and new features at a time when your customers are least active. 


## Nimble SaaS, Happy Customers

For most companies, it makes sense to use a multi-tenant public cloud SaaS product. But as your needs increase, you may find it sensible to switch to a dedicated environment. 

Private Cloud SaaS offers the best of both worlds. It requires little maintenance but offers the flexibility of a self-hosted application. You become able to make the choices necessary to deliver a lightning-fast, highly resilient product.

The Auth0 Identity Platform is available in both multi-tenant and private cloud versions. When you opt for a private environment, you get all the benefits of our industry-leading CIAM platform, but with the flexibility to choose how and where it's deployed. To find out how it can benefit your company, reach out to our team.

How Private Cloud SaaS Can Boost Application Performance

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Fine grained authorization-at-scale, available for everyone

[A few months ago](https://auth0.com/blog/auth0-fine-grained-authorization-developer-community-preview-release/) we announced a Developer Preview of Auth0 Fine Grained Authorization (FGA), our upcoming SaaS product to solve authorization-at-scale for developers. Today we’re announcing [OpenFGA](https://openfga.dev/), the open-source engine that powers Auth0 FGA.

OpenFGA is a fast, flexible Fine-Grained Authorization System inspired by [Google's Zanzibar](https://research.google/pubs/pub48190/) paper, and has been designed for reliability and low latency at a high scale. It makes it easy for application developers to model their access control layer, and to add and integrate fine-grained authorization in a way that is consistent across all of their applications. It’s designed, built, and sponsored by Okta/Auth0.

## Why Is Fine-Grained Authorization Important?

Modern applications have evolved in a way that end-users now drive permission management. This makes fine-grained authorization an increasingly critical element in software. For example:

**Collaboration** and **Social** features are things users expect. These features range from the **‘Share’** button where users proactively grant specific permissions to a set of users for a specific resource, to **‘Request Access’** workflows that allow users to reactively grant access on demand. These features are useful both for business-related assets such as documents or project boards, as well as social sharing personal content like photo albums, social media posts, and even IoT devices.

**Security, compliance and privacy** are mandatory problems to solve for any software application from day one, and authorization is a big part of any solution. In fact, the top [2021 OWASP risk is broken access control.](https://owasp.org/Top10/)

Organizations like Airbnb and Carta have built Zanzibar-like systems to solve their authorization needs. We don’t think organizations should have to keep building the same authorization tools, again and again, so we set out to build one version that any developer can use. 

## How Does It Work?

As an example, we’ll use OpenFGA to model a simple expense management system. Imagine expense reports have the following requirements:

* Can be submitted by any employee.
* Can be approved by the submitter’s manager, or by the manager’s manager (or their manager, etc..).
* Can be viewed by the submitter, the approver, and anyone else that got the report shared with them.

To solve this problem in OpenFGA you would define the following authorization model:

```go
// There are reports in the system
type report
 relations
   // Reports have submitters (user who have submitted that report)
  define submitter as self
   // Reports have approvers (users who can approve reports)
   // A report's approvers are the managers of the submitter
   // of that report
  define approver as manager from submitter
   // Reports have viewers (user who can view that report)
   // The users who can view a report are the submitter,
   // the users who can approve it, anyone it has been shared directly with
  define viewer as self or submitter or approver

// There are employees in the system
type employee
 relations
   // Employees have managers, managers are those directly assigned
   // or anyone who's a manager of a manager
  define manager as self or manager from manager
```

The OpenFGA language uses `self` to indicate that the relationship can be assigned.

* Submitters and viewers of a report can be directly assigned.
* Direct managers of an employee can be directly assigned.

Definitions without `self` can not be assigned directly but can be inherited.

In addition to defining an authorization model, OpenFGA requires you to provide the actual data to instantiate these permissions. In this example, we’ll have 4 participants:

* Daniel, who is Sam’s manager
* Matt, who is Daniel’s manager
* Sam, who will submit an expense report
* Peter, who works in the same team as Sam. Sam wants to share the report with him.

You would provide this data by using the [OpenFGA’s Write API](http://openfga.dev/api/service/#/Tuples/Write) and a few “tuples”. 

Some of the tuples will define the direct reports. This data will probably be synchronized automatically from an HR system (e.g. Workday):

```json
{ 
    "user": "employee:daniel",  
    "relation": "manager", 
    "object": "employee:sam" 
}
```

```json
{ 
    "user": "employee:matt",  
    "relation": "manager", 
    "object": "employee:daniel" 
}
```

Whenever Sam submits an expense report (in this example, ‘sam-trip’), the following tuple should be created:

```json
{ 
    "user": "employee:sam",  
    "relation": "submitter", 
    "object": "report:sam-trip" 
}
```

When Sam later shares the report with Peter, the following tuple should be created:

```json
{ 
    "user": "employee:peter",  
    "relation": "viewer", 
    "object": "report:sam-trip" 
}
```

With the above information now in the system, we can now ask OpenFGA if a specific user has a specific relation with a particular object. We do that by using [OpenFGA’s Check API,](https://openfga.dev/api/service#/Tuples/Check) which will return true or false. For example, if we check:

```json
{ 
    "user": "employee:matt",  
    "relation": "approver", 
    "object": "report:sam-trip" 
}
```

OpenFGA will return **TRUE**, as Matt is the manager of Sam’s manager, and Sam is the submitter of the expense report.

You can also use the [‘Expand’ API](https://openfga.dev/api/service#/Relationship%20Queries/Expand) to understand why OpenFGA returns that result. The Auth0 FGA Playground provides a visualization of the results of calling that API:

![OpenFGA](https://images.ctfassets.net/23aumh6u8s0i/1eSifra3BxJLVtV6XtR4xv/58c1a82f8770c9a2555b9632dbc80507/OpenFGA.jpg)

It needs to answer “is `employee:matt` related to `report:sam-trip` as approver”. To do that, OpenFGA:

1. Expands the “approver” relationship for Sam’s report
2. Finds out that the approver needs to be Sam's manager (the report submitter’s manager), and finds out who the managers are <br>
    **a**. Daniel is Sam’s assigned manager, but Daniel is not the one we are looking for <br>
    **b**. Daniel's managers are also Sam's managers, so OpenFGA needs to expand them <br>
3. Expands the “manager” relationship for Daniel <br>
    **a**. Matt is Daniel's manager, which is what we were looking for! <br>
    **b**. Matt's managers would also be Sam's managers, but there's no manager defined for Matt <br>

To summarize, you need to:

* Define a domain-specific authorization model.
* Use the `Write()` API to add relationship tuples.
* Use the `Check()` API to check for permissions.
* Use the `Expand()` API in cases where you need a detailed understanding of the `Check()` results instead of a simple `TRUE` or `FALSE` response

## Why Open Source?

Both Auth0 and Okta maintain a large number of open source projects and use a myriad of open source products internally. This time we are going one step further than usual and open-sourcing a core Auth0 product. We’ll continue to offer [Auth0 FGA](https://fga.dev/) as a SaaS offering, but also strive to build the best open source implementation of a Zanzibar-style authorization system.

We’re doing this for several reasons:

* We believe there’s an opportunity to create a large ecosystem around a fine-grained authorization system, and that making our FGA offering open source will maximize the chances for this to happen. We expect OpenFGA integrations for authorization policies products like [OPA](https://www.openpolicyagent.org/), proxies like [Envoy](https://www.envoyproxy.io/), API gateways like [Kong](https://konghq.com/); identity providers ([Auth0](https://auth0.com/es), [Okta](https://www.okta.com/), [AzureAD](https://azure.microsoft.com/es-es/services/active-directory/)), SDKs for platforms and frameworks (Python, Java, [Spring](https://spring.io/), [Next.js](https://nextjs.org/)), etc. 
* We want to enable customers that require deploying in different cloud providers,  on-premise, in multiple regions, with FedRAMP compliance, or those that have a low tolerance to the risk of delegating authorization to a third party provider. From our experience with Auth0, we know those are difficult problems for a SaaS product.
* The industry will benefit by having a common way to manage Fine Grained Authorization. We believe Auth0/Okta is the company that can make this happen. It’s a leader in the Identity Access Management space, is trusted by thousands of customers, is cloud-agnostic, and has the financial capacity to invest in the product long-term.

## What Are We Open Sourcing?

We are open sourcing the engine that drives our SaaS product, and the SDKs that make it so easy to use. 

You can find all of these projects hosted in an [OpenFGA organization on Github.](https://github.com/openfga)

* [OpenFGA Server](https://github.com/openfga/openfga): the core FGA server which provides:
   * An expressive language to define your authorization model.
   * HTTP APIs for checking and granting permission, authoring models, query tuples.
   * A graph querying implementation inspired by Google Zanzibar
   * Pluggable storage adapters, with support for an in-memory database and PostgreSQL
   * OpenTelemetry tracing, metrics, and structured logging
* [Website and Docs](https://github.com/openfga/openfga.dev): The openfga.dev website, which includes our product documentation.
* [SDK Generator](https://github.com/openfga/sdk-generator): Tooling to generate SDKs based on OpenAPI definitions.
* [Go SDK](https://github.com/openfga/go-sdk), [.NET SDK](https://github.com/openfga/dotnet-sdk), [Javascript SDK](https://github.com/openfga/js-sdk): SDKs for different languages, with more to come soon!
* [Auth0’s FGA Playground](https://play.fga.dev/), which is not open source now but it will be in the following weeks.

## OpenFGA and the Cloud Native Computing Foundation

The Cloud Native Computing Foundation (CNCF) is an open-source software foundation that promotes the adoption of cloud-native computing. It hosts projects like Kubernetes, Envoy, and Open Policy Agent, along with a hundred others.

As we mentioned earlier, we believe there needs to be an open source version of a Zanzibar-inspired Fine Grained Authorization product. Creating such a product requires an initiative that early adopters can trust. To further accelerate this process, **we submitted OpenFGA to the Cloud Native Computing Foundation sandbox**. 

By joining the CNCF, the OpenFGA project will find a larger, vibrant community that will help this initiative to continue growing and attract more users and developers.

## Try It!

An open source project is only as good as its community, so we are extending a warm welcome to everyone that wants to get involved.

You can help by simply trying the product, providing feedback, and engaging with other OpenFGA users in [Discord](https://discord.gg/6xzMMuU8YR) / [Github Discussions](https://github.com/orgs/openfga/discussions), attending our bi-monthly office hours, or [contributing](https://github.com/openfga/.github/blob/main/CONTRIBUTING.md) to the project. 

Find out more by visiting [openfga.dev](https://openfga.dev/), and learn how to use it in our [awesome documentation](http://openfga.dev/docs). Keep up to date with the latest news by following us on [Twitter](https://twitter.com/openfga).

Announcing OpenFGA - Auth0’s Open Source Fine Grained Authorization System

Salman Ladha

As a Product Marketing Manager, I’m responsible for communicating the value of identity for SaaS application builders and our public sector vertical. I’m particularly passionate about the role identity plays in accelerating business growth, promoting product adoption, and establishing trust. Outside of work, you can catch me reading, working out, or watching the latest Marvel movie.

How identity can help startups scale up-market to win bigger deals.

Most (not all) founders at Business-to-Business (B2B) and Software-as-a-Service (SaaS) startups dream of becoming the next industry-defining enterprise application like Salesforce, Slack, or Atlassian.

To have millions of daily active users, billions of dollars in market capitalization, and the comfort of being a staple in the technology stack of another business, is a revered status that [fuels the ambition of hungry startups](https://auth0.com/blog/so-you-want-to-be-a-unicorn/).  

An important step to attaining such scale is the difficult journey of moving upmarket to acquire enterprise customers. From both a go-to-market (GTM) and product perspective, enterprise customers come with their own unique set of [requirements](https://www.enterpriseready.io/), which can overwhelm even the most disciplined teams. As a burgeoning startup, pursuing these opportunities may feel like a double-edged sword.

On the one hand, adding a large, recognizable brand to your customer base would improve your company’s standing in the market. On the other, it would mean diverting most (if not all) development resources towards building capabilities that aren’t central to your business’s core value proposition.

The good news is that business customer identity solutions can help provide startup teams with the necessary tools to incorporate standard enterprise-ready capabilities early on in their product development, thus unlocking future growth. In doing so, identity can support GTM motions without bogging down technical teams in the long run. 


## 670 Billion Reasons to Move Upmarket 

The enterprise market is an attractive space for SaaS companies for one main reason: there’s a lot of money on the table.

Digital transformation continues to change the way businesses operate, particularly related to the adoption of cloud applications. Investments into SaaS products were up [50% in 2020](https://www.blissfully.com/saas-trends/2020-annual-report/) compared to the previous year and showed no signs of slowing down. [According to a Gartner®](https://www.gartner.com/en/newsroom/press-releases/2022-01-18-gartner-forecasts-worldwide-it-spending-to-grow-five-point-1-percent-in-2022) report, worldwide spending on Enterprise Software is projected to reach almost 670 billion dollars this year alone, representing an 11% growth rate. 

For startups, entering this segment of the market not only signals a level of product maturity but also supports long-term, sustainable growth by widening the total addressable market (TAM) of the business and increasing profitability in a few ways. 

First, the average selling price (ASP) for an enterprise customer is typically much larger than others. As an example, let’s consider Shopify, the Canadian E-commerce company that helps businesses sell, ship, and process payments online. Their core platform, geared towards small and medium-sized businesses (SMB), has an upper price point of $299/month. In stark contrast, Shopify Plus, their enterprise offering, is nearly ten times that, starting at $2000/month. This is why enterprise deals can grow revenues from [10 to 30](https://www.saastr.com/why-tilting-just-a-smidge-from-self-service-can-grow-your-revenue-30x/) times the original product’s value depending on the market, product, and offers. 

Secondly, enterprise clients are [less likely to churn](https://www.cmswire.com/analytics/enterprise-saas-churn-rates-whats-acceptable/#:~:text=According%20to%20Lincoln%20Murphy%20of,would%20be%20approximately%200.4%20percent.) from your service. Due to the higher ASP, longer contract lengths, and less price sensitivity, the average churn for enterprise customers can range anywhere from 1% to 5% compared to the 20% - 25% churn seen from their SMB counterparts. 

Finally, adding a recognizable brand to your customer base exerts a form of gravity that other GTM teams can leverage as it signals a degree of credibility for your offering. As an example, look at the customers cited on your favorite SaaS applications home page. You’ll likely find larger, established companies. For what it’s worth, AMD, Pfizer, and American Airlines are just a few of the global brands you’ll find on the Auth0 [home page](https://auth0.com/). 

When you combine all of those factors, the benefit on pipeline generation, top-line revenue, and net dollar retention paint a compelling picture of the financial benefit of moving upmarket. 


## The Challenges of Building for Enterprise 

The natural question is if the enterprise space is so lucrative, why doesn’t every company race towards it like their valuation depends on it? 

Though a SaaS company may demonstrate market viability with its customers in the SMB segment, the needs of the enterprise are significantly more complex, often stressing functionality around user provisioning, administration, and security at scale. They’re inherently risk-averse and rely on well-established patterns to vet the security of the SaaS applications they adopt. Common requirements of doing business with larger customers include: 

* **Single Sign-On —** so that administrators can easily manage user provisioning and de-provisioning via their own IdP while making it simple for employees to access an application. 
* **Multi-Factor Authentication —** to align with security policies and validate the owner of the account is the one actually trying to access the application. 
* **Role-Based Access Control (RBAC) —** so that appropriate levels of user permissions can be granted throughout an application.  
* **Compliance Accreditations —** certifications such as [SOC2](https://auth0.com/blog/soc-2-compliance-and-certification-what-saas-businesses-need-to-know/), [ISO27001](https://auth0.com/blog/what-is-iso-27001-2013-a-guide-for-businesses/), and [PCI](https://auth0.com/blog/what-is-pci-a-business-guide-to-compliance/) DSS that are granted by a third party and assert a professional standard.
* **Data Privacy Compliance —** adherence to privacy laws and regulations such as GDPR, LGPD, APPI, and CCPA. 

It’s not _impossible_ to build these capabilities with developers in-house, but it is challenging and requires subject matter expertise in identity, security, and protocols. 

However, just because developers _can_ build something doesn’t mean they _should_. When it comes to platform capabilities like authentication, startups should weigh their decision against two key criteria:

1. The opportunity cost of doing it yourself 
2. The potential cost of getting it wrong  

B2B buyers have never had more options for the SaaS solutions they adopt. Consider the marketing technology landscape, with over [8,000 products](https://chiefmartec.com/2020/04/marketing-technology-landscape-2020-martech-5000/) that promise some variation of the same value proposition. Building a single sign-on solution from scratch might meet the requirements of the enterprise customer you’re trying to close a deal with, but it also takes away from your team’s ability to work on the core customer problems your technology aims to solve. While you’re bogged down learning the nuances of SAML protocols, competitors can double down on product innovation and focus on delivering differentiated value from your offering. 

Additionally, putting the responsibility of building mission-critical infrastructure onto developers whose core expertise lies outside of security is a risky proposition because the financial and social costs of getting it wrong are severe. Identity is increasingly becoming a target for bad actors. According to Verizon’s 2021 Data Breach Investigations Report, [80% of web application breaches](https://www.verizon.com/business/resources/reports/dbir/) involves using stolen credentials. On average, credential stuffing attacks cost businesses upwards of [4 million dollars](https://www.information-age.com/credential-stuffing-123482099/) a year. Sifting through protocols and leveraging open source code—which has also been shown to have [vulnerabilities](https://www.sonatype.com/resources/white-paper-state-of-the-software-supply-chain-2020)—might feel like an easy option, but it’s highly stressful for internal teams, requires constant attention in the form of maintenance, and if something does go wrong, it can leave your business in tatters. 

## Becoming _Identity_ Ready to Fuel Growth   

Your identity platform should be a crucial tool in your efforts to grow and land larger customers. Auth0’s Business Customer Identity solution is purpose-built for the unique needs of B2B SaaS organizations. With it, customer requirements around Enterprise SSO and Multi-Factor Authentication are available out-of-the-box. Coupled with our high availability cloud services that ensure a [99.99%](https://status.auth0.com/) SLA, you’ll have another great reason for that larger customer to sign on the dotted line.

