Maria-v

Maria Vasilevskaya is a leading Identity Defense Security Engineer at Okta. With her extensive experience in identity security, she has held diverse roles including security executive advisory, professional consulting services, identity and security solutions architecture, and solutions engineering. Her primary objective at Okta is to empower customers in maintaining robust security postures by offering expert assistance during critical incidents and providing strategic advice on implementing security practices to prevent future crises.

Principal Security Engineer

Maria Vasilevskaya

Matthew-w

Director, Threat Intelligence

Mathew Woodyard

Discover the Auth0 Security Detection Catalog, a new open-source resource on GitHub that provides actionable intelligence and proactive threat updates to boost your security efforts.

Level Up Your Security Posture with the Auth0 Security Detection Catalog

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Strengthen your authentication, threat detection, and volume capabilities before the games.


![Tokyo 2020 Emblems](https://tokyo2020.org/assets/img/pages/games/emblem/emblem.jpg)

[_Source: Tokyo 2020 Emblems_](https://tokyo2020.org/en/games/emblem/)

The [Tokyo 2020 Olympics](https://tokyo2020.org/en/) might seem far away — yet for lead engineers in charge of streaming the games, it’s not far enough.

Tokyo will have a total of [_33 official sports_](https://www.nbcnews.com/news/world/tokyo-2020-summer-olympics-everything-you-need-know-n849301) — five more than the Rio Summer Olympics in 2016. In particular, new sports like surfing, skateboarding, sport climbing, and karate target younger viewers who are accustomed to watching sports (and e-sports) online, uninterrupted, and at high resolution. 

In 2018, major broadcasters like NBC streamed [_thousands of hours_](https://techcrunch.com/2017/11/16/nbc-will-live-stream-a-record-1800-hours-of-the-2018-winter-olympic-games/) of events. The BBC broke viewing records with [22.2 million streams](https://www.bbc.co.uk/mediacentre/latestnews/2018/most-streamed-winter-olympics-to-date). The pressure is on in 2020 to reach and impress an even larger audience.

Delivering a high-quality Olympic viewing experience is an enormous challenge from both a bandwidth and a security point of view. [Over 100 million unique users](http://www.nbcuniversal.com/press-release/nbc%E2%80%99s-rio-olympics-most-successful-media-event-history) watched the Olympics across NBC’s digital platforms alone in 2018 — nearly a 30% jump over London’s 2012 games. Users logged in to watch the games on-the-go and on myriad devices. NBC had to build out its operations and rely on more than 1,100 staff to maintain consistent service. 

Since then, the risks for video streamers have become more visible and acute. [In February of 2019](https://techcrunch.com/2019/01/02/chromecast-bug-hackers-havoc/), hackers exposed a vulnerability in Chromecast streaming devices that allowed them to play any video they wanted. More recently, on March 2019, free movie streaming site Kanopy disclosed a [significant breach](https://www.digitaltrends.com/home-theater/kanopy-streaming-data-breach/) of its users’ personal information, including geolocation, device type, and IP address. Hackers know how popular subscription streaming services are today — and are anticipating the 20-day bump that will start next July. 

Below, we offer three ways to future-proof your team’s streaming system, so you can deliver the safe yet thrilling experience your users expect.

## 1. Seamlessly and Securely Authenticate Your Users

Many users watching the 2016 Rio Games online were disappointed. Poor buffering, slow load times (occasionally [_up to 4 hours_](https://www.theverge.com/2016/8/26/12646224/nbc-rio-olympics-2016-coverage-tv-ratings-streaming) in parts of the U.S.), and mediocre in-app experiences caused frustration. Live streaming has been a major part of the Olympic experience since the 2008 Beijing Games. After more than a decade, it’s difficult to excuse subpar services.

Staggered visuals and outages are more than embarrassing. They can lead to declines in user engagement and revenue loss if advertisers seek other platforms.

One way to quickly and significantly improve your user experience is to implement better authentication measures. If a user is pleased with a simple, frictionless initial login — and can access content easily thereafter — it sets the stage for a rewarding, long-term relationship.

A third-party service like Auth0 can help you seamlessly implement features like [_single sign-on_](https://auth0.com/single-sign-on) (SSO) that make authentication painless and highly effective. Particularly when users require access to several applications simultaneously or in quick sequence, SSO allows them to simply log in once — regardless of their platform, technology, or domain.

![Example of single sign-on across apps](https://images.ctfassets.net/23aumh6u8s0i/3lzfDU5IDcS7PMe04OFltU/1fa68a5d13fc8e4160bd58f495d9525b/example-of-single-sign-on-across-apps)

Auth0’s SSO feature has [built-in security certifications](https://auth0.com/single-sign-on), including OpenID Connect, OAuth 2, and LDAP. In addition, it’s already SOC 2 and GDPR compliant — so if you’re concerned about protecting a volume of customer data, Auth0 can help with much of the heavy lifting.

