37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Essential practices for securing AI-generated code, key security considerations for your full-stack application, deployment, and infrastructure precautions.

Generate More Secure Code With AI-Powered Tools

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Learn how to build a tool-calling AI agent using LangGraph, Vercel AI SDK, and Next.js. Integrate different kinds of tools into them. Use Google services like Gmail, Calendar, and Drive as tools secured using Auth0 Token Vault.

**AI agents** and **Operators** are the next big things in software development. In a [previous post](https://auth0.com/blog/genai-tool-calling-intro/), we discussed how AI agents are taking center stage by seamlessly integrating with multiple digital tools to be more efficient. In this post, we will build a personal assistant that can use different types of tools. Both simple unauthenticated tools and more complex authenticated tools like Gmail, Calendar, and Google Drive.

If you haven't read the previous post, I recommend you do so before continuing to better understand tool calling in AI agents and how security is currently handled.

<include
 src="LinkCard"
 title="Tool Calling in AI Agents: Empowering Intelligent Automation Securely"
 link="https://auth0.com/blog/genai-tool-calling-intro/"
 description="Discover how AI agents are taking center stage by seamlessly integrating with multiple digital tools to be more efficient. Learn why it is important to secure them."
 img="https://images.ctfassets.net/23aumh6u8s0i/4LrNhImjPcdPVpmCIrhlG9/4efed8dfb26630e6cf48b4a478a1f550/genai-tool-calling-intro.png"
/>

To keep this post focused on tool calling, we will only focus on the AI agent part, not the UI. Each tutorial step, including building the UI, can be found as a distinct commit in the [GitHub repository](https://github.com/auth0-samples/auth0-assistant0).

## Technology Stack

We will use a [Next.js](https://nextjs.org/) application called **Assistant 0** as the base. Assistant 0 is an AI personal assistant that consolidates your digital life by dynamically accessing multiple tools to help you stay organized and efficient.

Apart from Next.js, we mainly use the following technologies:

- [LangGraph.js](https://langchain-ai.github.io/langgraphjs/) and [LangChain's JavaScript framework](https://js.langchain.com/docs/introduction/) for building agentic workflows.
- [LangChain community tools](https://js.langchain.com/docs/integrations/tools/).
- Vercel's [AI SDK](https://github.com/vercel-labs/ai) to stream response tokens to the client and display the incoming messages.
- The [Auth0 AI SDK](https://github.com/auth0-lab/auth0-ai-js) and [Auth0 Next.js SDK](https://github.com/auth0/nextjs-auth0) to secure the application and call third-party APIs.

## Prerequisites

> **You will need the following tools and services to build this application**:
>
> - [Bun v1.2](https://bun.sh/) or [NodeJS v20](https://nodejs.org/en/download)
> - An Auth for GenAI account. [Create one](https://a0.to/ai-content).
> - An OpenAI account and API key. [Create one](https://platform.openai.com) or use any [other LLM provider supported by LangChain](https://js.langchain.com/docs/integrations/llms/).
> - A SerpAPI account and API key. [Create one](https://serpapi.com/).
> - A Google account for Gmail, Calendar, and Drive. Preferably a new one for testing.

## Getting Started

First clone [the repository](https://github.com/auth0-samples/auth0-assistant0) and install the dependencies:

```bash
git clone https://github.com/auth0-samples/auth0-assistant0.git
cd auth0-assistant0
git switch step-1 # so that we skip building the UI and get straight to the AI agent

bun install # or npm install
```

Next, you'll need to set up environment variables in your repo's `.env.local` file. Copy the `.env.example` file to `.env.local`. To start, you'll just need to add your OpenAI API key.

Now, start the development server:

```bash
bun dev # or npm run dev
```

Open `http://localhost:3000` with your browser to see the result! Ask the agent something, and you'll see a streamed response.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/ePzgV9PLYqmwdsqdJC2VU/3507e783ee8199b6a5599742ef81fed7/assistant-0.png)

### A Peek into the Code

The application is structured as follows:

- `src/app`: Contains the Next.js application routes, layout, and pages.
- `src/app/page.tsx`: Home page with chat interface.
- `src/app/api/chat/route.ts`: API route for handling chat requests. This is where the AI agent is defined.
- `src/components`: UI components used in the application.
- `src/lib`: Services and configurations. This is where custom tools will be defined.
- `src/utils`: Utility functions