Development teams can quickly implement Auth0 into your application with well-documented APIs and SDKs. In fact, many of our customers go live in [less than a month](https://auth0.com/case-studies/innit-inc/) and have been able to [shorten their time to market](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas?utm_content=dsa&gclid=Cj0KCQiAosmPBhCPARIsAHOen-NkJJirZcFB7dOkaSL7_S3nBwgTP9G1yZ-pxJ0pK8Eal8ZKRncqI_IaAszlEALw_wcB) for other key product capabilities. 

You’ll also have the peace of mind of having an on-demand, identity security system in place. Secure the data of your business customers by quickly adding protection against some of the most common attacks on identity systems out of the box. From bot attacks to credential stuffing, Auth0 takes the burden of identity security off your internal teams so that they can focus on shipping new features for your product.

Importantly, all of this can be managed programmatically and at scale using Auth0 Organizations, which can help you represent all your business customers in your multi-tenant application.  

If you’re interested in learning how other SaaS businesses used Auth0 to move upmarket and nab larger customers, check out our [Sendoso case study](https://auth0.com/case-studies/sendoso/). 

## Gartner Trademark
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

<include src="asides/AboutAuth0" />

Identity is the First Step Towards Enterprise Readiness

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Secure apps and protect users with enterprise scale account takeover protection

It’s 2022, yet passwords still remain the [most common form of authentication](https://www.idrnd.ai/5-authentication-methods-that-can-prevent-the-next-breach/) online. Like it or not, they are not going away anytime soon. Even if they’re becoming riskier than ever. The very fact that there are so many more applications that users have to register for and log in to makes password reuse across multiple sites even more likely for all but the most security-conscious users. No wonder that the threat of account takeovers (ATOs) [nearly doubled in 2020](https://www.techrepublic.com/article/account-takeover-attacks-spiked-in-2020-kaspersky-says/).

Breaches impact everybody. The average email address is now associated with [130 online accounts](https://www.linkedin.com/pulse/b2b-identity-software-deep-dive-clement-vouillon/?trackingId=C11skBW3qNhNTv25nHkiEQ%3D%3D). Chances are that a significant portion of your users are using the same or similar usernames and passwords as they use on other sites. So when a password gets leaked in a data breach, that same password, or a slight variation thereof, has a high chance of being successful at multiple other online accounts that the user owns. Even if your own site hasn’t been breached, there’s still a good chance that your users' information may be compromised due to a leak that occurred elsewhere. 

![Improve Detection Response](https://images.ctfassets.net/23aumh6u8s0i/KbvD9MBeJw2z9YfGaC2Rv/567a40c8cb1cf8cdf565aa3827030351/Credential-Guard_crop1.jpg)

With [Auth0 Credential Guard](https://www.auth0.com/breached-passwords#credential-guard), you can protect your applications from bad actors logging in with stolen credentials. You can alert the user about their compromised password, challenge the user using an additional factor, or block access by forcing a password reset. Typical breached password detection relies on breach data released to the public. From the time when a breach happens to when it’s announced, there is a gap (typically months) during which your users and business remain at risk. Credential Guard eliminates this gap: a team of dedicated security experts infiltrates criminal communities and gains access to exposed data as soon as breaches occur. With this advantage, you can better protect your users and secure your applications by resetting stolen passwords sooner.

## Improve Detection Response

A typical account takeover attempt is performed using bots that hit login screens that use credentials obtained in data dumps that follow breaches. These indiscriminate attacks account for [90% of ATO attempts](https://spycloud.com/resource/targeted-vs-automated-ato/), yet only inflict 20% of the losses that business incur due to breaches. Targeted attacks, on the other hand, are disproportionately costly, even though they are far fewer in number. These attacks use sophisticated and clandestine methods of obtaining passwords, using these compromised credentials to inflict damage long before there is any traceable record of the breach. Traditional breach detection services that use scanners and scrapers to identify leaked credentials are therefore of no use when it comes to these types of attacks.

Credential Guard counters this threat with a team of security experts that infiltrate the dark web to mine out the exposed information before criminals can monetize it. This unique capability allows us to identify ATO risks months, even years before breach data is made public. Given importance of timeliness in identifying targeted attacks, companies can secure their applications during login by detecting and resetting stolen passwords as soon as breaches happen

![Expand Reach Globally](https://images.ctfassets.net/23aumh6u8s0i/5lO6E741lPvTK11haSvP5Z/1c5d39145aa0fbc1741f624bb50041c9/Credential-Guard_crop2.jpg)

## Expand Reach Globally

Breached passwords are not only a threat to the companies’ applications but also their users. As mentioned above, users reuse passwords across multiple sites, so it’s not just an account that’s at risk but their entire online identity. 

Credential Guard automates the detection and remediation of breached passwords across more than 35 languages and 200+ countries and territories for global account protection.

## Improve Security Posture 

We all have heard ad nauseum about the trade-off between user experience (UX) and security. Human psychology tells us that we make choices based on perceived threat. When a threat goes from being abstract to real, we’re much more likely to take it seriously and adjust our behavior to account for it. The same user that scoffs at stronger authentication methods when there is no perceived risk might enthusiastically sign up for the same measure if the choice is presented at a time when the alternative was to lose control of their account. Companies can alert a user that their password has been leaked in a data breach, and then offer to improve their security posture enrolling in MFA, without risking conversion, impacting UX or retention.

![Secure Your Login Box, Protect Your Users](https://images.ctfassets.net/23aumh6u8s0i/1sJJusx7kMMHjOgw5Bv4zY/c889e692d0bb0be2a2d35a230f0fa4bc/Credential-Guard_crop3.jpg)

## Secure Your Login Box, Protect Your Users

As security enthusiasts, we know that passwords worry both users and app owners alike. Yet they persist, and will likely do so for the foreseeable future. Using Auth0 Credential Guard, companies can stay ahead of criminals trying to exploit breached passwords. It protects companies as well as users’ online identities, which are increasingly bound up with a single, widely used password. While password protection is no silver bullet, making password protection part of a strategy to improve authentication choices, companies can reduce chances of being breached by [up to 89%.](https://www.verizon.com/business/resources/reports/dbir/) 

Learn more about implementing Credential Guard [here](https://auth0.com/docs/secure/attack-protection/breached-password-detection).

<include src="asides/AboutAuth0" />

Detect Breached Passwords Faster with Auth0 Credential Guard

Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
<br><br>
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
<br><br>
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

We are excited to announce the Developer Community Preview for Auth0 Fine Grained Authorization (FGA), our upcoming SaaS to solve authorization-at-scale for developers.

## What Is Fine Grained Authorization?

[Authentication is about who the user is. Authorization is about what they can do.](https://auth0.com/intro-to-iam/authentication-vs-authorization/)

Historically, software applications have, in general, handled [authorization](https://auth0.com/intro-to-iam/what-is-authorization/) in a coarse grained manner. A user has one or more roles in an application, which grants them permissions to perform certain actions across the application. This worked well for a while because users didn't create content in systems. As social and work collaboration applications become mainstream, a different kind of authorization became necessary: fine grained authorization.

An application implements fine grained authorization when it can determine a user's permission to perform actions on any object in the application, and users can create objects in the application and manage permissions to those objects.

This is "fine grained" because there is no lower limit to the granularity at which builders of the system can make authorization decisions. It is up to the builders of the system to determine how granular they want authorization to be, and up to the users of the system to determine who has specific permissions on objects.

## Why Is Fine Grained Authorization Important?

Fine grained authorization is increasingly becoming a critical element in software. For example:

*   **Collaboration and social** features are things users expect, such as the ‘Share’ button you see in so many applications. This applies to both business-related assets, such as documents and project boards, and personal assets like pictures and home IoT devices. Specifically sharing one of these objects with another user is a Fine Grained Authorization use case.
*   **Security, compliance, and privacy** are musts for any software application from day 1, and authorization is a big part of solving those concerns. In fact, the [TOP OWASP 2021 risk is broken access control](https://owasp.org/Top10/).

However, solving authorization in an application is not a trivial matter. We believe applications solve authorization correctly if their authorization solution has the following characteristics:

1.  **Reviewable:** It should be easy to determine "who can access what," essentially understand the rules used to enforce access control.
2.  **Easy to manage change:** Authorization related changes must be explicit and traceable. Change management control for authorization is important.
3.  **Auditable:** It should be possible to know what happened with regards to authorization, in essence "who tried to access what, and when?".
4.  **Reliable:** Authorization decisions are made as part of most flows/requests, so authorization components need to always be running and returning the expected results.
5.  **Fast:** Authorization decisions are made as part of most flows/requests, so they need to be fast. If authorization decisions are slow, then the end-user experience is slow as a whole.

Implementing all of the above is complex, even with expertise. So we looked at how we could solve authorization for our customers, and allow them to focus on their core business. This is what led us to create **Auth0 Fine Grained Authorization.**

## What Is Auth0 Fine Grained Authorization?

Auth0 Fine Grained Authorization (FGA) is a SaaS to solve **fine grained authorization at scale for developers**. It is inspired by [Google Zanzibar](http://zanzibar.academy), the [system Google uses to solve authorization](https://auth0.com/blog/auth0-introduces-zanzibar-academy/) across all their products, such as Google Drive, Youtube, Google Cloud, and others.

Auth0 FGA does not require you to be using Auth0 already. You can use Auth0 FGA with any identity provider: your own user database (e.g. MySQL, PostgreSQL), Auth0, Okta or anything else.

Auth0 FGA centralizes your authorization. It becomes your "authorization (micro)service" if you will. It's a single place for you to define your authorization model, store your authorization data and make your authorization decisions, across all your apps and products.

Centralizing your authorization logic and decisions into a single service that has the flexibility to handle use cases across your different products gives you distinct advantages:

*   **Simplify security auditing:** Explicit authorization rules are easier to audit by internal and external parties.
*   **Lower costs:** Standardizing how authorization is done across your company makes it easier for developers to switch teams.
*   **Deliver faster:** You’ll be able to ship features and products faster, as the system is easily extensible to new requirements.
*   **Security logging:** The Auth0 FGA service generates logs for all operations out-of-the-box, both reads and writes.
*   **Empower your users:** Allow users to take control of granting access to their data directly in your application.
*   **Fast and reliable at scale:** A centralized service dedicated to fine grained authorization should scale as your business and products grow. Since Auth0 FGA specializes in fine grained authorization and nothing else, it can be particularly optimized for access control patterns and use cases, improving the latency and reliability of your authorization approach.

<br>
Auth0 FGA supports granting access at an atomic object level in any system, easily enabling collaboration between users, going far beyond typical role-based access control (RBAC). It also supports building custom roles into any system, empowering your customers to define how to manage access. Auditing capabilities provide fundamental building blocks for security and compliance teams. The more we’ve spoken to customers about it, the more we’ve learned just how many use cases it can solve for.

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/21LaMJQrrDSNHmIEP2oWhO/17fd5e2a825a937590557973d59678b3/Uploaded_from_Auth0_Fine_Grained_Authorization__Developer_Community_Preview_Release)

Organizations like [AirBNB](https://medium.com/airbnb-engineering/himeji-a-scalable-centralized-system-for-authorization-at-airbnb-341664924574) and [Carta](https://medium.com/building-carta/authz-cartas-highly-scalable-permissions-system-782a7f2c840f) have built [Zanzibar-like](https://zanzibar.academy/) systems to solve their authorization needs. We don’t think organizations should build the same authorization tooling, again and again, so we set out to build one version everyone can use. We developed Auth0 FGA as a service so you don't have to.

## How Do I Get Started?

To start using Auth0 FGA you need to do three things:

1.  Define your authorization model ([docs](https://docs.fga.dev/modeling))
2.  Write authorization data from your system to Auth0 FGA ([docs](https://docs.fga.dev/writing-data))
3.  Add authorization to your API by adding access control checks to your system ([docs](https://docs.fga.dev/integration))


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  <b>The Developer Community Preview is meant to help us learn how customers use the product. If you have feedback, reach out on our <a href="https://discord.gg/6jsgXhVBu6">Community Discord</a>.<br> 
</div>

From that point on, all authorization decisions are centralized and made by Auth0 FGA. You can think of it as your "authorization microservice."

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/tROyM1vl5FzzqImS1xjNU/d6a4a8f07e6aca48aed81f4aafadd821/Uploaded_from_Auth0_Fine_Grained_Authorization__Developer_Community_Preview_Release)

### A brief example

Let's say you were to start from a Node.js API to manage projects. That API doesn't have authorization capabilities yet, but it does have authentication.

You have an endpoint that would return a particular project given its project ID. In that endpoint, you might have code like the one from the following snippet. The second line verifies the [JSON Web Token](https://jwt.io/) (JWT) sent as part of the request to perform [authentication](https://auth0.com/intro-to-iam/what-is-authentication/), using [express-jwt](https://www.npmjs.com/package/express-jwt).

```js
app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    // authorize access
    async function(req, res, next) {
        // your business logic
    }
);
```

Now we want to add [authorization](https://auth0.com/docs/authorization) so only users that can **read** a project can call this endpoint.

First, we would install and setup the Auth0 Fine Grained Authorization Node.js SDK. You would need to obtain some data from your Auth0 Fine Grained Authorization account, and follow [these steps](https://docs.fga.dev/integration/getting-your-api-keys) to get it.

```js
const { Auth0FgaApi } = require('@auth0/fga');

const auth0Fga = new Auth0FgaApi({
  environment: AUTH0_FGA_ENVIRONMENT,
  storeId: AUTH0_FGA_STORE_ID,
  clientId: AUTH0_FGA_CLIENT_ID,
  clientSecret: AUTH0_FGA_CLIENT_SECRET,
});

...

app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    function(req, res) {
        // your business logic
    }
);
```


You would then add a new middleware that calls Auth0 Fine Grained Authorization to perform authorization on every request, after authentication has taken place. You know who the user is (authentication), now you want to check what they can do (authorization):

```js
app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    async function(req, res, next) {
        try {
            const result = await auth0Fga.check({
              tuple_key: {
                user: req.user.sub,
                relation: 'read',
                object: `project:${req.params.id}`,
              },
            });

            if (!result || !result.allowed) {
                return res.status(403)
                	.send({ code: 'missing_permissions', message: `ForbiddenError: Not allowed to access object ${req.params.id}` });
            }

            next();
        }  catch (err) {
            // handle error
            return next(err);
        }
    },
    function(req, res) {
        // your business logic
    }
);
```

The key part of the new middleware is this one, where we call the Auth0 Fine Grained Authorization API:

```js
const result = await auth0Fga.check({
  tuple_key: {
    user: req.user.sub,
    relation: "read",
    object: `project:${req.params.id}`,
  },
});
```

We are conceptually asking the question **"can the {user} read project:{id}"?**:

*   The **user** identifier is obtained from the JWT [sub (subject) claim](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.2), as the JWT validation middleware sets all claims for the JWT in the **req.user** object as properties. Whatever your existing authentication method is, you can easily integrate it with Auth0 FGA.
*   The **relation** is "read" because the endpoint is a **GET**, it allows the caller to "**read"** one project. For **PUT** or **PATCH** you would use **"write"**.
*   The **object** is made up of the object type (project) and the project ID. The **object** **ID** comes from the request parameters (the path). A full URL for the request might be GET {API\_URL}/projects/1234, so the **object** would be **project:1234**.

You can learn about **CHECK** requests in depth [here](https://docs.fga.dev/intro/auth0-fga-concepts#what-is-a-check-request).

The previous example is intentionally verbose to show you the inner workings of things. You can imagine having SDKs for any web framework, API Gateway, and even policy languages that easily allow you to configure authorization per endpoint. For example:

```js
app.get('/projects/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    authorize(req => ({
        user: req.user.sub,
        relation: 'read',
        object: `project:${req.params.id}`
    })),
    function(req, res) {
        // your business logic
    }
);
```

## What's in the Developer Community Preview?

The Auth0 FGA Developer Community Preview is completely free and includes the features below. This is a chance for you and your teams to try the product out, assess how you'd integrate it with your apps, and give us your feedback.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  <b>The rate limits in the API are intentionally set low and there are no SLAs, as the Developer Community Preview is meant to help us learn how customers use the product. For additional inquires, please reach out on the <a href="https://discord.gg/6jsgXhVBu6">Community Discord</a>.<br> 
</div>

### Management dashboard

The management dashboard ([https://dashboard.fga.dev/](https://dashboard.fga.dev/)) allows you to create an account and a store. You can use the dashboard to define your authorization model, write authorization data, and perform authorization checks.

![Management dashboard](https://images.ctfassets.net/23aumh6u8s0i/3BFXmCWtMBx8Bqtrrj2sh0/91674dba44c3c779518b3421a2f16df1/02.jpg)

### Documentation

We have written extensive documentation ([https://docs.fga.dev/](https://docs.fga.dev/)) to help you learn the main concepts, get started, and explore advanced use cases.

![Documentation](https://images.ctfassets.net/23aumh6u8s0i/7wFQjqES9oqiEXTYOpshM1/aa3e08e49cdb20a80d6b24b9ca2639b0/01.jpg)

### HTTP API and SDKs

Auth0 FGA is a product built for developers. We’ve created an API for developers to integrate Auth0 FGA into their systems. Everything you can do with the dashboard you can also do with the API.

At launch, we are shipping with SDKs for [Javascript](https://github.com/auth0-lab/fga-js-sdk) and [Golang](https://github.com/auth0-lab/fga-go-sdk). If you'd like an SDK for another language let us know in [Discord](https://discord.gg/6jsgXhVBu6). We can easily generate it from our OpenAPI definitions.

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/5Tdtrh6uySJPvMPsH2ms6/54517d4f5b1749909bce5f32c529a806/03.jpg)

## What's Next?

We are excited about the capabilities that Auth0 FGA will unlock for our customers. We want to make sure our roadmap items are driven by customer feedback and input. So if you’re interested in the product, please let us know your thoughts by joining our Auth0 Lab community [here](https://discord.gg/6jsgXhVBu6).