Another way to offer your users smooth authentication and authorization is [Device Flow](https://auth0.com/device-flow/), a fast, easy, and safe way to log into limited-input devices. Auth0 offers a fully compliant implementation of the [OAuth 2.0 Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/) so you can take advantage of the security and user experience benefits of a standard delegated authorization protocol.

Taking the time to create a richer user experience doesn’t have to be a drain on your resources. Zeroing in on a pain point like authentication can improve multiple issues simultaneously — making you at once more organized, more secure, and more delightful to your audience.

## 2. Detect Threats before They Snowball 

Cybercrime is on the rise — and according to [_recent data from Akamai_](https://www.akamai.com/us/en/about/news/press/2019-press/state-of-the-internet-security-credential-stuffing-attacks-and-economies.jsp), streamers have emerged as top targets.

In this challenging environment, which will likely become even more dangerous leading up to 2020, it’s critical to take every precaution to protect the customers on your platform.

Simple yet powerful [_anomaly detection features_](https://auth0.com/docs/anomaly-detection) can help you quickly catch common threats — and take immediate action to block their progression. 

Auth0’s [_brute-force shield_](https://auth0.com/docs/anomaly-detection#brute-force-protection), for example, triggers after a set number of failed login or sign up attempts from the same IP address. The shield automatically notifies the administrator, who can immediately respond.

![Image of Auth0 Brute Force Shield](https://images.ctfassets.net/23aumh6u8s0i/4TwHT9UbSxQY9znGFp4p16/f05467dc9a90258258d9c44ff1e38143/image-of-auth0-brute-force-shield)

On the back end, admins can tailor their response to a suspected attack in a number of ways, including:

* Blocking the suspicious IP address
* Sending a [_customized email_](https://auth0.com/docs/anomaly-detection/references/brute-force-protection-triggers-actions#customize-the-blocked-account-email) to the affected user, and/or
* Whitelisting the account, so it doesn’t erroneously trigger a reply in the future

If admins are able to verify the user’s identity and resolve the issue, they can also easily remove the block via an email link.

A tool like brute-force protection is particularly useful with subscription services — where major data leaks have left [millions of user credentials exposed](https://www.troyhunt.com/pwned-passwords-version-5/) to hackers. 

With this cache of personal information, it’s easy for cybercriminals to develop algorithms that churn through username/password combinations — rapidly testing them against a login screen — until they gain access. 

The bad news is that since consumers worldwide expect to [_increase their number of subscriptions_](https://www.emarketer.com/content/which-subscription-services-will-us-consumers-sign-up-for-next), the surface area for such attacks continues to widen. The good news is that it’s not hard to bolster or build your platform to keep these attempts in check. Offloading this specific concern to a third party can also free up your technical talent to focus on larger, more complex tasks that directly relate to your efforts to scale.

## 3. Easily Handle Increased Volume

Even if you’ve developed a winning UX and strengthened your platform against major attacks, video streamers still face the challenge of making sure their service is robust enough to handle the surge in viewers expected for the Olympics.

Now is the time to be updating legacy systems, load testing, and determining specific gaps so that you can make necessary changes in time for Tokyo.

One way to do this is to develop your technology in-house. This has the potential to give you more ownership and flexibility over your outcomes. Yet many teams can’t afford to dedicate the time and engineers required to make these systemic changes. 

A second option is to buy your solution. In this case, it’s critical to find technology you can tailor to fit your needs. Every company is different — and will have different needs as it evolves. There is no one-size-fits-all product or suite of products that instantly delivers on volume, security, and design.

For this reason, at Auth0, we’ve built flexibility into our core. Every tool and feature we provide comes with [extensions](https://auth0.com/docs/extensions) — ways to run commands/scripts that enlarge the functionality of the base product. Whether it’s SSO, anomaly detection, advanced authentication features, or tools for better [user management](https://auth0.com/user-management) — Auth0 has specific [Rules](https://auth0.com/docs/rules) and [Hooks](https://auth0.com/docs/hooks) that adapt our technology to serve yours. 

## Be a Team Player

Preparing your platform for an enormous uptick in demand and increasing security threats — all while remaining fun and easy-to-use on the front end — might seem like an unwieldy and expensive task. 

Whether you build or buy the solutions you need, you’ll be dedicating significant financial and human resources in a tight time frame. Partnering with a team who has done this before can make all the difference — and the [ROI](https://auth0.com/forrester-total-economic-impact/) is often much higher than teams think. 

You’ll speed up time to implementation, reduce security costs, and free your engineers to double down on core, revenue-driving products. 

You don’t have to dread the Olympics. If you update your platform now, by the time 2020 rolls around, you too could be in the audience.

<include src="asides/AboutAuth0" />


"threat detection"