Let's take a look at the `src/api/chat/route.ts` file where the AI agent is defined.

```js
// src/api/chat/route.ts
// ...
const AGENT_SYSTEM_TEMPLATE = `You are a personal assistant named Assistant0.
You are a helpful assistant that can answer questions and help with tasks.
You have access to a set of tools, use the tools as needed to answer the user's question.`;

export async function POST(req: NextRequest) {
  // ... Process the request and get messages
  // Create a new OpenAI chat model
  const llm = new ChatOpenAI({ model: "gpt-4", temperature: 0 });
  const tools = [];
  // Use a prebuilt LangGraph agent.
  const agent = createReactAgent({
    llm,
    tools,
    messageModifier: new SystemMessage(AGENT_SYSTEM_TEMPLATE),
  });
  // Stream back all generated tokens and steps from their runs.
  const eventStream = agent.streamEvents({ messages }, { version: "v2" });
  // Log tool calling data. Only in development mode
  const transformedStream = logToolCallsInDevelopment(eventStream);
  // Adapt the LangChain stream to Vercel AI SDK Stream
  return LangChainAdapter.toDataStreamResponse(transformedStream);
}
```

The route uses a prebuilt LangGraph agent and OpenAI chat model. No tools are defined yet; we will add them in the next section.

Here is a high-level architecture of the application with the tools we will be adding in this post.

![Assistant 0 architecture](https://images.ctfassets.net/23aumh6u8s0i/6ZTtsivmBOPUmKGWx479Xm/d8d90c3bf3f24f1c8ce99ff703a1ba7d/architecture.jpg)

Now that the base application is running, let's start building our personal assistant with tool-calling capabilities.

## Add Tools to the Assistant

If you recall the previous post, we discussed authenticated and unauthenticated tools. Let's start with an unauthenticated tool and then proceed to add more complex tools like Gmail, Calendar, and Google Drive.

### Add a Calculator Tool

We will start with a simple calculator tool from the LangChain community tools to perform basic arithmetic operations.

Install the `@langchain/community` package.

```bash
bun add @langchain/community # or npm i @langchain/community
```

Update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { Calculator } from "@langchain/community/tools/calculator";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [new Calculator()];
  // ...
}
```

It's that simple! Now, try asking the assistant to perform some calculations. For example, `what is (2+56) x 200`. You should see the answer in the UI. If you check the console where Next.js dev server (`bun dev`) is running, you should see the tool calling data like below.

```bash
Tool calls state: {
 "call_E3Za9klJcJ5TADWiMj8XfjdB": {
   "name": "calculator",
   "args": "{\n  \"input\": \"(2+56) * 200\"\n}"
 }
}
POST /api/chat 200 in 8382ms
```

### Add a Web Search Tool

Now let's add a web search tool to search the web for information. Let's use [SerpAPI](https://serpapi.com/) for this. It's an authenticated tool. But since this is going to be API usage and not a user impersonation, we can simply use an API key.

First, get an API key from SerpAPI and add that to your `.env.local` file.

```bash
SERPAPI_API_KEY=your-api-key
```

Now, update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { SerpAPI } from "@langchain/community/tools/serpapi";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [new Calculator(), new SerpAPI()];
  // ...
}
```

Again, quite simple! Now try asking the assistant to search the web for information. For example, `What is the top 10 news today?`. You will see the response in the UI.

![Assistant 0 web search](https://images.ctfassets.net/23aumh6u8s0i/h4hWDQwBBTUiDh6gdaVET/137647c87dd51c6cc34ec0a44d6e453d/assistant-0-web-search.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
 "call_e8vqAPW45vMsUbFiIF9SW5Yn": {
   "name": "search",
   "args": "{\n  \"input\": \"top 10 news today\"\n}"
 }
}
POST /api/chat 200 in 15443ms
```

This corresponds to the `step-2` branch in case you want to double-check your code.