We are also looking forward to the future, especially the "better together" use cases that Auth0 Fine Grained Authorization will enable for both Auth0 and Okta customers.

We hope you'll join us on this journey and are eager to hear your thoughts on what we’ve built so far.

Take a look, try it out at [https://auth0.com/developers/lab/fine-grained-authorization](https://auth0.com/developers/lab/fine-grained-authorization), and let's learn together!

Auth0 Fine Grained Authorization: Developer Community Preview Release

jameeka_aron

Jameeka has over 20 years of Information Technology and Cyber Security experience. She is a versatile leader, successfully leading teams as both a CISO and CIO across various industries including; Aerospace & Defense, Apparel, Retail, and Manufacturing at both Fortune 100 and privately held companies and many spaces in between. <br>
She is highly skilled in Business Engagement (International and U.S. based) Audit, Compliance, Vulnerability, Risk and Identity Management, Digital Transformation, Mergers, Acquisitions, Divestitures, and leading Cross-Functional and Matrixed teams.

CISO

Jameeka Aaron

The consumer speaks — how readiness to scale wins the security and privacy battle for the customer

If you sped through your digital road map during the pandemic and are looking to fill security and privacy gaps right now, go back and check out my earlier posts:

* [Accelerated Your Road Map? Go Fix Workforce and App Security](https://auth0.com/blog/accelerated-your-road-map-go-fix-workforce-and-app-security)
* [Workforce and App Privacy Have Changed, So Should You](https://auth0.com/blog/workforce-and-app-privacy-have-changed-so-should-you)

<br>
This post is about making the shift from reaction to preparation so that you are ready for the next moment that requires speed – and set up to scale.

## Find Your Balance

In all of these posts, we mention speed and imply pressure. There is always going to be a business reason to get an app to market as quickly as possible. You will discover vulnerabilities that require your immediate attention. And regulations will set deadlines for you. 

So there is always going to be more you could do to improve security for your customers, your business, and the rest of the internet. Even for veteran security professionals, the pandemic was a reminder that we still need to pick and choose priorities. If you have an internal security team, lean into their expertise. Give them the time and space to guide you on priorities. Listen to their assessments of risk and let them set a pace that works for your business.

Longer-term security and privacy improvements can have big payoffs. Like the previous posts, these things require action. You’re also going to need to support your existing security team or create one. By support, I mean backing conversations about risks with budget for tools, external vendors, and hiring internal talent.

If you don’t currently have security or privacy teams, we’ll cover a bit of advice on what to look for as well.

## Consumers Expect and Deserve Strong Security and Privacy

Let’s also set some context.

There was a time when businesses leaned heavily into just shipping the product. Speed often won over security or privacy.

> Consumers are telling us that time is over.

In a [recent global survey](https://www.mckinsey.com/business-functions/risk/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative), McKinsey found that 87% of consumer respondents said security practice concerns would mean they wouldn’t do business with a company, and 71% would stop doing business if it gave away sensitive data without their permission. 

> The more secure and private app is now the one that keeps and attracts customers. 

## Security: Longer-Term Planning

If you’re looking to make a dramatic improvement in your cybersecurity, these best practices will help get you there.

* **Increase pen test frequency.** Penetration testing (pen testing) includes hiring an external vendor to test your application and site for vulnerabilities and provide you with a report cataloged by severity. Many companies do this once a year and call it good. In today’s evolving threat environment, that’s not enough. If you can up your pen testing to every quarter — and take action on what you learn — you’ll see a big increase in security. Adding a pen test after every major operating system upgrade, library update, or major code push will do even more.
* **Improve your software development life cycle (SLDC).** Many shops are still doing security after the product is completely coded, but this creates an automatic security backlog that can not only slow getting your product to market it can put pressure on your execs to allow unnecessary risks into the wild. Involving security and privacy teams as software is being developed allows them to raise questions that influence architecture before burning hours of engineering time. Few people like to put hours and hours into something only to have to take it apart, so your devs are rarely pleased to see this analysis tacked on at the end of the SLDC., which leads me to my next point.
* **Encourage ownership and collaboration between devs and security.** How you introduce the idea of static and dynamic code analysis as well as overall participation of security in the SLDC matters. Explaining that humans are fallible, so all code is going to have vulnerabilities, and there are going to be remote code executions (RCEs) is a good place to start. As a dev, they don’t want RCEs creating headaches, and they don’t want to get paged and work nights because problems have been discovered and exploited. You can encourage ownership by asking your dev team to review the security team handling analyses. Ultimately, this can go a long way towards establishing security-dev collaboration, leading to apps that get to market more securely as well quickly.
* **Create a golden image.** A [golden Image](https://www.cisecurity.org/cis-hardened-images/)is a single machine image that has been tested and hardened. When there is an operating system or library update, the AMI gets updated and tested. This allows you to see how your customers might be impacted before you push that patch update out to thousands of users. It also provides an approved starting point for new business units or apps. The time it takes to create and maintain this image pays off in protected services and reduced downtimes. Using [hardened](https://en.wikipedia.org/wiki/Hardening_(computing)) images also increases reliability and consistency.

## Hiring Security Talent

Security can seem like an area that is purely technical — and your team does need to have a deep understanding of your product and how it works, but sooner or later, a human is going to touch or use your product. Strong security talent needs to understand human behavior from bad actors to customers. Your chief information security officer (CISO) also needs to be able to explain technical risks and benefits to non-technical executive teams.

There’s a cybersecurity talent shortage globally. According to an International Information System Security Certification Consortium (ISC)² [report](https://www.isc2.org/Research/Workforce-Study#), that shortage shrank slightly during the pandemic, from 4 million open jobs in 2019 to 3.1 million. You’re going to need to compete for talent.

Your new CISO also needs to understand your industry because threats are often industry-specific. Here are some questions to ask your hiring team when considering a potential candidate:

* Are they passionate about not only security but also your company?
* Do they have experience in your industry? If not, how adept are they at cross-applying knowledge?
* Areas of expertise? If you need them to be a generalist, do they understand how to source third-party support (and are you willing to fund that support)?
* Do they welcome diversity? 
* Do they contribute to open source security? 
* Do they regularly attend and speak at conferences?
* Can they explain the business case for your product?

## Privacy: Longer-Term Planning

Consumers are demanding a secure and contextual private experience — and we’re seeing regulators back them up with a variety of data privacy regulations.
 
"_By industry, consumers are most comfortable sharing data with providers in healthcare and financial services, though no industry reached a trust rating of 50 percent for data protection,_” notes [McKinsey](https://www.mckinsey.com/business-functions/risk/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative).

This isn’t one of those things that is going away, says Auth0’s Vice President of Privacy Lucy McGrath. Globally, we’re seeing consumer groups becoming more vocal about data privacy concerns and violations with filings against companies like [What’sApp](https://www.beuc.eu/publications/consumer-groups-file-complaint-against-whatsapp-unfairly-pressuring-users-accept-its/html). 

“_Data privacy is going to continue to evolve with consumers’ awareness and expectations,_” says Lucy. “_To adapt, companies are going to have to think beyond just meeting the bare minimum of legal requirements. They need to ask themselves hard questions about what protections are appropriate given the context and the humans you’re interacting with and work through the answers. We need to be building proactive privacy programs that reflect these data privacy conversations. Creating consumer trust requires listening and deliberate action._”

Start with these questions:

* Have I taken the time to understand the relationship my digital properties (app, site) create with my customers? How do I want them to feel at login? What about as they continue through my app or site? 
* Am I encouraging or discouraging trust by how I gather consent and data? 
* Have I created a transparent customer experience (CX) with clear consent and options? 
* If I am really honest with myself, do I need to change something? Do I really need this data?
* Who are my customers? What does privacy mean to them in the context of my services? 
* Do I have appropriate basic security and data governance processes in place? 
* Have I invested extra resources and time to protect the most sensitive/high-risk data such as health, financial, religious, or sexual orientation information? 
* Do I have any customers in regulated jurisdictions such as the European Union (EU) or California? If so, when was the last time I checked in with my legal counsel to make sure I’m in line with current requirements?

## Provide Cues for Safety and Trust

[Apple’s nutrition labels for data privacy](https://www.wired.com/story/apple-app-privacy-labels/) make good on efforts that have been around since the 2010s. If your new app is going to be in the App Store, Apple requires that you report publicly on data you’re using to track your customers, data linked to them, and data gathered but not linked to them. Even though Apple is relying on app developers to self-report, the labels increase consumer awareness and expectation, says Lucy. Given Apple’s size ($274.5 billion reported revenue in 2020 makes it the world’s largest company), these nutrition labels signal that data privacy is now an everyday consumer concern.

“_Businesses who don’t respond could miss out_”, says Lucy. “_The threats of data privacy fines and unhappy customers are real, but so is the opportunity to create customer experiences (CX) that drive brand loyalty. The entire tech industry is coming together to work on these data privacy challenges. Companies that act on the side of the consumer stand out._”

## Hiring Data Privacy Talent

Like security, data privacy professionals need to understand and express the intersection of humans and technology. They need to be able to communicate risks and benefits across an entire organization, with an emphasis on engineering, marketing, and senior leadership. Critical and analytical thinking, empathy, and consideration of different motivations and perspectives are key. Technical knowledge around privacy laws can be taught, but an ability to engage, listen and understand the context of the business and their customers is essential. Privacy isn’t “done” by privacy professionals - they support all parts of the business to build privacy protections into their individual business processes.

Lucy recommends that you ask candidates questions to show how they think about privacy issues in the context of the businesses in which they work. Examples of such questions include: 

* How would you demonstrate the value of good privacy practices to the chief financial officer (CFO)?
* How do you respond to the statement: privacy slows the business down? 
* What can you do to support developers to integrate privacy controls into their development lifecycle?
* Provide examples of when you have translated legal obligations into plain English requirements that the business can implement?
* Which company does privacy well? Why? How would you implement similar standards here?
* What are the key privacy risks that need to be prioritized? What actions are required to mitigate these risks?

## You’re Helping Make the Internet Safer

Thank you for checking out this series. One of the things that came up while working on this content is how the pandemic has made everything even more connected. The [threat landscape](https://auth0.com/resources/whitepapers/state-of-security-identity-report) and regulatory requirements can seem overwhelming, but taking the time to secure your personal data, your customer’s data, and your businesses make it harder for bad actors.

Identity can be a weak spot for both security and privacy if it’s not handled by experts. A strong Customer Identity Access Management (CIAM) solution like Auth0 can increase your security, support your data privacy strategy, and comes with certifications for various compliance requirements like [ISO 27001:2013](https://auth0.com/blog/what-is-iso-27001-2013-a-guide-for-businesses/) and [ISO 27018:2019](https://auth0.com/blog/what-is-iso-27018-2019-everything-executives-need-to-know/) and [CSA Star](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/). If you’d like to learn more about how Auth0 can help make your business more secure and stay ahead of your customers’ evolving expectations, please [reach out to the team at Auth0](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales).

<include src="asides/AboutAuth0" />

Time to Prepare: Be Ready to Scale Your Workforce and App

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Enable agile scalability with customer identity and access management (CIAM)

In the last few years, identity has become a familiar concept to business decision-makers seeking to fortify their security, unlock efficiency gains, and outpace competitors.

[Customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) is a set of solutions built to help organizations balance convenience, privacy, and security for every type of user who needs access to their platform. At Auth0, we’ve heard from our customers that investing in third-party CIAM solutions can benefit the entire organization, especially by:

* Providing a seamless, secure customer experience
* Protecting against expensive data breaches
* Guiding compliance with data privacy laws
* Gathering customer data into a single source of truth
* Increasing the success of digital transformation projects

Another major advantage to CIAM is that centralizing customer identity helps you build more scalable solutions — and scalability is both a benefit of and a requirement for the advantages listed above. Simply put, CIAM gives you the tools you need to scale identity quickly.

![The Business Value of Scalability](https://images.ctfassets.net/23aumh6u8s0i/BXZTiwu81LfqqP7O3yEmj/a66340c22f87e48739da621e7e46cdf6/02_B_power.jpg)

## The Business Value of Scalability

Scalability refers to a system’s ability to increase its capacity and functionality based on the evolving demands of its users. Your industry may be volatile, but scalable software allows your platform to remain stable in the face of infrastructure changes, updates, overhauls, and resource reductions/additions.

Laggard legacy systems are inflexible and resource-intensive to maintain, which for many companies is reason enough to prioritize digital transformation. Critically, legacy systems also fall short of modern scaling demand and user expectations. 

In contrast, building scalable solutions helps your organization increase predictability; trim maintenance and upgrade costs; and become more agile, so you can meet customers’ dynamic demands.

> Scalable software also shortens time-to-value. Your teams will bring products to market more quickly and deliver more value to your customers if they don’t have to worry about scaling your identity solution.

### Increase reliability

Scalable software systems increase reliability, so you can avoid outages and maintain continuous uptime. The ability to provide a smooth, consistent customer experience even in the face of demand spikes is a key competitive advantage enabled by CIAM. When circumstances like a major news broadcast or a big sporting event cause your platform to be flooded with requests, you don’t want to experience lags or outages. The bottom line: Lack of scalability leads to reduced reliability, which can drive users to another service. 

### Protect against data breaches

A scalable identity solution helps protect customer data from breaches and exposures that can occur as your organization scales. [A 2020 IBM-Ponemon study](https://www.ibm.com/security/data-breach) found that data breaches cost an average of $3.86 million per incident globally, with the number rising to $8.64 million on average in the United States. Breach-related costs include actual fines and reputation erosion that can lead to customers shifting to competing brands.

<include src="TweetQuote" quoteText="With CIAM, you can offer your customers the convenience of rapid authentication without introducing security vulnerabilities that make you more susceptible to a data breach." />

### Be ready for mergers and acquisitions

If you want to enhance your appeal as an acquisition target, or if you’re evaluating other companies to acquire, a solid CIAM strategy is critical. [Implementing CIAM before a merger or acquisition](https://auth0.com/blog/why-iam-is-essential-to-m-a-and-replatforming/) can prevent you from spending months integrating applications struggling to reconcile a high volume of user data, exposing security vulnerabilities, or introducing friction that drives customers away. 

CIAM goes a long way toward minimizing the disruption of M&A activity: before, during, and after integration. Managing post-M&A integration in-house is a difficult, time-consuming job that keeps your developers from devoting their full attention to your core solutions — which is more important than ever when you need to mitigate churn. [As Auth0 customer Cimpress discovered](https://auth0.com/case-studies/cimpress/), the right approach to customer identity management allows you to connect companies with divergent systems to your platform quickly and easily.

## How Does CIAM Enable Scalable Identity?

Identity touches every function of your business. Typically, organizations have to manage identity for different types of users: customers, employees, and enterprise partners. Each user type has different requirements for your platform depending on how they use it. CIAM not only helps you provide the right balance of convenience, privacy, and security to each type of user; it also gives you superior insight and a single source of truth to drive better strategic decision-making. 

### Give customers the frictionless experience they want

When a seamless customer experience is your first priority, scalability is an absolute requirement. And with customer-facing applications, ease of experience is everything. If your CIAM solution doesn’t scale, your users will abandon you for another service.

As a customer, you’ve probably experienced this impatience. If you’re trying to order dinner and your first-choice food delivery platform is overwhelmed and experiencing lags, you’ll switch over to another platform — and that platform might be your first choice from then on.

CIAM also allows companies to unify their login experience across apps, creating a consistent experience that benefits both user and brand. UK-based conditioning company [Gymshark](https://auth0.com/case-studies/gymshark/), an Auth0 customer, is a great example of how CIAM enables an exceptionally smooth, secure login experience across platforms. Gymshark needed a universal login solution that could authenticate customers across 15 different online stores and mobile apps. With Auth0, they’re able to manage access for 250,000 monthly users while securing their platform against [credential stuffing attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) and other threats to the login box.

### Cultivate customer trust with strong security

Your customers trust you to keep their personal information private; to be transparent and responsible with how you collect, store, and use their data; and to comply with regulations designed to protect customer privacy. CIAM enables you to uphold this trust as your solution scales, and your integration ecosystem expands.

Data privacy laws like [GDPR](https://auth0.com/docs/compliance/gdpr), [CPRA](https://auth0.com/blog/cpra-passed-what-s-changing-in-ccpa-2-0/), and [APPI](https://auth0.com/resources/whitepapers/amended-appi) require companies to understand how third-party providers manage the collection, use, and storage of data in their systems. CIAM solutions help guide compliance with these regulations, so you don’t lose sleep over non-compliance fines or expensive data breaches.

Implementing CIAM shows customers that you are literally invested in ensuring their privacy and security. Similarly, essential [certifications](https://auth0.com/docs/compliance) like HIPAA, CSA STAR, and ISO 27001/27018 also signify to customers and regulators that you’re not just claiming a strong security posture; you’re undergoing regular, rigorous security checks by an expert third party.

### Accelerate time-to-market and solve for future problems

Implementing CIAM lets your developers focus on supporting your core solutions instead of also having to manage identity in-house. As a result, you’ll bring products to market faster and deliver more value to your customers.

At Auth0, we recommend that companies make decisions around CIAM based not on where their business _is_, but on where they want it to be. You need identity management capable of scaling to meet future business needs, not just the pain points you encounter today. Where do you want your business to be in five years? How will that drive your scalability needs? Think strategically about your desired future state. If you get overly focused on the pain points you’re encountering right now; you may be inviting incompatibility and tech debt into your business infrastructure.

![Manage Identity Complexity with CIAM](https://images.ctfassets.net/23aumh6u8s0i/5jPq4nBdhF6cZtBAJYb2xM/2cafa607686a3a828b43b9d3161cdd8d/02_C_power.jpg)

## Manage Identity Complexity with CIAM

Since identity touches every aspect of your business, the functionality and scalability of your identity solution will tend to match the functionality and scalability of your organization as a whole. With CIAM, you can deliver the secure, frictionless experience your customers expect as you scale and integrate your ecosystem. That’s why many of our customers have opted to manage the complexity of identity with CIAM.

To learn more about how CIAM can help you reach your milestones, [get in touch](https://auth0.com/contact-us) with the experts at Auth0.

<include src="asides/AboutAuth0" />

How to Scale Quickly with Identity

The bcrypt hashing function allows us to build a password security platform that scales with computation power and always hashes every password with a salt.

Hashing in Action: Understanding bcrypt

jessica-sealby

Jessica drives public relations and global communications efforts for Auth0 across Asia Pacific. Outside Auth0, she frequents Melbourne’s live music venues and chases after her two energetic dogs.

PR Manager - APAC

Jessica Sealby

Auth0 enables SSO and Social Logins to save months of development time and help scale for expansion



**SINGAPORE – 28 May 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has partnered with a digital signage software company, ScreenCloud, to provide authentication for its growing enterprise offering. [ScreenCloud](https://screen.cloud/) will use Auth0 for enterprise federation, Single Sign On (SSO), and Social Logins to help its enterprise customers securely create and control content from anywhere. 

ScreenCloud helps leading brands transform how they communicate with employees and customers using simple, smart, and secure digital signage software. Its digital signage solution is trusted by more than 9,000 customers around the world, including Amazon, Uber, and Dropbox.

As the company sets its sights on significant international growth for its enterprise offering, ScreenCloud chose Auth0 as its primary identity management platform that offers the best combination of versatility, security, and ease of implementation. Auth0 will help support the diverse authentication and access management requirements of ScreenCloud’s enterprise customers, including SSO and Social Logins.

“Many of our customers store highly confidential data on our platform, so they demand secure authentication, and Auth0 makes it very easy for us to seamlessly tailor the authentication experience to suit each customers’ requirements,” said Brian Dewangga, Enterprise Product Manager at ScreenCloud, Thailand. “From a time-saving standpoint, it’s not just the big investment of time to build the solution, but also the long-term maintenance of the system.
By using Auth0, we also save significant resources on maintaining and updating identity management, which provides enormous value for us.”  

“Our growth in the region is marked by exciting fast-growth companies like ScreenCloud,” said Richard Marr, General Manager for Asia Pacific at Auth0. “Their pace of innovation and growing global demand required an identity solution that they could onboard and implement quickly to serve their customers better. We look forward to supporting their ongoing expansion.” 

Auth0 is helping ScreenCloud quickly build resiliency and scale for expansion. With a growing user base around the world working remotely due to COVID-19, ScreenCloud is developing new features to support the remote workforce and anticipates a significant increase in logins. 

“The world looks very different now to what it did a few months ago. We want to help remote workers interact with their company without needing to be in the physical presence of a company-owned screen,” said Dewangga. “It’s increasingly important for us to allow distributed teams to log on easily, without exposing sensitive company information. We feel we’re in good hands with Auth0.”

ScreenCloud believes using Auth0 will deliver a return on investment in the form of saved developer time and peace of mind, allowing them to focus on their core product.

<include src="asides/AboutAuth0" />


ScreenCloud Chooses Auth0 for Global Enterprise Offering

alejandro-ortuno

Alejandro is a Security Engineer in Auth0's Detection & Response team with a passion for automation and the cloud. Initiated as a software developer, he has experience working on AppSec, network security and cloud security for startups and enterprise companies such as Cisco or Rackspace. He spends his spare time learning newer technologies, playing padel and breaking things.

Security Engineer

Alejandro Ortuno

Discover how Auth0 uses security automation to respond to GuardDuty events at scale and our learnings in the process



Cloud adoption is occurring at a rapid pace and so are the risks and challenges in maintaining those secured environments. Doing it at scale requires the extensive use of automation and tooling. DevSecOps methodologies can also be applied to the detection and response of threats, decreasing the time to respond and preventing potential breaches. Logging pipelines, Slack bots, orchestration tools, and serverless technologies empower operation teams in a way that traditional security operations centers (SOC) can’t. Services such as AWS GuardDuty provide indispensable threat detection to continuously monitor for malicious activity and unauthorized access on cloud resources.

At Auth0, we have embraced the cloud since our inception, and with cloud resources in numerous AWS accounts in our organization, strong defenses and timely response to security events in the cloud are an absolute priority for us. That is why our Detection and Response team has embraced technologies to automate the response to security events in the cloud to scale for our [future organizational growth](https://techcrunch.com/2019/05/20/auth0-billion-dollar-unicorn/).

In this blog, we will provide an overview of the implemented architecture for the alert analysis, triage, user notification, and automated response of the AWS GuardDuty security findings on all of our AWS accounts.

## AWS GuardDuty Service

[_Amazon GuardDuty_](https://aws.amazon.com/guardduty/) is a threat detection paid service that continuously monitors for malicious activity and unauthorized behavior on AWS accounts and workloads. The service consumes CloudTrail, VPC Flow, and DNS logs and then enriches them with threat intel from AWS and other third-party services (such as CrowdStrike). GuardDuty also uses machine learning techniques to detect malicious activity on an AWS account. The service is regional (needs to be enabled on a per-region basis) and has a 30-day free trial. GuardDuty findings, if any, will start populating just a few minutes after the service is enabled.

At Auth0, we enable the GuardDuty service at account creation in all regions. Configuration follows a [_master/member_](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html) setup where every new AWS account becomes a new member of the master GuardDuty account.
From there, a combination of regional CloudWatch event rules and AWS Lambda functions ships all GuardDuty events into our security information and event management (SIEM) system.

We also monitor the health of this ecosystem closely as any failure would mean a critical gap in our alerting systems. As an example, we monitor specific [_GuardDuty API calls_](https://docs.aws.amazon.com/guardduty/latest/ug/logging-using-cloudtrail.html) (such as `Disassociate`, `StopMonitoring`, `DeleteDetector`, and many more) that could tamper with our infrastructure resulting in a page notification to our team.

Also, we have subscribed to the [_GuardDuty Announcements SNS Topic_](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_sns.html) and integrated the alerts with our bot, so we get Slack notifications when there are new GuardDuty findings or updates to the existing ones that require our attention.

## SecurityBot

At Auth0, we rely heavily on Slack as our main communication channel. On top of it, [we have created Slack Bots](https://auth0.com/blog/auth0-internal-dev-tools-unleashing-engineering-potential/) that can automate our common tasks and help us scale and better respond to security events.

One of those bots is the SecurityBot, developed by the Detection and Response team on top of our Security Orchestration, Automation, and Response (SOAR) system. Auth0’s SecurityBot was inspired by the awesome work of the security teams at both [_Slack_](https://slack.engineering/distributed-security-alerting-c89414c992d6) and [_Dropbox_](https://github.com/dropbox/securitybot).
The SecurityBot helps us in two main tasks:

- As a ChatOps function, we can ask the bot to create an incident response channel, add all necessary members to it, initiate the documentation for an incident, or perform an investigation on specific IPs and Domains.

- As our main channel to communicate with employees. The bot can send notifications or inquiry messages (that require a confirmation) to our employees, ask for MFA confirmation, or even page our team if an employee responds negatively to a specific event.

![A message notification from SecurityBot](https://images.ctfassets.net/23aumh6u8s0i/3heWkQLOzq6ehvjVSDE5a1/967048353b36f46ce89be46c3ea7be00/a-message-notification-from-securitybot)

## AWS Incident Response Tool (aws-ir)

Especially important when dealing with an incident is to have a timely response. For that reason, our team has developed an internal tool to make investigation and response on AWS a much easier and repeatable task.

AWS IR is an API built on a serverless infrastructure that allows our team to take necessary forensic artifacts and response options on a specific machine in any of our AWS accounts. Those actions are mainly:

- Take a snapshot of the instance volume.

- Run a set of [_osquery_](https://osquery.io/) commands.

- Take a memory dump.

- Take a `tcpdump` of the network traffic.

- Isolate an instance.

We have integrated this tool with the response to GuardDuty events so we can collect artifacts and perform response actions depending on the severity of the alerts.

## The Hive Project

Keeping records for the actions taken and the artifacts collected is sometimes a “boring” but necessary task to do while performing a response to an incident. [_The Hive Project_](https://thehive-project.org/) is our main ticketing and artifacts collection platform that we use to perform our investigations.

We rely on its APIs to create alerts, promote them to cases, and to upload the artifacts that we automatically collect.

## Automating the Response Like a Pro

Now that we have explained all the different elements that compose our architecture let’s see how we glue them together.

We partner with the security automation company [_Tines_](https://tines.io/) in this regard. Every alert from our detection stack, whether it’s from SIEM, GuardDuty, Phishing, or custom tooling we’ve built, first goes through Tines where it is enriched, prioritized, and ticketed. We also use Tines to automate the response to the GuardDuty alerts.

One of the most common observations after enabling GuardDuty is that it can be daunting at the beginning and that it requires a significant amount of time to tune it to make it serviceable for your environment. Let’s take a look at a few examples of what this tuning looks like and some associated caveats:

### Network Load Balancer: Port Probe Alert False Positives 

Receiving a GuardDuty event of an instance which have a random port that is being probed by a malicious IP from the internet can be concerning. But the story changes if the instance has no public IP, and is behind a load balancer which has port 443 open to the internet. The reason for this is that the Network Load Balancer, by default, offers "Source IP Preservation" and the source IP addresses of the clients are preserved and provided to your backend applications. This is documented in the following [_public article_](https://mysteriouscode.io/blog/dont-panic-false-positives-from-guardduty-and-network-load-balancer-nlb/) as well. Later we will discuss how we have overcome this limitation when making changes on the load balancer is not an option.

### Alerting on harmless customer provided domains

If your service takes or ingests domains supplied by your customers and queries them (as is the case for us), GuardDuty can flag some of this legit activity as malicious. We encountered false positive "Backdoor and Trojan" alerts that happened due to customers providing flagged domains into our service.

### Detecting anomalies while employees are on the move

Machine learning is great, and we definitely believe in this technology for detection purposes (we want to further expand on this technology for our own sake). Still, it doesn’t cope well on a remote-friendly company where employees are on the move, continuously changing their locations and source IPs.

### GuardDuty events for already terminated EC2 Instances

We have received GuardDuty events where the instance state is “terminated” (this information is contained on the GuardDuty event). On an ephemeral infrastructure where instances are spun up and torn down on demand, and there are no long-running services, this can limit our capabilities to respond to incidents or to perform live investigations.

### Visibility gaps in cloud environments

There is a lack of visibility for Digital Forensics and Incident Response (DFIR) with GuardDuty for containers/microservices, especially if they are running on the same EC2 instance. Alerts will come from the same EC2, and additional logging/tooling will be needed to respond to those alerts.

<include src="TweetQuote" quoteText="Learn how to tune GuardDuty to make it serviceable for your environment and the associated caveats."/>

So let’s dig deeper into how we have automated the response for those GuardDuty findings and overcome some of those challenges. We have grouped the different GuardDuty events and their responses mostly into four different categories:

1. EC2 PortProbe alerts

2. IAM User non-critical alerts

3. IAM User critical alerts

4. EC2 Other alerts

Let's go over the response for each of them.

## PortProbe Alerts

The first group of alerts involves inbound port probing, which means potentially malicious IPs probing ports that are open on the internet. We do have PortProbe type of events (_Recon:EC2/PortProbeUnprotectedPort_) and also SSH and RDP brute force events included in this group.

Initially, we filter out common ports that we know are open and are commonly attacked (for example, port 443). Also, as mentioned before, we do not want instances that are behind a network load balancer to trigger events if the load balancer is opening common ports such as 443. For that reason, we have built an [_AWS Step function_](https://aws.amazon.com/step-functions/) that maps network load balancer ports against instance ports and dumps this information on a DynamoDB database. From Tines, we query the database to filter out alerts on instances behind a network load balancer from which the listening port is 80 or 443.

![AWS Step function to collect network load balancer information](https://images.ctfassets.net/23aumh6u8s0i/6ApTwxb12qBo36xQ3tlpVc/a22e10551f48604894d5ef8326394160/aws-step-function-to-collect-network-load-balancer-information)

Finally, if the event is not filtered and has not been notified before, we send a notification via SecurityBot to the resource owner (based on Instance tags).

## IAM User Non-Critical Alerts

In this group, we cover GuardDuty `IAMUser` events that we have deemed non-critical. These events typically suggest suspicious API calls made by AWS principals. Our main action with those alerts is to first automatically determine the mapping of the Principal to an employee and their endpoint machine. From there, we check their device IP and compare it to the IP in the alert. If there is any mismatch, we trigger a SecurityBot Inquiry message to ask the employee for confirmation that they made the AWS API call.

![SecurityBot Inquiry Message](https://images.ctfassets.net/23aumh6u8s0i/3urYXdOgk6xG4F2nOp2L1B/53a2bf233268ff3b2f95a9c14ee28ab2/securitybot-inquiry-message)

## IAM User Critical Alerts

In this group, we cover the GuardDuty IAMUser events that we have deemed critical, and as such, they trigger a PagerDuty alert to our team. These events include modification to CloudTrail, password policy changes, credential exfiltration, or the [_latest S3 specific alerts_](https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-guardduty-adds-three-new-threat-detections/) among others.

We also enrich the alerts with the following information:

- List of employees seen under the same offending IP over the last 24 hours

- CloudTrail API calls made by the offending IP

## EC2 Alerts

Within this group, we have the following event types:

- EC2 Outbound network connection

- EC2 DNS request

- EC2 PortScanning

There is an important filtering layer that we needed to implement for our network scanner, and also for services that query customer provided domains which caused false positives to trigger. We initiate the AWS Incident Response tool to collect specific artifacts on the instance so we can better perform timely forensics investigation on the machines.

<include src="TweetQuote" quoteText="Dig deep into how Auth0 has automated the response to GuardDuty events and the associated challenges."/>

## Conclusions

We have no doubt as to the incredible value and visibility the AWS GuardDuty service provides to our team. Enabling it is incredibly simple, and we have decided to include it on each of our AWS accounts.

Automating our response to the GuardDuty alerts has helped us focus on what is important to us, filtering out some of the noise it generates and customizing it to our environments. We have evolved from processing hundreds of GuardDuty events per week (that would completely consume our team’s time to review and respond to these alerts) into just a few events per week needing our manual review. To add to this, with SecurityBot, we empower our employees to provide valuable real-time data relating to potential security incidents, making them aware of the alerts and also adding them to the front line of our security team.

For future work, we will continue to improve the automation for our incident response process. We also want to include other sources of information into our alerts, such as the events provided by agents like [_osquery_](https://osquery.io/) or information specific to containers and Kubernetes infrastructures. On top of that, we will expand our threat model to include attacks vectors such as compromised employee machines, malicious insiders, etc.

<include src="asides/AboutAuth0" />


Guardians of the Cloud: Automating the Response to Security Events

brandon-maxwell

Brandon is a Senior Security Engineer in Auth0's Detection & Response team. As a proponent of automation, he enjoys automating as many tasks as possible to spend time focusing on solving difficult security problems.

Senior Security Engineer

Brandon Maxwell

Learn how Auth0 uses security automation to generate phishing response at scale



Phishing continues to be a popular attack vector used by attackers with all sorts of motivations — from [_political_](https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html) to [_financial_](https://www.wired.co.uk/article/hr-email-scam-phishing-impersonating-employees) ones. According to Verizon’s [_2019 Data Breach Investigations Report_](https://enterprise.verizon.com/resources/reports/dbir/), 32% of the investigated breaches involved phishing. Most organizations deal with this threat on an almost daily basis, which makes automating the triage for these events an important part of maturing a security program.

In this post we talk about the approach Auth0 has taken to automating phishing in the hopes that it will help other organizations tackle this near-universal threat vector.

## phishing@auth0.com

Auth0 uses the email address `phishing at auth0 dot com` as an "abuse" inbox. We encourage customers and members of the public to report any suspicious Auth0-related emails they receive to this address. In addition, all Auth0 employees are trained to report suspicious emails they receive to this abuse inbox.

In Auth0’s infancy, every email that was sent to the abuse inbox was analyzed manually. A security engineer would review the email body and headers, copy URLs from the body of the emails and analyze them in various intelligence tools, and upload suspicious attachments (or their hashes) to various sandboxes. If the reported email represented a real threat, a remediation process was performed.

This worked great; however, as Auth0 started to grow, the volume of reports to `phishing at auth0 dot com` increased. Email analysis work became time-consuming and was detracting our attention from other higher-impact activities. In other words, it was a perfect use-case for security automation.

## Security Automation

At Auth0, we rely heavily on security automation to ensure we’re not wasting valuable cycles performing repetitive, manual tasks. We partner with the [security automation company Tines](https://tines.io/) in this regard. Every alert from our detection stack, whether it’s from SIEM, GuardDuty, or custom tooling we’ve built, first goes through Tines where it is enriched, prioritized, and ticketed. We also use Tines to automate phishing responses.

## Automated Phishing Response

For the most part, our automated phishing response story maps directly to our previous, manual process and consists of the following high-level steps:

1. Fetch email data and extract indicators
2. Create tracking tickets
3. Analyse indicators
4. Determine if the email represents a real threat
5. Close case if benign
6. Remediate if true positive

### Step 1: Fetch email data and extract IOCs

The first step is to read all emails sent to our abuse inbox. We do this with GSuite’s Gmail API. Once we have the email content, we can extract all URLs and attachments and begin to analyse them. We also recursively open and extract Indicators of Compromise (IOCs) from EML files attached to the originally reported email.

![Flowchart to fetch email data and extract IOCs](https://images.ctfassets.net/23aumh6u8s0i/4kB2PfHEaRZZswUn4bRU6M/d71c7ec982dcde9f05fd943244b2ed13/how-auth0-automates-phishing-response_3Afetch-email-data-and-extract-iocs)

### Step 2: Create tracking tickets

We track and record every single email that’s reported to our abuse inbox in our case management system. Not only does this allows us to track the volume of emails reported over time, but it also allows us to store indicators for future reference and later threat-hunting.