```bash
git switch step-2
```

### Add Gmail Tools

Now, let's get into business. I know you are here for this part, not to learn about adding calculators and web search tools. But before we can add a Gmail tool, we need to add Auth0 authentication to the application since we will be using Auth0's [Token Vault](https://auth0.com/docs/secure/tokens/token-vault) feature to get access tokens to call the Gmail API via a tool.

#### Add Auth0 Authentication

First, let's add Auth0 as the authentication provider to the application.

Follow the [Auth0 Next.js quickstart guide](https://auth0.com/ai/docs/user-authentication) to set up the application.

> If you want to create the Auth0 application manually, create a new application (Type: **Regular Web App**, Callback URL: `http://localhost:3000/auth/callback`) and get the **client ID** and **client secret**.

Update the `.env.local` file with credentials, and create the `src/lib/auth0.ts` and `src/middleware.ts` files.

If you want to skip to the next step, check out the `step-3` branch. The [full changelog for this step is on GitHub](https://github.com/auth0-samples/auth0-assistant0/commit/9a6db1ec49511afa7c361080c3f5a1854ee8efe5).

```bash
git switch step-3
```

#### Configure Auth0 for Gmail

To use Gmail API with Auth0 via a Google Social Connection, you need to do the following:

- Create Google OAuth 2.0 credentials
- [Enable Gmail API](https://console.cloud.google.com/apis/library/gmail.googleapis.com) for the credentials
- Configure Gmail social connection in Auth0

You can follow the [Google Sign-in and Authorization](https://auth0.com/ai/docs/google-sign-in-and-auth) guide from Auth0 to configure this.

#### Configure Auth0 AI SDK

First, install the `@auth0/ai-langchain` package from [Auth0 AI SDK](https://github.com/auth0-lab/auth0-ai-js).

```bash
bun add @auth0/ai-langchain # or npm i @auth0/ai-langchain
```

Update `src/lib/auth0.ts` with the following code.

```js
// src/lib/auth0.ts
// ...
export const auth0 = new Auth0Client({
  // this is required to get federated access tokens from services like Google
  authorizationParameters: {
    access_type: "offline",
    prompt: "consent",
  },
});

// Get the refresh token from Auth0 session
export const getRefreshToken = async () => {
  const session = await auth0.getSession();
  return session?.tokenSet?.refreshToken;
};
```

Create a new `src/lib/auth0-ai.ts` file with the following code.

```js
// src/lib/auth0-ai.ts
import { Auth0AI } from "@auth0/ai-langchain";
import { getAccessTokenForConnection } from "@auth0/ai-langchain";
import { getRefreshToken } from "@/lib/auth0";

// Get the access token for a connection via Auth0
export const getAccessToken = async () => getAccessTokenForConnection();

const auth0AI = new Auth0AI();

// Connection for Google services
export const withGoogleConnection = auth0AI.withTokenForConnection({
  connection: "google-oauth2",
  scopes: [],
  refreshToken: getRefreshToken,
});
```

#### Add Gmail Search Tool

We can add Gmail tools now that we have Auth0 authentication in place. Let's start with a Gmail search tool. This tool will allow the assistant to search for emails in the user's Gmail account.

First, we need to get an access token for the Gmail API. We can get this using the [Auth0 Token Vault](https://auth0.com/docs/secure/tokens/token-vault) feature.

Update `src/lib/auth0-ai.ts` with the required scopes.

```js
// src/lib/auth0-ai.ts
// ...
export const withGoogleConnection = auth0AI.withTokenForConnection({
  // ...
  scopes: ["https://www.googleapis.com/auth/gmail.readonly"],
  // ...
});
```

Install the `googleapis` package.

```bash
bun add googleapis # or npm i googleapis
```

Import the `GmailSearch` tool from LangChain community tools and update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { GmailSearch } from "@langchain/community/tools/gmail";
import { withGoogleConnection, getAccessToken } from "@/lib/auth0-ai";
// ...
export async function POST(req: NextRequest) {
  // ...
  // Update the LLM model to gpt-4o-mini to support a larger context window
  const llm = new ChatOpenAI({
    model: "gpt-4o-mini",
    temperature: 0,
  });
  // Provide the access token to the Gmail tools
  const gmailParams = {
    credentials: {
      accessToken: getAccessToken,
    },
  };
  const tools = [
    // ... existing tools
    withGoogleConnection(new GmailSearch(gmailParams)),
  ];
  // ...
}
```

We are all set! Now, try asking the assistant to search for emails. For example, `What is the latest unread email?`. You should see the response in the UI.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/14n2drq2woolLeJybBMWk6/3bbc575f92493dc2322f485a6b4f4ac9/assistant-0-gmail-search.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
 "call_rCzcZRjueyD8p2kzTmeZMiSK": {
   "name": "search_gmail",
   "args": "{\"query\":\"is:unread\",\"maxResults\":1,\"resource\":\"messages\"}"
 }
}
POST /api/chat 200 in 10892ms
```

#### Add Gmail Draft Tool

We will add a Gmail draft tool next. This tool will allow the assistant to draft emails on behalf of the user.

Update `src/lib/auth0-ai.ts` with the required scopes.