### Step 3 - Analyze indicators

One of the key benefits of automating analysis of indicators is that we can leverage many different intelligence sources without having to worry about wasting an analyst’s valuable time. In our phishing automation story we analyse URLs in:

- VirusTotal
- Urlscan.io
- URLhaus
- PhishTank
- Phish.AI

> **Protip**: When submitting URLs to public sandboxes, remember to first [_redact sensitive information_](https://tines.io/blog/automated-information-leakage/) from URL parameters and never submit links that could be used to reset passwords, etc.

Tines allows us to easily add and remove intelligence sources and experiment with different combinations of sandboxes, without having to change the core flow of the automation story.

![Flowchart to analyze indicators](https://images.ctfassets.net/23aumh6u8s0i/4XqCWGvVyGwl1ttZ140Y7C/8d4b825d58a6cf9b2f4e89089cdf2758/how-auth0-automates-phishing-response_3Aflowchart-to-analyze-indicators)


### Step 4: Determine if the email represents a real threat

Once we have analysed a URL or attachment in all the various intelligence sources and sandboxes, we use the combined results to determine whether the URL represents a legitimate threat and should be remediated/escalated to a human engineer or whether it’s a false positive and we can ignore it. There’s some secret sauce involved in making this determination and we regularly change the criteria used as our requirements adapt.

### Step 5: Close case if benign

If we have determined that all indicators associated with an email are benign, we update the ticket in our case management system and no further action is taken.

### Step 6: Remediate if true positive

If, however, we have determined that the reported email represents a real threat, we perform a number of automated remediation actions. Again, these actions change regularly but include the following:

- Purge the email from all employee inboxes
- Sweep endpoint logs to determine if any employees visited the malicious domain/URL, or downloaded/executed a malicious file
- Proactively share indicators with trusted peers in the InfoSec community
- Quarantine the devices we believe may have been infected
- Contact users who visited and/or interacted with malicious content and provide them with the next steps needed to mitigate any damage
- Reset potentially compromised credentials

Again, for every step that’s taken, evidence is collected and added to the relevant ticket in our case management system. This ensures a complete paper trail is available for every action that’s taken.

## Summary

Security awareness, email sandboxes, and strong multi-factor authentication all play a part in our *defense-in-depth* approach to phishing response. However, an abuse inbox, where employees and customers can report suspicious emails, is an indispensable resource, providing vital insight into on-going and emerging phishing attacks.

By automating triage of our abuse inbox, our security engineers can focus on higher-impact activities such as threat hunting and refinement or detection logic.

<include src="asides/AboutAuth0" />


How Auth0 Automates Phishing Response

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Strengthen your authentication, threat detection, and volume capabilities before the games.


![Tokyo 2020 Emblems](https://tokyo2020.org/assets/img/pages/games/emblem/emblem.jpg)

[_Source: Tokyo 2020 Emblems_](https://tokyo2020.org/en/games/emblem/)

The [Tokyo 2020 Olympics](https://tokyo2020.org/en/) might seem far away — yet for lead engineers in charge of streaming the games, it’s not far enough.

Tokyo will have a total of [_33 official sports_](https://www.nbcnews.com/news/world/tokyo-2020-summer-olympics-everything-you-need-know-n849301) — five more than the Rio Summer Olympics in 2016. In particular, new sports like surfing, skateboarding, sport climbing, and karate target younger viewers who are accustomed to watching sports (and e-sports) online, uninterrupted, and at high resolution. 

In 2018, major broadcasters like NBC streamed [_thousands of hours_](https://techcrunch.com/2017/11/16/nbc-will-live-stream-a-record-1800-hours-of-the-2018-winter-olympic-games/) of events. The BBC broke viewing records with [22.2 million streams](https://www.bbc.co.uk/mediacentre/latestnews/2018/most-streamed-winter-olympics-to-date). The pressure is on in 2020 to reach and impress an even larger audience.

Delivering a high-quality Olympic viewing experience is an enormous challenge from both a bandwidth and a security point of view. [Over 100 million unique users](http://www.nbcuniversal.com/press-release/nbc%E2%80%99s-rio-olympics-most-successful-media-event-history) watched the Olympics across NBC’s digital platforms alone in 2018 — nearly a 30% jump over London’s 2012 games. Users logged in to watch the games on-the-go and on myriad devices. NBC had to build out its operations and rely on more than 1,100 staff to maintain consistent service. 

Since then, the risks for video streamers have become more visible and acute. [In February of 2019](https://techcrunch.com/2019/01/02/chromecast-bug-hackers-havoc/), hackers exposed a vulnerability in Chromecast streaming devices that allowed them to play any video they wanted. More recently, on March 2019, free movie streaming site Kanopy disclosed a [significant breach](https://www.digitaltrends.com/home-theater/kanopy-streaming-data-breach/) of its users’ personal information, including geolocation, device type, and IP address. Hackers know how popular subscription streaming services are today — and are anticipating the 20-day bump that will start next July. 

Below, we offer three ways to future-proof your team’s streaming system, so you can deliver the safe yet thrilling experience your users expect.

## 1. Seamlessly and Securely Authenticate Your Users

Many users watching the 2016 Rio Games online were disappointed. Poor buffering, slow load times (occasionally [_up to 4 hours_](https://www.theverge.com/2016/8/26/12646224/nbc-rio-olympics-2016-coverage-tv-ratings-streaming) in parts of the U.S.), and mediocre in-app experiences caused frustration. Live streaming has been a major part of the Olympic experience since the 2008 Beijing Games. After more than a decade, it’s difficult to excuse subpar services.

Staggered visuals and outages are more than embarrassing. They can lead to declines in user engagement and revenue loss if advertisers seek other platforms.

One way to quickly and significantly improve your user experience is to implement better authentication measures. If a user is pleased with a simple, frictionless initial login — and can access content easily thereafter — it sets the stage for a rewarding, long-term relationship.

A third-party service like Auth0 can help you seamlessly implement features like [_single sign-on_](https://auth0.com/single-sign-on) (SSO) that make authentication painless and highly effective. Particularly when users require access to several applications simultaneously or in quick sequence, SSO allows them to simply log in once — regardless of their platform, technology, or domain.

![Example of single sign-on across apps](https://images.ctfassets.net/23aumh6u8s0i/3lzfDU5IDcS7PMe04OFltU/1fa68a5d13fc8e4160bd58f495d9525b/example-of-single-sign-on-across-apps)

Auth0’s SSO feature has [built-in security certifications](https://auth0.com/single-sign-on), including OpenID Connect, OAuth 2, and LDAP. In addition, it’s already SOC 2 and GDPR compliant — so if you’re concerned about protecting a volume of customer data, Auth0 can help with much of the heavy lifting.

Another way to offer your users smooth authentication and authorization is [Device Flow](https://auth0.com/device-flow/), a fast, easy, and safe way to log into limited-input devices. Auth0 offers a fully compliant implementation of the [OAuth 2.0 Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/) so you can take advantage of the security and user experience benefits of a standard delegated authorization protocol.

Taking the time to create a richer user experience doesn’t have to be a drain on your resources. Zeroing in on a pain point like authentication can improve multiple issues simultaneously — making you at once more organized, more secure, and more delightful to your audience.

## 2. Detect Threats before They Snowball 

Cybercrime is on the rise — and according to [_recent data from Akamai_](https://www.akamai.com/us/en/about/news/press/2019-press/state-of-the-internet-security-credential-stuffing-attacks-and-economies.jsp), streamers have emerged as top targets.

In this challenging environment, which will likely become even more dangerous leading up to 2020, it’s critical to take every precaution to protect the customers on your platform.

Simple yet powerful [_anomaly detection features_](https://auth0.com/docs/anomaly-detection) can help you quickly catch common threats — and take immediate action to block their progression. 

Auth0’s [_brute-force shield_](https://auth0.com/docs/anomaly-detection#brute-force-protection), for example, triggers after a set number of failed login or sign up attempts from the same IP address. The shield automatically notifies the administrator, who can immediately respond.

![Image of Auth0 Brute Force Shield](https://images.ctfassets.net/23aumh6u8s0i/4TwHT9UbSxQY9znGFp4p16/f05467dc9a90258258d9c44ff1e38143/image-of-auth0-brute-force-shield)

On the back end, admins can tailor their response to a suspected attack in a number of ways, including:

* Blocking the suspicious IP address
* Sending a [_customized email_](https://auth0.com/docs/anomaly-detection/references/brute-force-protection-triggers-actions#customize-the-blocked-account-email) to the affected user, and/or
* Whitelisting the account, so it doesn’t erroneously trigger a reply in the future

If admins are able to verify the user’s identity and resolve the issue, they can also easily remove the block via an email link.

A tool like brute-force protection is particularly useful with subscription services — where major data leaks have left [millions of user credentials exposed](https://www.troyhunt.com/pwned-passwords-version-5/) to hackers. 

With this cache of personal information, it’s easy for cybercriminals to develop algorithms that churn through username/password combinations — rapidly testing them against a login screen — until they gain access. 

The bad news is that since consumers worldwide expect to [_increase their number of subscriptions_](https://www.emarketer.com/content/which-subscription-services-will-us-consumers-sign-up-for-next), the surface area for such attacks continues to widen. The good news is that it’s not hard to bolster or build your platform to keep these attempts in check. Offloading this specific concern to a third party can also free up your technical talent to focus on larger, more complex tasks that directly relate to your efforts to scale.

## 3. Easily Handle Increased Volume

Even if you’ve developed a winning UX and strengthened your platform against major attacks, video streamers still face the challenge of making sure their service is robust enough to handle the surge in viewers expected for the Olympics.

Now is the time to be updating legacy systems, load testing, and determining specific gaps so that you can make necessary changes in time for Tokyo.

One way to do this is to develop your technology in-house. This has the potential to give you more ownership and flexibility over your outcomes. Yet many teams can’t afford to dedicate the time and engineers required to make these systemic changes. 

A second option is to buy your solution. In this case, it’s critical to find technology you can tailor to fit your needs. Every company is different — and will have different needs as it evolves. There is no one-size-fits-all product or suite of products that instantly delivers on volume, security, and design.

For this reason, at Auth0, we’ve built flexibility into our core. Every tool and feature we provide comes with [extensions](https://auth0.com/docs/extensions) — ways to run commands/scripts that enlarge the functionality of the base product. Whether it’s SSO, anomaly detection, advanced authentication features, or tools for better [user management](https://auth0.com/user-management) — Auth0 has specific [Rules](https://auth0.com/docs/rules) and [Hooks](https://auth0.com/docs/hooks) that adapt our technology to serve yours. 

## Be a Team Player

Preparing your platform for an enormous uptick in demand and increasing security threats — all while remaining fun and easy-to-use on the front end — might seem like an unwieldy and expensive task. 

Whether you build or buy the solutions you need, you’ll be dedicating significant financial and human resources in a tight time frame. Partnering with a team who has done this before can make all the difference — and the [ROI](https://auth0.com/forrester-total-economic-impact/) is often much higher than teams think. 

You’ll speed up time to implementation, reduce security costs, and free your engineers to double down on core, revenue-driving products. 

You don’t have to dread the Olympics. If you update your platform now, by the time 2020 rolls around, you too could be in the audience.

<include src="asides/AboutAuth0" />


3 Ways to Scale Your Streaming Platform Before Tokyo 2020

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

It's not magic. Startups can succeed if they have infrastructure that enables them to scale quickly and securely.


Unicorns (startups valued at over $1 billion) depend on rapid, uninterrupted growth. With just a [1.28% chance](https://www.cbinsights.com/research/unicorn-conversion-rate/) of achieving this coveted status, you need to set yourself up for success from the very start.

Your growth begins with creating infrastructure that fits your needs. To realize your vision for the impact you want to have on the world, you need to assemble systems that enable speed and efficiency — and can also rapidly adapt to change.

It's no easy feat. [Forbes](https://www.forbes.com/next-billion-dollar-startups/#56e3d2514441) believes Auth0 might be figuring it out. We wanted to share some of the insights and advice gleaned from our journey. While there's no one-size-fits-all solution, this piece offers entrepreneurs and their early technical teams advice on when to build or buy their tools, how to become a leader in customer engagement, and how to effectively manage a growing number of users as you scale. 

Nailing these critical components of growth early on will provide a solid foundation from which to take off.

## When Should You Buy, and When Should You Build?

As you grow, you'll need ways to store data, collaborate with co-workers ([particularly remote ones](https://auth0.com/blog/we-are-thankful-for-these-benefits-of-working-remote/)), and understand and connect with your customers. You’ll also need systems for [managing your finances](https://pilot.com/blog/merakis-hans-robertson-on-building-a-startup-finance-team/), hiring and human resources, and, of course, [security](https://auth0.com/security/). 

When confronting these challenges, teams at early-stage companies face trade-offs between [building or buying their own tools](https://auth0.com/blog/when-to-build-and-when-to-buy/).

![Startup Unicorn in the build vs buy tools/tech analysis.](https://images.ctfassets.net/23aumh6u8s0i/1wwxoR3yvEUhr4CBpXZ2UA/b7ae38df1cf649e93a5b91021a3833fa/the-build-vs-buy-analysis)

On the one hand, built tools have the potential to fit your specific use case and needs. If you create them in-house, your developers will have an intimate view of your team's mindset and working style. Though it might be time-consuming, building your systems fully on your own might pay off in the long run as you’re not incurring third-party fees.

On the other hand, when you're in the midst of rapid growth, [buying can be faster to implement](https://auth0.com/blog/auth0-roi-how-are-you-calculating-your-build-formula/). The upfront cost might be a challenge, but you won’t tie up your tech talent for months on end and can begin using your tools for faster ROI.

An approach that many startups take is to build certain components in-house and find trustworthy partners that understand their business and need for flexible solutions to fill in critical gaps.

Here at Auth0, for instance, we offer a [“buy and customize” model](https://auth0.com/learn/identity-faster-buy-customize/) for our identity solutions that can immediately address core issues like federation and offer teams the ability to refine other processes like user authentication. 

Auth0 Extensions enable third-party integrations that extend Auth0's base identity product. With Extensions, you can authorize users with groups, roles, and permissions; manage custom social connections; import and export existing users; create a single sign-on dashboard; and more.

The ability to [customize and integrate](https://auth0.com/docs/integrations) can help reduce business risk and close sales. 

As you grow and take on new [enterprise level clients](https://auth0.com/enterprise), striking the right balance of powerful and flexible tools becomes even more valuable — helping you to meet, and even exceed, demands of increasingly complex service-level agreements.

## Unicorns are Always on the Front Lines of Customer Engagement

Before long, you'll have too many customers to reliably speak to or survey. The importance of [feedback, metrics, and iteration](https://www.profitwell.com/blog/choosing-the-right-saas-metrics-for-different-stages-of-your-company) will require sophisticated analytics tools that can capture granular user data. 

![Startup Unicorn analyzing customer data in their decision-making](https://images.ctfassets.net/23aumh6u8s0i/m8HYvKo8fo1kVSN6go1wA/ab8df220f045c43ace7f96ab0cc8611d/analyzing-customer-data-is-key)

Infrastructure that enables [social login](https://auth0.com/learn/social-login/) can provide a stage for these analytics. Every time a user authenticates to your site, you can learn more about who they are and what they want — all while making it easier for them to log in. 
Social logins [reduce friction](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth//) so that users don't have to create new accounts to join your site. Less friction can result in lower customer acquisition costs, maximizing the value of your marketing efforts.

With social login, you can correlate [users' logins](https://auth0.com/docs/identityproviders) with other data, such as pages visited and shopping cart additions. You can even do [sentiment analyses](https://auth0.com/blog/4-ways-to-calculate-your-customers-happiness/) that search their login source, such as Twitter, for positive or negative mentions of your company. 

The sooner you know more information about someone, the better you can [personalize the onboarding experience](https://blog.clearbit.com/customized-saas-on-boarding-actions-person-role-referring-link/) and support retention down the line. 

In addition, Auth0 enables [progressive profiling](https://auth0.com/blog/progressive-profiling/), which builds up an image of each user as they interact with your product. Users authenticated through Auth0 each get a profile, which fills in with information from their identity provider, attributes created by [_Rules_](https://auth0.com/docs/rules), and information directly from users.

## Unicorns Always Efficiently Manage Their Users

This rapid model of change means that startups are constantly under pressure to spend resources on improving their core product. Speed must, however, match security. The more you grow, the more vulnerabilities you're likely to have, and the better target you become for hackers. 

Over half of SMB breaches result from [negligent employees or contractors](https://keepersecurity.com/assets/pdf/Keeper-2017-Ponemon-Report.pdf), but you can mitigate these threats by authorizing different levels of access for different people working to improve your products.

Identity is one of those areas that might seem like an afterthought; however, it becomes essential as your company grows. Authenticating new employees while you let go of others, and tracking all of your temporary contractors, consultants, and partners can become so complex that it drains technical resources from core product development. Losing sight of this, however, can result in gaps in communication, project delays, and even [data breaches](https://auth0.com/blog/what-is-a-data-breach/).

Outsourcing your identity needs is one way that many teams remain focused on their core business while easily and securely [managing different levels of access](https://auth0.com/user-management).

Auth0 profiles enable you to see detailed information on each of your users, such as authentication details, devices, login histories, and locations. With a comprehensive user management dashboard, authenticating users won't slow you down. 

Managing users on your own will cost you time, but a security breach can cost you your company. If growth is your goal, then defense and recovery need to be as important as your offense.

## You Want to be a Unicorn? Make Innovation + Infrastructure Work Together

Methods that made your company successful in its first year might not work in its fifth. If you want to be a unicorn company, your growth depends on flexible and powerful infrastructure that directly supports your [bold startup vision](https://www.intercom.com/blog/why-startups-need-a-strong-vision/) — even as it changes over time.

![Startup Unicorn innovating and growing thanks to powerful infrastructure](https://images.ctfassets.net/23aumh6u8s0i/4hSxXMHqxWgOdSTyUs57G1/f2e706df4f7956e9b6506681ac1e76ec/innovation-and-infrastructure-supports-growth)

No one can guarantee your success; however, finding the right balance of partners and tools to support you *will significantly increase your chances*.

<include src="asides/AboutAuth0" />



So You Want to be a Unicorn?