```js
// src/lib/auth0-ai.ts
// ...
export const withGoogleConnection = auth0AI.withTokenForConnection({
  // ...
  scopes: [
    // ... existing scopes
    "https://www.googleapis.com/auth/gmail.compose",
  ],
  // ...
});
```

Update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { GmailCreateDraft } from "@langchain/community/tools/gmail";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [
    // ... existing tools
    withGoogleConnection(new GmailCreateDraft(gmailParams)),
  ];
  // ...
}
```

Now, ask the assistant to draft an email. For example, `Draft an email to John Doe about the meeting tomorrow.` You should see the response in the UI.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/hWz4f6iUXTacbCNoqxwLz/c16c70d786027012b4c4944639339999/assistant-0-gmail-draft.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
"call_pPAk6rFYJSSyAuYkNWFf5KYX": {
  "name": "create_gmail_draft",
  "args": "{\"message\":\"Hi John,\\n\\nI hope this message finds you well. I wanted to … [Your Name]\",\"to\":[\"john.doe@example.com\"],\"subject\":\"Meeting Reminder\",\"cc\":[],\"bcc\":[]}"
}
}
POST /api/chat 200 in 7594ms
```

You can find the [full changelog of these two steps on GitHub](https://github.com/auth0-samples/auth0-assistant0/commit/020f90f9ca85824f9cf99a82986a91bf72625041).

This corresponds to the `step-4` branch in case you want to double-check your code.