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Amazon Web Services customers can now implement Auth0’s Universal Identity Platform to build and scale new applications quickly



**BELLEVUE, Wash., – January 14, 2019 –** [Auth0](https://auth0.com/) today announced the public availability of its Identity-as-a-Service (IDaaS) platform on [AWS Marketplace](https://aws.amazon.com/marketplace/pp/B07YH11JH6). Customers can now add the cost of an Auth0 Enterprise Subscription to their Amazon Web Services (AWS) bill, and gain fast, flexible access to cloud-based identity management.

Auth0 is also an Advanced Technology Partner in the [AWS Partner Network (APN)](https://aws.amazon.com/partners/), which allows it to be hosted on or integrated with AWS. APN Advanced Technology Partners have demonstrated their commitment to AWS and deliver unique value to its customers. Auth0 will also take advantage of APN’s many benefits and framework for growth within AWS Marketplace, including technical training opportunities, business growth, and sales/marketing enablement. 

Auth0’s availability on AWS Marketplace makes it even more accessible to developers who need an extensible identity solution for new applications. Auth0 is quick to implement and easy for AWS customers to purchase, so developers can easily get new applications up-and-running. An Enterprise Subscription to Auth0’s highly scalable identity platform includes: Custom Domains, Unlimited Social Identity Providers, Unlimited Enterprise Identity Providers, HIPAA/BAA compliance, Single Sign On, and many other features.   
“Working with AWS offers us a powerful opportunity to continue expanding the global reach of our Universal Identity Platform,” said Eric Snyder, Senior Director of Partners at Auth0. “Enterprises can focus on innovation and achieve faster time-to-value by outsourcing their identity management to Auth0 for any audience, whether customers, business partners, employees, or even machines.”

For more information on the Auth0 Enterprise Subscription, please visit: [https://aws.amazon.com/marketplace/pp/B07YH11JH6](https://aws.amazon.com/marketplace/pp/B07YH11JH6).

<include src="asides/AboutAuth0" />

## **Media Contacts:**
Jeana Tahnk<br/>
Corporate Communications<br/>
Auth0<br/>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br/>
Matter for Auth0<br/>
[khall@matternow.com](mailto:khall@matternow.com)<br/>
971-246-7898


Auth0 Now Available on AWS Marketplace

Implement identity management tools for all of your users as you scale.



On August 21, Facebook took down over 600 accounts, pages, and groups that originated in Iran. These accounts were disseminating political disinformation, largely targeted at users in Latin America and the Middle East.

Cybersecurity firm FireEye initially tipped Facebook off about a network of pages called Liberty Front Press. Their reach was 74 Facebook pages, 70 accounts, and 3 groups, as well as 76 Instagram accounts.

The tip also led Facebook to discover an array of other networks, pages, and accounts that were disseminating false information — and engaging in cybersecurity attacks.

With these issues so widespread on the platform, how could Facebook not have figured it out sooner?

Coupled with numerous other [data breaches](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) across multiple companies this year, the most recent Facebook incident highlights how important it is for companies to continually update their user-management practices as they scale — before bad activity gets out of control.

## Facebook's Disinformation Incident Reveals the Challenge of Monitoring All of Your Users

The number of daily active users on Facebook has nearly tripled since 2011. Today, it boasts 1.47 billion users worldwide.

![Facebook daily user statistics](https://images.ctfassets.net/23aumh6u8s0i/1A3WvCiIUCsatoS3Du1l7f/87c64d7a41a81547cc3261de519f27f3/facebook-scandal_daily-users)
 
In addition, as of Q2 2018, the company had over 25,000 employees, and it shares its data with numerous third parties. 

Although it recently ended this practice, following the [Cambridge Analytica scandal](https://auth0.com/blog/what-data-did-facebook-really-give-cambridge-analytica/), Facebook historically shared user information with major online and offline data brokers through its Partner Categories program. This included what the company had collected itself (e.g., page likes) and information from its advertisers.

<include src="TweetQuote" quoteText="With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of Fake news, and accounts are rampant."/>

These providers helped other businesses understand and optimize their marketing campaigns. As an example, [according to Facebook](https://www.facebook.com/help/494750870625830):

"An auto dealer may want to customize an offer to people who are likely to be in the market for a new car. The dealer also might want to send offers, like discounts for service, to customers that have purchased a car from them. To do this, the auto dealer works with a third-party company to identify and reach those customers with the right offer. The third-party partner provides Facebook with information that helps Facebook connect those customers with the offers." 

With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of [Fake news](https://www.zuora.com/2017/05/26/social-platforms-channel-fake-news-next-revolution-journalism-2/) and accounts are rampant.

How can your team do better?

## Avoid Your Own Disinformation Scandal with Strong Identity Management Tools

Even if you’re not as large as Facebook, there are key steps you can take as your company scales to be sure you are keeping track of who your users are (customers, employees, and third parties) and what behaviors they display in order to root out fake accounts and nefarious activities.

### Identity management for your employees

As your team expands on multiple levels, across new geographies and time zones, following everyone working within your system can be a headache.

Pushing certain [Rules](https://auth0.com/learn/cloud-identity-access-management/) in the cloud, like blocking people or even entire groups from logging in on particular devices or at certain times, can help cut down on inefficient DIY tactics and organize access in a streamlined way.

If using Auth0's solutions, you can quickly pull [user-profile details](https://auth0.com/docs/user-profile/user-profile-details), including

* first name and last name;
* email address; and
* specific company identifiers, such as an employee number or a listed department name.

Given the range of data sources that this information could come from, including custom databases, an Active Directory, or even a social provider like LinkedIn, Auth0 will normalize this and return a basic set of data, with attributes like  `user_id`, `name`, `nickname`, and `picture`, to allow admins and programs to retrieve the information they need when double-checking employees.

Giving admins the control to rapidly parse an employee user base will help them notice any suspicious behaviors — like repeated failed login attempts in real-time — mitigating the risk of false accounts or system breaches.

### Identity management tools for third parties

For third parties such as consultants or auditors (or, in Facebook's case, purchase-data providers like Datalogix, Epsilon, Acxiom, and BlueKai) that you allow into your system but that are not regular employees, providing them with a single sign-on (SSO) feature through [Auth0 Universal Login](https://auth0.com/universal-login) will not only make things cleaner and more efficient on their end but also help consolidate all of their credentials into a single location for vetting purposes.

Auth0 Universal Login provides a secure login infrastructure to authenticate users to your apps.

![Auth0 Universal login page](https://images.ctfassets.net/23aumh6u8s0i/6TwsXjuNeMnkg5I4ZN3y5o/c4b1c77a6e5b8e10b44dc000bde49d19/auth0-centralized-login)

On the back end, after the authentication event occurs, admins can call the `getUserInfo` method to acquire all of the user's profile information (as needed).

Keeping track of external users is critical in maintaining order and privacy within your system as needed (as Facebook's canceled Partner Categories program highlighted). Because these users aren't formal employees, you want to be sure that they still adhere to your company's standards and practices and aren't straying or creating unwanted programs.

### Customer identity management tools

Knowing your customers is key to growing your company. Strong customer-identity and customer-access tools can make onboarding quick and fun, up your daily active-user base, reduce churn, and [drive conversions](https://blog.nomnominsights.com/turning-customer-feedback-into-research-hypotheses/).

It also helps you ensure that no one is masquerading as someone they're not.

This year, British shipping company Clarksons revealed that a single fake account was to blame for [stealing confidential information](https://www.zdnet.com/article/clarkson-says-single-user-account-to-blame-for-data-breach/). The account accessed corporate databases and made off with highly sensitive data, such as Social Security numbers, criminal convictions, medical information, tax and insurance details, signatures, and login credentials  — along with even more personal details, like ethnicity and religion.

To get out of the mess, Clarksons had to hire outside forensic help to find and disable the problematic account.

Implementing social integrations can help you avoid this by immediately double-checking that all users are who they say they are. A social login feature relies on existing login information from a social network provider like Google to verify a users identity.

![Log into a Wordpress site using social login provider](https://images.ctfassets.net/23aumh6u8s0i/4DR1XvnUhTlC5oOYIQw4vU/c5c39ff1cd0ec9e4a6d26cb97ca860ed/facebook-scandal_auth0-wordpress)

A customer can sign into a third-party website like WordPress through Google instead of creating an entirely new account. Since the provider (Google) has already authenticated the user, it provides an extra layer of security.

Any further support you can get to vet users — even your loyal and trusted customers — can go a long way toward avoiding a costly data breach.

<include src="TweetQuote" quoteText="Creating or outsourcing tools like Auth0 Universal Login for rapidly pulling and storing current user data, and features like social login will help secure your company at its foundation so that you can grow."/>

## Use Identity Management Tools to Stop Bad Behavior at the Source 

As your company grows, it's a blessing to bring on more users — whether new customers, freelancers, consultants or employees. But it can quickly become a curse if you don't implement strong practices for monitoring them.

As the Facebook disinformation scandal clearly shows, without proper tracking, small issues can balloon out of control. Ideally, you'd stop any fake accounts at the login source so they don't snowball at all.

Creating or outsourcing tools like [Auth0 Universal Login](https://auth0.com/universal-login), [Rules for rapidly pulling and storing current user data](https://auth0.com/docs/rules/current), and features like [social login](https://auth0.com/learn/social-login/) will help secure your company at its foundation so that you can grow.


What the Facebook Disinformation Scandal Means for Your Company

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

How Auth0 is striving to keep its soul while hiring for dramatic growth

Building Company Culture for Scale

saravana-kumar

Guest Author

Saravana Kumar

Learn how utilizing identity solutions like Auth0 allows your engineers to focus on what matters most to your company - developing your SaaS product's unique features.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

**TL;DR**: In this article, we will explore some of the key technical considerations you have to make while building highly-scalable SaaS products. The idea is to show that it's better to use reliable PaaS (Platform as a Service) vendors available in the market instead of utilizing your valuable engineering resources on infrastructure requirements. As you will learn, this will make your engineers available to focus on what matters the most, the key features of your project.

<include src="TweetQuote" quoteText="Relying on battle-tested solutions allows your engineers to focus on what matters most to your company — the unique features of your SaaS products."/>

## Introduction

Before going into the details, I need to give you a short background of Document360, which will help you to understand the context of the article better.
 
[Document360 is a self-service knowledge base product](https://document360.io/) that helps you to create public or private product documentation. Take as an example [Auth0's own documentation](https://auth0.com/docs). Using Document360, you can easily build such product documentation.

![Document360 logo](https://images.ctfassets.net/23aumh6u8s0i/1EvAgNetdKQ85x3DI6FOtz/7c207131cb5d55a5cc6ad5b05cd9450d/document360_logo)
 
When the idea for Document360 was conceived at the end of 2017, one of the key decisions we have made was to build a solution to scale to unlimited users without any architectural changes. This means that the product has to serve 500 customers today and it shouldn't suffer big architectural changes to serve 500,000 customers in a few years down the line.
 
Architecturally, this requires a different level of thinking and infrastructure requirements when you are designing a system that's capable of 500 customers and 500k customers. You need to be careful you are not over-engineering the solution, which will end up being difficult to manage and very expensive.
 
For example, let's say you have the requirement to pick a video file from a storage location to do some processing (like creating a transcript) and to store the result in a third-party storage location. When you are looking at processing 5 video messages per day, the solution is pretty simple, but imagine if you are YouTube or Wistia and need to process 100,000+ videos per day. Then, this single piece of functionality will require significant architecture and infrastructure investment.
 
If you do not plan correctly and decide to build scalable components yourself, your valuable software engineering time will be spent on creating basic versions of those functionalities. The cloud Platform as a Service (PaaS) market has evolved significantly in the past 5-8 years and, today, there is a specialized offering for each piece of the puzzle. It might be a smart move to pick the required Lego blocks and assemble it together rather than building everything yourself.

## Core Services for Cloud Scaling

For Document360, there are five core pieces of the product that required cloud-scale thinking:

1. the Identity Management (user authentication) system;
2. an user-facing web application;
3. technical-writers-facing web application;
4. a search engine;
5. and data storage.

Before going into identity management, which is the core of this article, let's quickly take a brief look at the background about other scalable parts of the architecture.

### User-Facing and Technical-Writer-Facing Web Apps
 
These web applications are straightforward requirements. Both applications should be scalable, reliable, and fast to provide a great experience to both end customers and technical writers. We decided to use [Microsoft Azure Web Apps](https://azure.microsoft.com/en-gb/services/app-service/web/) as the core front-end facing technology with [Azure Traffic Manager](https://azure.microsoft.com/en-gb/services/traffic-manager/) to route the traffic to the closest location.

### Search Engine
 
For any self-service knowledge base product, a good search engine is the key. These days, people do not navigate through your structure, they will just go and hit that big search box to look out for answers. We need to make sure the search feature is robust and, again, scalable when 1000's of customers arrive. There is no point in building this in-house. As such, we decided to go with [Algolia as our search provider](https://www.algolia.com/).

### Data Storage
 
A document management product like Document360 is full of text documents, so we need a reliable storage (database) with fast read and write capabilities and that can also scale as we grow. For this feature, we decided to go with [MongoDB cloud as our data storage provider](https://www.mongodb.com/cloud).

## Identity and Access Management with Auth0

Now, let's get a bit deeper into the main part of this article: ["Identity Management as Service"](https://auth0.com/learn/cloud-identity-access-management/). Document360 got various types of users logging into the system. When you are building a public facing self-service knowledge base, your draft writers and editors need to safely login to the system to produce relevant content. In some scenarios, where the customer decided to keep their self-service knowledge base private to the organization, then the whole organizations need to securely login in.

![Managing Identity with Auth0](https://images.ctfassets.net/23aumh6u8s0i/56TDJXutAc7DPAGwcknHY9/0ce17a9352d60d4a5382acf67f55c2e4/p-dashboard-6fc11ba51b)

Out of the five core areas of Document360, getting the initial authentication part in a secure, reliable, and scalable part is the most important aspect. For this, we decided to go with [Auth0 to provide the initial login and user authentication for our product](https://auth0.com/).

There are few reasons why we decided to use Auth0 instead of custom building our own identity providers:

- **Enterprise-Ready**: Even though capturing credentials (username/password), validating them against your database, and issuing a validation token might look like a simple task, soon, everything get complicated when you look at the scale factor. It would have taken months for our developers to build [an identity solution with the B2C features that Auth0 provides](https://auth0.com/b2c-customer-identity-management). More than that, it would take years to reach the level of quality and security of what Auth0 can provide.
- **Hack-Proof**: These days, when you are building a SaaS product like Document360, you need to worry about the DDOS attack and identity hacking. Every now and then, there is something on the news saying that one of the top websites was hacked. As such, it's not worthing the risk for us to do it ourselves. A product like Auth0 deals with billions of identity validation every day will be [better equipped and more secure than any in-house solution that we come up with](https://auth0.com/security). Enabling functionalities like [breached password detection](https://auth0.com/breached-passwords) enables that our users data is secure..
- **Trivial to add more providers**: Initially, we are starting with a standard username/password for identity verification. However, our plan in later stages is to support more identity and [single sign on (SSO)](https://auth0.com/single-sign-on) capabilities. By using Auth0, we can rest assured that, when the time comes, we will be able to [easily support other identity providers like Azure Active Directory, LDAP, and social identities (like Facebook, Google, LinkedIn etc)](https://auth0.com/docs/identityproviders). With Auth0, this is more of a trivial configuration change rather than spending weeks building support for new identity providers.
- **Low cost**: If we put together the total investment required to build and manage an identity solution, we would be amazed. The effort and the investment will all add up pretty quickly because you will need specialized engineering resources blocked just for this feature and for the infrastructure requirement. By using Auth0, we save money by simply [paying based on our usage](https://auth0.com/pricing). That is, we pay more when we make more money.
- **Rules trigger on identity**: This is one of the cool features we take advantage of at Auth0. We have requirements like, whenever a new user signup, we need to notify the sales team. With Auth0, we achieved this by plugging in [the Zapier integration after a successful authentication](https://auth0.com/rules/zapier-new-user). This was trivial.
- **Single Sign On**: In the Document360 case, we have two different web portals. One for where the Technical writers produce knowledge base content and another one for user/customer facing website (public or private). When the customer decides to go private, then [a seamless Single Sign On experience](https://auth0.com/docs/sso/current) is required between both the portals. This is achieved seamlessly using Auth0.

<include src="TweetQuote" quoteText="By using Auth0, we save money by simply paying based on our usage. That is, we pay more when we make more money."/>

## Summary

If you are building a SaaS product today, you really shouldn't think about building things yourself. The modern way of building stuff is all about assembling the best solutions in the industry together and constructing a solid application. That's exactly what we have done in our case. The core parts of the business are running with the help of great products in the market and we act more or less like an orchestrator to assemble and create a beautiful music out of all these talents.

<include src="asides/AboutAuth0" />

## About the Author

Saravana Kumar is the Founder of [Document360](https://document360.io/), a  product that helps your team create, collaborate, and publish a self-service knowledge base for your software with ease.  Saravana is passionate about technology and he holds the famous Microsoft Most Valuable Professional title for 12 years in a row. He founded and scaled three other successful enterprise products ([BizTalk360](https://www.biztalk360.com/), [Serverless360](https://www.serverless360.com/) and [Atomic Scope](https://www.atomicscope.com/)) in the last 7 years.


Cloud-Scale Thinking from Day One for Your SaaS Products

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

JSF heavily depends on HTTP sessions, which is usually easier to scale vertically. Today we will see how to scale JSF horizontally with Spring Session.

[Spring](https://spring.io/) is one of the most popular and reliable frameworks available for Java developers. Upon its core, many modules were implemented, like [Spring MVC](https://docs.spring.io/spring/docs/current/spring-framework-reference/html/mvc.html), [Spring Security](https://docs.spring.io/spring-security/site/docs/current/reference/html/), [Spring Data](https://docs.spring.io/spring-data/jpa/docs/current/reference/html/), and so on. In this article we will see how to use [Spring Session](http://projects.spring.io/spring-session/) (one of these Spring modules) to scale [JavaServer Faces (JSF)](https://javaserverfaces.java.net/) applications horizontally.

## Horizontal vs Vertical Scaling

Before diving into how we use Spring Session to scale JavaServer Faces (JSF) applications, let's do a quick review on the differences between scaling applications vertically and horizontally.

Scaling an application vertically means adding more power to the machine that hosts the application. For example, let's say that we have an application running on a [`t2.medium` instance on AWS (which has 2 virtual cores and 4GiBs of RAM)](https://aws.amazon.com/ec2/instance-types/) that is having a hard time to process all requests. To scale this application vertically would mean choosing a more powerful instance, with more resources, to host it (e.g. using a `t2.xlarge` instance that has 4 virtual cores and 16GiBs of RAM).

This approach has one good advantage but three extremely important disadvantages. The upside is that it is *very* easy to scale it. It's just a matter of deploying the application to the new instance and we are good to go. The downside list is:

1. The host that supports our application is a single point of failure. This means that if it goes down our users won't have access to our application.
2. It is quite expensive to keep upgrading the instance type, no matter where we are hosting it.
3. There is a limit on how much power we can get from a single host.

Horizontal scalability, on the other hand, means adding more hosts to support an application. In the example above, instead of choosing a new instance type, we could create a second `t2.medium` instance and [load balance requests](https://en.wikipedia.org/wiki/Load_balancing_(computing)) between them.

The biggest disadvantage of this approach is that the complexity of scaling an application is higher, when compared to deploying an application on a more powerful machine. But, the advantages are:

1. We can scale it infinitely.
2. It is cheaper to add a second machine rather than replacing for one with twice the power.
3. We have no single point of failure.

As we can see, although scaling applications vertically mighty be easier, scaling them horizontally is much more interesting and improves the reliability of our system. That's why in this article we will see how we can use Spring Session to scale JSF applications horizontally.

## What is Spring Session

Spring Session is a module of the Spring Framework that aims on providing a common infrastructure for managing clustered sessions. This means that Spring Session abstracts the complexity of clustering HTTP sessions, making it easy to host applications scaled horizontally. Basically, what this modules does is to offload the storage of the session state into  external session stores (e.g. Redis or a regular database such as PostgreSQL).

## Scaling JSF with Spring Session

To see Spring Session in action, we are going to run two dockerized instances of a specific JSF application—i.e. we are going to use [Docker](https://www.docker.com/) to host our application instances. Each dockerized instance will run on a different port: instance *number one* will run on port `8081`; and instance *number two* will run on port `8082`.

The JSF application in this repository is not configured with Spring Session. After building the application and running it on Docker, we are going to make the adjustments needed to tie these two instances together with Spring Session. To seamlessly integrate these instances, making them look like a single application, we are going to use a dockerized NGINX instance configured as a load balancer.

To summarize, we are going to:

1. clone a GitHub repo that gives us a good start point
2. compile and package the JSF application in this repo
3. launch two dockerized instances of this application
4. check their behavior running as independent applications
5. refactor the application to use Spring Session
6. run Redis in a Docker container
7. and configure NGINX and launch everything to have a horizontally scaled JSF application

## JSF Application

To start, let's [clone this repository](https://github.com/auth0-blog/spring-boot-session). The JSF application inside this repository contains only a data table that lists products and that accepts drag & drop commands to reorder the items.

The list of products is instantiated in memory when a user access the application for the first time. When the user drags & drop an item, the new order is kept for the whole duration of the session. Different users can have different orders, as the reordering occurs inside an HTTP session. But, for the same user, no matter how many tabs of the application are opened on a web browser, the order will be always the same.

Every time a user reorders the data table, JSF shows a message distinguishing which instance of the application handled the request. Before using Spring Session and tying the two instances together, this message won't have that much value. But, when we have every piece in place, we will be able to see that different instances will act in the same HTTP session.

Enough talking, let's get our hands dirty. To clone the application and to run it in two different dockerized instances, let's issue the following commands:

> **Note** that you will have to have Docker properly installed in your development environment. To install it, [follow the instructions here](https://docs.docker.com/engine/installation/). Besides that you will need a [JDK (1.7 or higher)](http://www.oracle.com/technetwork/java/javase/downloads/index.html) and [Maven](https://maven.apache.org/install.html). Please, be sure to have everything properly installed before proceeding.

```bash
# clone repo
git clone https://github.com/auth0-blog/spring-boot-session.git

# access its main directory
cd spring-boot-session

# compile and package the application
mvn clean package
```

After issuing the three commands above, we will have our JSF application ready to run. You might want to run it in your own machine before dockerizing it. This step is not needed, but it is good to see the application before putting it inside a Docker instance. To do that issue `java -jar target/spring-session-0.1-SNAPSHOT.jar` and open `http://localhost:8080/index.jsf` in your web browser. Note that if you do run the application now and try to reorder the data table, you will see a message saying *Request handled by: default title*. When we dockerize this application, we will give different titles to both instances.

## Dockerizing the JSF Application

Now that we have our application compiled and packaged, we can proceed with the dockerizing step. The process of dockerizing a [Spring Boot](https://projects.spring.io/spring-boot/) application (the JSF application in this repo is based on Spring Boot) is quite simple. We just need to generate a Docker image with a JDK, add the packaged application to this image and then run it. You will find the `Dockerfile` with all these commands in the root directory of our application, but I show its contents below as well:

```dockerfile
FROM frolvlad/alpine-oraclejdk8:slim
VOLUME /tmp
ADD target/spring-session-0.1-SNAPSHOT.jar /app.jar
RUN sh -c 'touch /app.jar'
ENV JAVA_OPTS=""
ENTRYPOINT [ "sh", "-c", "java $JAVA_OPTS -Djava.security.egd=file:/dev/./urandom -jar /app.jar" ]
```

The first line defines that the image will be generated from an image that contains JDK 1.8. After that we define a volume and add the packaged application to the image. The last command in this `Dockerfile` executes the JSF application.

To build and run the two dockerized instances of the JSF application, let's issue the following command from the root directory:

```bash
# build the dockerized application image
docker build -t without-spring-session .

# running instance number one
docker run -d -p 8081:8080 --name without-spring-session-1 -e "APPLICATION_TITLE=First instance" without-spring-session
# running instance number two
docker run -d -p 8082:8080 --name without-spring-session-2 -e "APPLICATION_TITLE=Second instance" without-spring-session
```

The first command builds the image naming it as `without-spring-session` to easily identify that it is an image with no Spring Session configured. After that we run two instances of this image. We define that the first instance being run will have its port `8080` tied to port `8081` in our development machine. And the second instance will have port `8080` tied to port `8082`. Note that we also define distinct values to the environment variable named `APPLICATION_TITLE`. This is the title that the JSF application shows in the *Request handled by* message when reordering the data table.

By opening `http://localhost:8081/index.jsf` on a tab of our web browser and `http://localhost:8082/index.jsf` on another tab, we can see that we have two distinct applications running apart. They do not share a common state (i.e. an HTTP session). This means that if we reorder the data table on instance *number one*, nothing will happen with instance *number two*. We can refresh the page an check that the second tab will have the data table unaltered.

## Integrating Spring Boot with Spring Session

Integrating Spring Boot with Spring Session is very easy. We have to take only four small steps. The first one is to add two dependencies to our project: Spring Session and a external session store (we will use [Redis](https://redis.io/) in this article). To add these dependencies, let's open the `pom.xml` file and add the following elements to the `<dependencies/>` element:

```xml
<dependencies>
  
  <dependency>
    <groupId>org.springframework.session</groupId>
    <artifactId>spring-session</artifactId>
    <version>1.3.1.RELEASE</version>
  </dependency>
  <dependency>
    <groupId>org.springframework.session</groupId>
    <artifactId>spring-session-data-redis</artifactId>
    <version>1.3.1.RELEASE</version>
    <type>pom</type>
  </dependency>
</dependencies>
```

After that we need to tell our `Application` that we are going to use Spring Session with Redis to manage HTTP sessions. We do this by adding the `@EnableRedisHttpSession` annotation to the `Application` class.

```java
// ...
import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;

@SpringBootApplication
@EnableRedisHttpSession
public class Application {
  // ...
}
```

Since HTTP session will be handled by an external session store (Redis), we will need to add the `Serializable` interface to everything that gets added to users' sessions— this interface tells the JVM that the classes that use it are subject to serialization over the network, to disk, etc. In this case, we have to update only the `Product` class.

```java
//...
import java.io.Serializable;

public class Product implements Serializable {
  // ...
}
```

Last step is to configure the Spring Session connection to Redis. This is done by adding the following properties to the `application.properties` file:

```bash
# ... other properties
spring.redis.host=172.17.0.1
spring.redis.password=secret
spring.redis.port=6379
```

The properties above point to a Redis instance running on `localhost:6379`, which doesn't exist yet. We will tackle that now.

## Dockerized Redis Instance

As we don't want to install Redis on our development machine, we are going to use Docker to run it. To do that we are going to create a `Dockerfile` in a new directory called `./redis`. The contents of this file will be:

```bash
FROM redis
ENV REDIS_PASSWORD secret
CMD ["sh", "-c", "exec redis-server --requirepass \"$REDIS_PASSWORD\""]
```

The file above starts by defining the [official Redis image](https://hub.docker.com/_/redis/) as the base for our own image, and then define `secret` as the password for connecting to Redis. To build and run this image, we can issue the following commands:

```bash
# create redis image
docker build -t spring-session-redis redis

# run redis
docker run -p 6379:6379 -d --name spring-session-redis spring-session-redis
```

Redis is now available to the Spring Session module that we've just configured in our JSF application. Therefore, we are ready to rebuild our JSF application, build the new Docker image (now with Spring Session), and then run both instances based on this new image.

> **Note** that the first command below removes the two instances created before. This is needed to release ports `8081` and `8082` on our development machine.

```bash
# remove previous instances
docker rm -f without-spring-session-1 without-spring-session-2

# compile and package the application
mvn clean package

# build the dockerized application image
docker build -t spring-session .

# running instance number one
docker run -d -p 8081:8080 --name spring-session-1 -e "APPLICATION_TITLE=First instance" spring-session
# running instance number two
docker run -d -p 8082:8080 --name spring-session-2 -e "APPLICATION_TITLE=Second instance" spring-session
```

After executing these commands, the last step that we will need to perform to tie everything together is to create an NGINX instance that behaves as a load balancer.

## Load Balancing with NGINX

To load balance requests between the two instances we will use the `Dockerfile` and the `nginx.conf` file that exist in the `./nginx` folder of the repository. The `Dockerfile` (contents below), simply enables the creation of an image based in the [official NGINX image](https://hub.docker.com/_/nginx/) with a configuration defined in the `nginx.conf` file.

```bash
FROM nginx
RUN rm /etc/nginx/conf.d/default.conf
COPY nginx.conf /etc/nginx/conf.d/default.conf
```

The `nginx.conf` file configures NGINX to act as a load balancer that uses the round-robin algorithm to distribute HTTP requests between instances. As we can see through the contents below, this file defines an `upstream` that contains both instances, and then defines that any request should be redirected to one of these instances. By not explicitly defining any strategy in the `upstream` property, NGINX uses the default one (round-robin).

```bash
upstream my-app {
    server 172.17.0.1:8081 weight=1;
    server 172.17.0.1:8082 weight=1;
}

server {
    location / {
        proxy_pass http://my-app;
    }
}
```

To build and run the NGINX load balancer image, we can issue the following commands:

```bash
# build the dockerized NGINX load balancer
docker build -t spring-session-nginx nginx

# run load balancer
docker run -p 8080:80 -d --name spring-session-nginx spring-session-nginx
```

And Voila! We got our JSF application horizontally scaled with Spring Session handling HTTP sessions with the help of Redis. Now, whenever we issue an HTTP request to `http://localhost:8080`, we may get an answer from one instance or another. Just load this URL in your web browser and reorder the data table a few times. You will see that sometimes one instance of our application will respond to the reordering event, sometimes the other instance will.

## Aside: Securing Spring Boot Applications with Auth0

One of the most complex features to implement in an application is [user authentication and identity management](https://auth0.com/user-management). [Security for authentication and identity](https://auth0.com/docs/security) is [an entire glossary](https://auth0.com/identity-glossary) unto itself.

![Auth0 hosted login screen](https://images.ctfassets.net/23aumh6u8s0i/4ve30M1qt7GmE2nAYNKOhs/358e1f9aab4405b66fbeb5ca4cfa1eae/angular-aside-login)

If you need to implement a robust, highly customizable [identity and access management](https://auth0.com/user-management) system quickly and easily for your Spring Boot application, Auth0 can help. Take a look at [Securing Spring Boot with JWTs](https://auth0.com/blog/securing-spring-boot-with-jwts/) to properly secure your application.

> Auth0 provides the simplest and easiest to use [user interface tools to help administrators manage user identities](https://auth0.com/user-management) including password resets, creating and provisioning, blocking and deleting users. [A generous **free tier**](https://auth0.com/pricing) is offered so you can get started with modern authentication.

## Conclusion

Using Spring Session to handle HTTP sessions is an easy task. Spring Boot makes it even easier, requiring just a few small steps to configure everything in an application. The problem is that this kind of architecture is not frequently used and that there are few resources that teach us how to integrate all the moving pieces together. I hope that, by making this article available, Java developers that use Spring and mainly those that use JSF (which heavily depends on HTTP session) will be able to scale their application without struggling so much.

Horizontal Scaling JSF Applications with Spring Session

7752008352217db815996ab04aec46e6?s=80 avatar

7752008352217db815996ab04aec46e6?s=80

Matias Quaranta

Learn how to integrate Azure DocumentDB as your Auth0's custom user database and take advantage of this blazing fast cloud NoSQL database service.



---

**TL;DR:** In this article you will learn how to integrate Auth0 with the fast and scalable Azure DocumentDB as a custom database connection and use it in your Auth0 applications.

---

Auth0 offers a highly performant and secure user store to maintain your users’ profiles. It is also a common solution if you want to **store** your users’ login information in your **own database** where you keep all of your application's data; in this case, Auth0 provides you with several identity providers you can use to **integrate**. One such database is **Azure DocumentDB**, a blazing-fast **NoSQL** service for highly available and globally distributed applications.

During this article, we will guide you into **integrating Auth0 and Azure DocumentDB** so your users' profiles are stored on your cloud NoSQL database.

## Authentication integrated

Let’s start by noting the **diversity** of custom database identity providers that Auth0 supports.

This list includes MySQL, Sql Server (both on-premises and on Azure), PostgreSQL, ASP.NET Membership Providers, any Basic Auth web service and **MongoDB**. We will focus on this last one since Azure DocumentDB now supports the [MongoDB protocol](https://azure.microsoft.com/documentation/articles/documentdb-protocol-mongodb/).

![Auth0 custom providers list](https://images.ctfassets.net/23aumh6u8s0i/5YDcN2Zobu6KIQKTwo7Mz6/ceb7fe5f1f58b9d5f97f041b336469b1/providers)

>You can see the full Custom Database Identity providers' documentation in the [official docs](https://auth0.com/docs/connections/database).

The integration is achieved by **customizable [Node.js](https://nodejs.org/en/) scripts** that can be coded directly on Auth0’s configuration dashboard manually or using a wide array of templates.

To _sum up_, we will be using the MongoDB protocol supported by Auth0 identity provider to connect to our Azure DocumentDB and store/retrieve our users' information by custom Node.js scripts.

## Creating our database

As we mentioned before, Azure DocumentDB supports the [creation of databases that support the MongoDB protocol](https://azure.microsoft.com/documentation/articles/documentdb-create-mongodb-account/) (as of the writing of this article, this feature is in preview). We must access the [Azure Portal](https://portal.azure.com/) and filter for DocumentDB services to find the version with MongoDB support:

![Searching the Azure Portal](https://images.ctfassets.net/23aumh6u8s0i/46tUO7aKgIngsjtt5o9Xl2/e2f9d8067bcc32913bd769aefefd6760/portal-search)
![Creating our Azure DocumentDB service](https://images.ctfassets.net/23aumh6u8s0i/4jnaA1af9wBqZcRYBd0SWw/40b5cd80f5a9057695378347e9c21352/portal-creation)

Once created, we will be able to access our **connection string** credentials on the instance blade. We need to take note of these values because we will use them later on the integration:

![Obtaining connection string](https://images.ctfassets.net/23aumh6u8s0i/5VhrjNoe4P21IxjEZbATHN/d210f820991d41aae13cae6600f1144b/portal-connectionstring)

After creating our service, we will proceed to create a **Database** and a **Collection** to store our data. If you are not familiar with the Database and Collection concepts for NoSQL databases, a Database can hold multiple Collections and each Collection will store Documents (in JSON format). You will be [billed](https://azure.microsoft.com/pricing/details/documentdb/) for _each Collection_, so plan your distribution accordingly.

>You can review the complete concept diagram in the [official documentation](https://azure.microsoft.com/documentation/articles/documentdb-resources/).

We will create an "auth0" database:

![Creating a database](https://images.ctfassets.net/23aumh6u8s0i/4Hpv8gIPflHC4ZVq3JV937/c6cb4db948cfef16a89c956c75bfd35b/portal-db)

And a "users" collection:

![Creating a collection](https://images.ctfassets.net/23aumh6u8s0i/1tsbGjkzMWA2bd5MfmdFGF/8bff858ba192585b62912b862390809f/portal-collection)

Azure DocumentDB lets you define a [dynamic and scalable throughput](https://azure.microsoft.com/documentation/articles/documentdb-performance-levels/) you can increase later as your application demands.