```bash
git switch step-4
```

## Learn more about AI Agents and Auth for GenAI

You have successfully built an AI personal assistant that can search the web, search your emails, and draft emails. In the next chapters, we will switch to a more production-ready architecture and add more tools like User Info, Google Calendar, Google Drive, and Slack to the assistant.

This tutorial is part of a series of posts on tool-calling Agents with [Auth for GenAI](https://a0.to/ai-content). We learned how to add tools to an AI agent and how to secure them using Auth0.

Sign up for [Auth for GenAI in Developer Preview](https://a0.to/ai-content).

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI](https://vercel.com/ai), and [GenKit](https://firebase.google.com/docs/genkit). [Auth for GenAI](https://auth0.com/blog/introducing-auth-for-genai-launching-identity-for-ai-agents/) is our new product to help you protect your user's information in GenAI-powered applications. Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.


Build an AI Assistant with LangGraph, Vercel, and Next.js: Use Gmail as a Tool Securely

Discover how AI agents are taking center stage by seamlessly integrating with multiple digital tools like Gmail, Calendar, Slack, and Google Drive to be more efficient. Learn why it is important to secure them and how to do it.

**AI agents** or **Operators** are the latest trend in AI. At their core, agents are autonomous systems that not only process natural language using Large Language Models (LLMs) but also decide when and how to act by interfacing with external tools and APIs. These smart entities blend machine learning with decision-making capabilities, enabling them to perform complex tasks, interact in real-time, use the most efficient tools to perform certain tasks, and even learn from their environment—all without constant human intervention.

<AmpContent>
<amp-youtube
    data-videoid="r7wEinUG0ns"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  className='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/r7wEinUG0ns'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

## Tool Calling Agents

LLMs on their own are still susceptible to hallucinations and mistakes, but the ability to call tools opens up a whole new world of possibilities where error-prone tasks can be offloaded to a more traditional non-AI tool, like using a calculator to do math rather than relying on the LLM for it. Similarly, tool calling allows AI agents to interface with other applications and services, like Gmail, Calendar, Slack, and Google Drive, to do more for you than just answering questions.

Tool calling can be generally classified into these:

1. **Unauthenticated Tools:** These are tools that don't require authentication and are generally simpler to configure, like a calculator, a weather API, or a unit converter.
2. **Authenticated Tools:** These are tools that require authentication and are generally complex to configure, such as an API provided by another internal application or services like Gmail, Calendar, Slack, and Google Drive.

In an enterprise environment, the authenticated tools can be further classified into:

1. **First-Party Tools:** These are services that are part of the same infrastructure and require authentication, like an API provided by another internal application or a microservice.
2. **Third-Party Tools:** These are external services that require more complex authentication. They could be services that are authenticated using service accounts or API keys, like a payment API, or services that need to be authenticated by the end user, such as Gmail, Calendar, Slack, and Google Drive.

Tool calling provides many key advantages to an AI agent:

- **Autonomous Decision-Making:** AI agents analyze context and determine the next best action, reducing the need for manual oversight.
- **Optimized Task Execution:** They can connect to various services and APIs, enabling them to perform specialized tasks like data retrieval, scheduling, and communication.
- **Scalability and Adaptability:** As systems evolve, agents can easily incorporate new functionalities, adapting to changes in workflow or priorities.
- **Improved User Experience:** Their ability to tackle diverse tasks leads to more personalized and efficient interactions, making technology feel both intuitive and proactive.

## Tool Calling Agent: A Conceptual Example

Imagine an AI personal assistant that consolidates your digital life by dynamically accessing multiple tools to help you stay organized and efficient. Here’s how it could work:

1. **Gmail Integration:** The assistant regularly scans your inbox to generate concise summaries. It highlights urgent emails, categorizes conversations by importance, and even suggests drafts for quick replies.
2. **Calendar Management:** By interfacing with your calendar, it can remind you of upcoming meetings, check for scheduling conflicts, and even propose the best time slots for new appointments based on your availability.
3. **Slack Notifications:** For team communications, the assistant monitors Slack channels. It identifies key messages and creates action items, ensuring you never miss an important update from your colleagues.
4. **Google Drive Access:** Whether you need immediate access to the latest project document or a file related to a current task, the assistant retrieves pertinent documents from Google Drive on demand. It can create document summaries and even create new documents based on your instructions.

With tool-calling capabilities, the possibilities are endless. In this conceptual scenario, the AI agent embodies a digital personal secretary—one that not only processes information but also proactively collates data from connected services to provide comprehensive task management. This level of integration not only enhances efficiency but also ushers in a new era of intelligent automation, where digital assistants serve as reliable, all-in-one solutions that tailor themselves to your personal and professional needs.

## Security Challenges with Tool Calling AI Agents

Building such an assistant is not that difficult. Thanks to frameworks like [LangChain](https://www.langchain.com/), [LlamaIndex](https://www.llamaindex.ai/), and [Vercel AI](https://vercel.com/ai), you can get started quickly. The difficult part is doing it securely so that you can protect the user's data and credentials.