## Establishing the integration

In this step, we will use the connection string information we collected in the Azure Portal to create a **custom database provider**. In your Auth0 Dashboard, you will see a _Connections > Database_ configuration section:

![Auth0's Dashboard Connections menu](https://images.ctfassets.net/23aumh6u8s0i/3idCEu1z2jGhv12IZQOtLJ/1807cdf3162958eb5c7b9326831bdd12/dashboard-menu)

Once there, you can _Create a Db Connection_:

![Create Db Connection](https://images.ctfassets.net/23aumh6u8s0i/6tTuSPvTpnDkco5veH8nfc/6c87a231fa925cc5810349da4d6117d9/dashboard-button)

You will be asked for a _name_:

![Setting up Connection name](https://images.ctfassets.net/23aumh6u8s0i/2Udn4YepEwyH7ZQOpCdTYj/3a06b87a52342b5c13e8c8dc527ed1f9/dashboard-connection)

Once created, we will go to the Custom Database tab and enable the "**Use my own database**" toggle, which will activate the lower **Database Action Scripts** section.

The Auth0 editor allows us to define global variables to reuse on all our Node.js scripts. Let's start by setting a _global_ connection string; on the Settings subsection, we create a "ConnectionString" key and paste the Connection String value we obtained from the Azure Portal with the added _database_ name. 

Your copied string looks like this:

`mongodb://<your_service_name>:<your_password>==@<your_service_name>.documents.azure.com:10250/?ssl=true`

We will add the _database name_ after the port, like this:

`mongodb://<your_service_name>:<your_password>==@<your_service_name>.documents.azure.com:10250/auth0?ssl=true`

![Setting up global variable](https://images.ctfassets.net/23aumh6u8s0i/1U1XHtXLeqod4jdZzXIuAI/4518a6c11d470ac1bab4f15153b38483/dashboard-variable)

In our Node.js scripts, we can access this value by the global variable `configuration.ConnectionString`.

Now, we will define our custom _Login_, _Create_, _Verify_, _Change Password_ and _Delete_ scripts using our predefined variable:

__Login__

```javascript
function login (email, password, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
    users.findOne({email: email}, function (err, user) {


if (err) return callback(err);

      if (!user) return callback();

      if (!bcrypt.compareSync(password, user.password)) {
        return callback();
      }
      callback(null,   {
        user_id:      user._id.toString(),
        nickname:     user.nickname,
        email:        user.email
      });

    });  
  });
}
```

__Create__

```javascript
function create (user, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');

    users.findOne({ email: user.email }, function (err, withSameMail) {

      if (err) return callback(err);
      if (withSameMail) return callback(new Error('the user already exists'));

      user.password = bcrypt.hashSync(user.password, 10);

      users.insert(user, function (err, inserted) {  
        if (err) return callback(err);
        callback(null);
      });
    });
  });
}
```

__Verify__

```javascript
function verify (email, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
    var query = { email: email, email_verified: false };

    users.update(query, { $set: { email_verified: true } }, function (err, count) {
      if (err) return callback(err);
      callback(null, count > 0);
    });
  });
}
``` 

__Change Password__

```javascript
function changePassword (email, newPassword, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');

    var hashedPassword = bcrypt.hashSync(newPassword, 10);

    users.update({ email: email }, { $set: { password: hashedPassword } }, function (err, count) {
      if (err) return callback(err);
      callback(null, count > 0);
    });
  });
}
```

__Delete__

```javascript
function remove (id, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
      var o_id = new mongo.ObjectID(id);
      users.remove({ _id: o_id }, function (err) {
      if (err) return callback(err);
      callback(null);
    });
  });
}
```   

And we can **test** the connection by running the _Create_ script from within the interface:

![Testing the connection](https://images.ctfassets.net/23aumh6u8s0i/DbMIqtC0nxWl2bUN7zb9l/7debe09b03d5fdc9752207aa90a3f99c/dashboard-test)

If we query the content of the Azure DocumentDB collection through the Azure Portal, we will find our created user:

```json
{
    "_id": {
      "$oid": "57f2983189b7550100e909e4"
    },
    "tenant": "ealsur",
    "connection": "DocumentDB",
    "email": "ealsur@ealsur.com.ar",
    "password": "$2a$10$hiSfzkpLjQUXivV4AvdakOCsTqDAYeSAx1Dn2HfPW6XuU28i5wgpq",
    "debug": true,
    "id": "57f2983189b7550100e909e4",
    "_rid": "u11qAL9JdQATAAAAAAAAAA==",
    "_self": "dbs/u11qAA==/colls/u11qAL9JdQA=/docs/u11qAL9JdQATAAAAAAAAAA==/",
    "_etag": "\"08007436-0000-0000-0000-57f298320000\"",
    "_attachments": "attachments/",
    "_ts": 1475516462
}
```

As you can see, this is a plain JSON object that is readable through any application-consuming collection.

Finally, we can create a new **Client Application** and define that we will use our custom Azure DocumentDB database on the **Connections** configuration.

>For a detailed concept explanation, you can read the [official Applications documentation](https://auth0.com/docs/applications).

![Defining the Application connection](https://images.ctfassets.net/23aumh6u8s0i/1T6umRxNDrBYvHLJzEMZN4/eb196da1bda24bf6d9ed569709c92a2e/dashboard-setup)

This will let our Client Application access and use the DocumentDB identity provider.

## User profile customization

Since Azure DocumentDB uses JSON to store our user profiles, we can take advantage of this dynamic data format and customize our **users' profile data** during sign-up.

To achieve this, we can use [Auth0's Lock](https://auth0.com/docs/libraries/lock) and configure the [required additional signup fields](https://auth0.com/docs/libraries/lock/v10/customization#additionalsignupfields-array-). This will generate the new fields and store them on our collection as part of the user profile without any extra work.

>You can also view the complete [Custom Signup documentation](https://auth0.com/docs/libraries/lock/v10/custom-signup) for a more detailed explanation.

## Conclusion

Auth0’s custom database **flexibility** lets us use one of the most dynamic and fast NoSQL service offerings available. Azure DocumentDB has the ability to **scale** and grow as your business or application does in a seemingly easy way.


Planet-scale authentication with Auth0 and Azure DocumentDB

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Yahoo has confirmed that in late 2014, at least 500 million user accounts were stolen in a large-scale data breach, exposing names, emails, and more.



---

## Half a billion Yahoo accounts were leaked in large-scale data breach

Yahoo has confirmed that 500 million user accounts were exposed in a massive data breach that occurred in late 2014. Breached data potentially included users' names, emails, phone numbers, birthdates, hashed passwords, and in some cases, encrypted or unencrypted security questions and answers. Yahoo claims that financial information such as bank accounts or credit card credentials were not included in the breached data.

The official notification from Yahoo's Chief Information Security Officer Bob Lord can be read here: [An Important Message About Yahoo User Security](https://yahoo.tumblr.com/post/150781911849/an-important-message-about-yahoo-user-security).

Yahoo announced that the company believes the hacker to be a state-sponsored actor: a hacker acting on behalf of a non-US government. A spokesperson for the FBI said they are aware of the intrusion and investigation is underway.

[Verizon is currently in the process of acquiring Yahoo for $4.8 billion](http://www.usatoday.com/story/tech/news/2016/07/25/verizon-winner-yahoo-sale/87500668/). Verizon was made aware of the data breach within the last couple of days, but a spokesperson for the communications company claims Verizon has "limited information and understanding of the impact [of the security incident]."

To comprehend the scope of this attack, let's compare it to another within the last decade. In 2007, the [TJX data breach](http://www.nbcnews.com/id/21454847/ns/technology_and_science-security/t/tjx-breach-could-top-million-accounts/#.V-RR99yClTY) exposed 94 million credit and debit card accounts. At the time, it headlined as the biggest cybersecurity attack ever. At an estimated minimum of 500 million, the Yahoo incident leaked over five times as many accounts, making it the new largest data breach in history.

Yahoo asserts that they are notifying potentially affected users. The company is also recommending that users update their passwords and security questions if they have not done so since 2014. 

Although financial data may not have been leaked in the Yahoo data breach, Yahoo also provides login for [Flickr](https://www.flickr.com/) as well as [Oauth](https://developer.yahoo.com/oauth/) for third party websites. In addition, users frequently reuse the same email addresses and passwords for multiple accounts. When user credentials are leaked, it can compromise many more accounts than the one specifically exposed.  

## Aside: Protect your users from password leaks with Auth0

Auth0 provides breached password detection that can be enabled simply and easily. The Auth0 security team maintains a database of third party breached credentials. This database is updated daily. On each login, user credentials are checked against the leaked passwords database. If a breach is suspected, the user is notified and cannot log in until they change the compromised password.

<video autoplay loop width="600">
  <source src="https://cdn.auth0.com/blog/breach/lock-2.m4v"/>
<img src="https://images.ctfassets.net/23aumh6u8s0i/3DpdlDPwLfrdGGb7RUQ6NU/d959326b776a71764727d5e3eae43c8a/lock"/>
</video>

Read about [Breached Passwords](https://auth0.com/breached-passwords) and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) to learn more about how to protect users and their credentials with Auth0. You can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>!



Yahoo Confirms Data Breach of Half a Billion User Accounts

667b1c82b6cc2241ff176d50c65da603?s=200 avatar

667b1c82b6cc2241ff176d50c65da603?s=200

Eugene Kogan

Security is a challenge at most startups. Here's some advice on how to create a data breach response plan for the worst case scenario, a large-scale data breach.



A serious data breach can have massive negative repercussions for any organization, including the loss of customers, revenue, reputation, even intellectual property. For a startup, it can mean the end of your business. 

## Security for the Lean Startup

Unfortunately, startups are often completely unprepared to deal with a major security incident that involves a breach of sensitive data. Unlike larger, more mature organizations, startups have no choice but to be lean and spend their limited resources carefully. Startups are also worth much less than bigger companies, and all of their energy is focused on growth and proving a business model. So it’s no wonder that they tend to spend less time and money on issues like security, let alone data breach response.

On the other hand, no one wants to see their fledgling company go out of business because of a security breach. So how much time and money does it make sense for a startup to invest in preparing for a breach? I think of planning for the worst as somewhat of an insurance policy. You hope that a data breach doesn’t happen to your company. You put some effort into preventing one through reasonable security controls. But just in case something goes wrong (like if that small security incident suddenly becomes a breach of your credit card database) you want to be prepared.

Now that I’m responsible for security at Auth0, issues like this are increasingly on my mind. It’s my first time working at a startup, having spent the last 15 years working security at huge organizations like AT&T, Amazon.com, and the US Department of Defense. These folks are seriously prepared for anything, from a laptop with malware to a major natural disaster. But when you join a startup, you quickly learn how to pave the road as you’re driving it. Auth0 is a rare startup, since security has been a core part of our business from day one. But even for us, it can be hard to find enough time to plan for unlikely (yet potentially devastating) scenarios like a data breach.

## Data Breach Response Plan is sort of a Big Deal

Let’s assume your startup has enough valuable intellectual property, a growing user base, and increasing amounts of customer data. It’s likely that you’re already dealing with security incidents on a regular basis. You have a decent incident response plan that is sufficient for the common security issues that small companies face, and it’s probably not a big deal to quietly take care of these in-house.

A data breach is not a run of the mill security incident. What I’m talking about here is a major “oh crap” moment when you realize your entire user database was posted on Pastebin, along with those passwords you meant to [hash](https://crackstation.net/hashing-security.htm) with something better than SHA-1 but didn’t quite get around to doing. (It’s ok, we’re a startup, right? No! Bad startup! That’s what [Auth0](https://auth0.com) is for.)

## Planning for the Worst

So how would your company respond to such a breach? Do you know the legal requirements for notifying your customers? Should you contact law enforcement? Who do you call first and how long can you wait? Every data breach is different, so I’m not going to attempt to provide specific answers to these questions. A lot will depend on how big your business is, how many users were impacted, where they live, what kind of data was lost, and so on. 

** My goal is to help startups prepare for a data breach and to come up with a simple response plan without spending too much money. **

For a small company trying to respond to a major security incident like a data breach, the best thing to do is to ask for help. It’s just not practical or realistic to have all the necessary expertise in-house, at least not until your business can justify having a very large (and expensive) information security organization.

** I recommend having the following relationships in place _before_ you need them: **

* Cyber liability insurance
* Legal council with data breach experience
* Public relations (PR) firm with data breach experience
* Incident response (IR) and digital forensics consulting firm

Having these vendors under contract prior to an incident occurring is critical. I hope it’s obvious why you’d want cyber insurance in advance, just like you’d want car insurance before getting into an accident. But there are several good reasons for lining up the rest of your response network in advance. First is the issue of timeliness. It takes time to negotiate a contract with a new vendor, even at a startup. But when you’re responding to an incident, you don’t have any time to spare. You’re already late! Also, a lot of the best vendors will be booked up for weeks in advance, working for their current customers. If your plan is to call an IR firm and hope that they can come help you later today, you will be sorely disappointed (or shocked by how much they want to charge you).

## The Costs Involved

Speaking of cost, there are ways to help reduce the upfront expense of being prepared while simultaneously reducing the cost of an eventual response. Lawyers are expensive, and I don’t have any tips on fixing that problem just yet. So pick a good lawyer with a track record of working on major data breaches, and sign a contract to have him or her on a retainer. You should be able to do this without paying much (or anything) up front.

A public relations firm will be a major asset when it comes time to communicate with your customers. The way a company handles a data breach in the public eye can have a huge impact to how people react. You want to provide just enough details but no more, be accurate so you don’t have to issue a correction later, and take responsibility when appropriate. A PR firm with experience in dealing with data breaches will be able to help you get the right message across. That can go along way to mitigating the damage to your reputation and hopefully reducing the number of lost customers. Once you have a PR firm finalized, it may be worth paying them to draft up some boilerplate press releases for potential breach scenarios, just to save time later on.

Something to keep in mind is that even if you already have a PR firm that your startup uses for standard PR needs, they might be totally clueless when it comes to security incidents. You need to ask them the right questions to find out. If your current firm isn’t up to speed, it’s worth having a second PR firm on board just for breach response. Remember, you want to take responsibility for what happened and be honest in your communications, so don't let anyone try to talk you into denying everything or shifting blame.

## Using an Incident Reponse Firm

Do you really need an external IR firm to help you respond to a data breach? If you’re a startup, the answer is almost definitely _yes_. First of all, it’s unlikely that you have a security team with deep technical expertise in digital forensics. You need that expertise to be certain that the cause and extent of the breach has been accurately identified. And if you can’t be sure of that, then you can’t be sure the breach has been fully contained. This is especially true if the cause is an intentional intrusion by an attacker, who may be actively evading your response efforts. For a serious breach that involves law enforcement, you’ll be grateful to have security consultants with LE backgrounds helping you out.

Even with a team of experts, there is never a 100% guarantee that everything has been found and cleaned up. But you stand a much better chance of doing this correctly if you engage an experienced IR firm. Also, when it comes time to do a press release, having a well-known firm on your side will help your users feel like you’re taking the incident seriously.

When choosing an incident response firm, reputation goes a long way. The firms with better reputations attract better talent, at least on average. As always, it pays to ask around for recommendations from people you trust. The bigger firms are generally all decent, and will have several advantages over the smaller firms. First, all major firms offer a zero cost retainer option, so you can sign a contract and have them ready to go without spending any money upfront. Second, they will probably be quicker to respond than a smaller firm, simply because they have more consultants available at any given time.

Another advantage bigger firms have (not just IR, this goes for PR and legal as well) is their breadth of experience. This can be especially important if your startup has customers in foreign countries with strict privacy laws or notification requirements, or if you’re using a complex or niche technology stack. Is your product built with OpenBSD, Scala, and Spark, hosted on Oracle’s cloud? You should probably make sure the IR firm has people with experience using those technologies. Startups tend to be on the bleeding edge and most security consultants simply can’t keep up.

## You Need Insurance

Up until now I’ve mostly avoided talking about cyber insurance, partially because I hate the word “cyber.” But the reality is that every significant business should have some cyber liability coverage to help absorb the financial burden of a large-scale data breach. You will need a policy that’s tailored to your company, its projected growth, and the risks associated with your industry.

The first step to getting cyber insurance is to find a knowledgeable broker. It pains me to say this, since we techies generally don’t enjoy dealing with middlemen like brokers, but that’s really the only way to go at this point (until a startup comes along and successfully disrupts this model). Again, ask your industry peers for recommendations on a cyber insurance broker, and don’t assume your regular business insurance guy will know anything about this stuff. If you start this process with the wrong broker, you may end up with an inappropriate policy that will fail you when it comes time to file a claim.

Selecting a cyber insurance policy should actually be one of your first steps, once you have a clueful broker and a basic incident response plan in place. The reason for this is that almost all agencies will have a list of approved vendors that you’re strongly suggested to use in the event of an incident. They have pre-negotiated rates with these vendors, and they are (allegedly) vetted and deemed competent. It’s usually possible to get an exception to use a vendor that’s not on your insurance agency’s list, but that means jumping through more hoops to get them approved. If you go down this road, your broker should help you out and provide advice. So if you have a particular PR or IR firm in mind that you really want to work with, you should let your broker know before you start shopping around for a policy. I don’t recommend signing any contracts until you are sure that your cyber insurance policy will allow you to work with the vendor in question. This includes legal council and other vendor categories that I haven’t even mentioned, such as credit monitoring and notification service providers.

## The 8-Step Plan

** Here’s my recommended action plan for getting your startup in a good place, ready to respond to a large-scale data breach: **

1. Think about security, work on improving it, and have a decent incident response plan.
1. Document some potential data breach scenarios that your company might face, including the kinds of data that might be impacted, the number of users you have, where they’re located, and so on.
1. Contact a few cyber insurance brokers, ideally from trusted recommendations. Pick one who is knowledgeable and willing to work with startups.
1. Work with your broker, CFO, and security team to find a policy that meets your requirements.
1. Be aware of the agency’s approved vendor list, and ask for exceptions (if you have any in mind) before buying a policy.
1. Carefully select vendors to help you in case of a breach. That includes at least legal, PR, and IR firms.
1. Sign a contract with these vendors so that they are ready to help you respond at a moment’s notice. Go for zero cost retainers if that makes financial sense for your business.
1. Review all of the above as your startup grows and changes over the year. If your revenue explodes, you will need to increase your insurance coverage sooner rather than later.

<include src="TweetQuote" quoteText="Think about security, work on improving it, and have a decent incident response plan."/>

You can never be too prepared when it comes to security. So what are you waiting for?


"scale"