Many current solutions involve storing credentials and secrets in the AI agent application’s environment or letting the agent impersonate the user. Storing credentials securely in the environment might work for APIs that require API keys or service accounts. However, this is not a good idea for cases where the end users need to authenticate to the service, as it can lead to security vulnerabilities and excessive scope and access for the AI agent.

<br>

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487 icon-info"></i>
  <b>To learn more about other security concerns and vulnerabilities in AI check out this blog post on <a href="https://auth0.com/blog/identity-challenges-for-ai-powered-apps/">Identity Challenges for AI-Powered Applications</a>.</b><br> 
</div>

When you build an AI agent, you need to consider all its other security implications as well. You don't want an LLM to have unlimited access to your personal data like email and documents, and more importantly, you don't want to provide your credentials to the LLM to access these tools. Let's face it, regardless of how secure the LLM is, there is always a possibility of it getting manipulated into divulging sensitive information or doing something you don't want it to do.

## Tool Calling with the Help of Auth0

This is where Auth0 comes to the rescue. As the leading identity provider (IdP) for modern applications, our upcoming product, [Auth for GenAI](https://auth0.com/blog/auth-for-genai/), provides standardized ways built on top of OAuth and OpenID Connect to call APIs of tools on behalf of the end user from your AI agent.

Auth0 brokers a secure and controlled handshake between the AI agents and the services you want the agent to interact with on your behalf – in the form of scoped access tokens. This way, the agent and LLM do not have access to the credentials and can only call the tools with the permissions you have defined in Auth0. This also means your AI agent only needs to talk to Auth0 for authentication and not the tools directly, making integrations easier.

### Call first-party APIs on users' behalf

When your AI agent, secured with Auth0, needs to call another application also secured with Auth0, you can use standard OAuth 2.0 flows, like the [Authorization Code Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow), to get an API token from that application with user consent. In this case, Auth0 will manage the retrieval of new access tokens using cached refresh tokens when the API token expires.

### Call third-party APIs on users' behalf

When your AI agent, secured with Auth0, wants to call external services like Gmail, Calendar, Slack, and Google Drive, Auth0 can help the agent get access tokens for the external service on behalf of the end user. In this case, Auth0 brokers the API access token from the external service to the AI agent.

![Tool calling with Federated API token exchange](https://images.ctfassets.net/23aumh6u8s0i/1gY1jvDgZHSfRloc4qVumu/d44bb7102c1e858e5ac64dea324478fe/tool-calling-with-federated-api-token-exchange.jpg)

This is made possible by Federated API token exchange, which is a way to obtain an access token from an external identity provider without the need for the user to re-authenticate every time. The end user authenticates and connects the external service once, and Auth0 intermediates the authentication and authorization process and provides the API access token to the AI agent. Auth0 takes care of storing refresh tokens and getting new access tokens when the current access token expires.

## Security Best Practices for Tool Calling AI Agents

Here is a summary of security best practices to consider when building a tool-calling AI agent:

- **Least Privilege**: Grant the minimum permissions needed (e.g., read-only access).
- **Audit Logs**: Track API calls and credential usage.
- **Proxying**: Use an IdP like Auth0 as a broker between the AI agent and the tools to protect the user's credentials.
- **Encryption**: Encrypt credentials at rest and in transit (HTTPS/TLS).
- **Token Rotation**: Regularly rotate API keys and tokens.
- **Sandboxing**: Run tools in isolated environments when possible to limit damage from leaks.

## Learn More about AI Agents and Auth for GenAI

This post offers a glimpse into the transformative potential of AI agents and highlights how secure and intelligent tool calling can empower AI agents to deliver a more connected and personalized experience. Stay tuned for a series of posts on tool-calling Agents with [Auth for GenAI](https://a0.to/ai-content), where we will build the conceptual personal assistant from the previous section in Node.js and Python, showing how to integrate with different types of services securely using your favorite AI frameworks and Auth0.

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI](https://vercel.com/ai), and [GenKit](https://firebase.google.com/docs/genkit). [Auth for GenAI](https://auth0.com/blog/auth-for-genai/) is our upcoming product to help you protect your user's information in GenAI-powered applications. Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.

Tool Calling in AI Agents: Empowering Intelligent Automation Securely

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

Explore how tools like Auth0 Organizations, OPA, and Okta FGA can streamline your authorization strategy for secure, scalable SaaS development.

When building a multi-tenant SaaS application, selecting the right authorization model is critical to ensure the security and scalability of your system. Authorization is not only about managing user access but also about ensuring that tenants remain isolated, protected, and—where necessary—able to collaborate. The right model for your SaaS depends on the complexity of your application, the relationships between users and resources, and how dynamic or flexible your access control needs to be. This guide provides a deeper dive into how **RBAC**, **ABAC**, and **ReBAC** can be implemented for multi-tenancy, focusing on what needs to be handled in code versus what can be centralized in a system. We’ll also touch on popular services like [Auth0 Organizations](https://auth0.com/organizations), [OPA](https://www.openpolicyagent.org/), and [Okta FGA](https://fga.dev/) to streamline your implementation.

## Role-Based Access Control (RBAC)

**Role-Based Access Control (RBAC)** is often the first choice for SaaS applications that have clear roles with distinct access privileges and is often the most familiar option among developers. It’s a straightforward model where users are assigned roles (e.g., admin, editor, viewer), and those roles come with specific permissions. In a multi-tenant environment, RBAC needs some enhancements to ensure roles are properly scoped to each tenant. This way, the users' permissions are restricted to their organization.

In a multi-tenant setup, RBAC handles tenant isolation primarily by scoping roles to individual tenants. This means that roles like “admin” or “viewer” are not globally applicable across the system but are assigned on a per-tenant basis. For instance, a user might be an “admin” in “Tenant A” but only a “viewer” in “Tenant B”.

To enforce this isolation, your application will need to ensure that roles are checked **within the tenant context** before allowing access to resources.

At the **code level**, this means ensuring that the application always verifies which tenant the user is operating under when making role-based decisions. For example, when a user tries to access a resource, the system should confirm whether their “admin” role applies to that specific tenant’s resources, not to another tenant’s resources.

> Notice that when using RBAC for authorization, a user under a certain role will get access to all the resources for that tenant. Other authorization models provide ways to scope the privileges of a user to specific resources within the tenant, and we’ll cover them later in the article.

There are simpler approaches to implementing RBAC into your application; for example, when using Auth0 for authentication, Auth0 offers an **Organizations** feature, which simplifies authentication and role assignments in multi-tenant environments. Auth0 Organizations allows you to easily manage users across multiple tenants (or organizations), where each user can be assigned roles specific to the organization they belong to. By using Auth0’s built-in support for multi-tenancy, you can delegate much of the tenant-specific role management to the identity provider, reducing the amount of tenant-scoped logic that needs to be hardcoded into your app.

### Example use cases for RBAC:

- **HR Management Platform**: In an HR platform used by multiple companies, each company (tenant) has its own set of roles, such as "HR Admin" and "Employee." When an HR Admin from Company A logs in, their permissions are limited to the records of Company A, while an HR Admin from Company B has access only to their company’s records.
- **AI-Powered Customer Support Tool**: A SaaS platform for AI-powered customer support allows companies to manage their support teams. Each team has a role structure, where the "Team Lead" has access to configure the AI responses, and the "Support Agent" can only see suggestions.

## Attribute-Based Access Control (ABAC)

ABAC allows you to define access control policies based on various attributes related to the user, resource, or environment. Unlike RBAC, which assigns static roles, ABAC dynamically evaluates attributes such as the user’s department, resource sensitivity, or even contextual factors like time and location. This makes ABAC more flexible for scenarios where access decisions depend on dynamic conditions.

In multi-tenant SaaS applications, ABAC can handle tenant isolation by including the tenant ID as an attribute in access control decisions. For instance, you can create policies that grant access to users based on their `tenantId`, `role`, and `department`. This allows for more granular control over what users from each tenant can access and when.

At the **code level**, the application needs to collect the relevant attributes (e.g., `tenantId`, `userRole`, `resourceSensitivity`) and pass them to the authorization engine for evaluation. The actual logic for determining whether access is allowed is centralized in the policy engine, reducing the need for complex, tenant-specific logic in your app.

There are some caveats, though; while ABAC allows for dynamic evaluation of the information, the relationships and structure of the information are hardcoded throughout the application, and if your attributes change, it may require code changes throughout the application. This is because the relationships between a user, its role, tenant, etc, are not inferred by the policy engine, but rather specified during authorization checks. For an inferred and more fine-grained approach, there’s a different authorization model which I will cover next.

For **system-level implementation**, ABAC policies can be managed using tools like **Open Policy Agent (OPA)** or a custom policy engine. These tools evaluate attributes dynamically, ensuring that access is granted only if all conditions are met. For multi-tenancy, this would include ensuring that users are only accessing resources within their tenant.
`

### Example use cases for ABAC:

- **AI-Driven Healthcare SaaS**: A hospital management system uses ABAC to grant access to patient records based on a doctor’s role, department, and the patient’s condition. Additionally, access is restricted to working hours.
- **AI-Powered Marketing Platform**: Marketing managers can access reports based on their role, the campaign they are working on, and the region of the campaign. ABAC policies check the region, `campaignType`, and `role` attributes to ensure the user is accessing data for their tenant’s campaigns only.

## **Relationship-Based Access Control (ReBAC)**

**Relationship-Based Access Control (ReBAC)** is ideal for SaaS applications where access control is based on complex relationships between users, resources, and organizations. Instead of simply granting permissions based on roles or attributes, ReBAC models relationships (e.g., "is the owner of," "can edit") and uses these to make access decisions. This is particularly useful for collaborative SaaS platforms where permissions are based on how users interact with resources.

> If your SaaS application handles user-generated content, you’ll likely benefit from a ReBAC model)

In multi-tenant ReBAC implementations, tenant isolation is enforced by defining relationships within and across tenants. For example, a user might "own" a resource within one tenant, and another user might have "edit" permissions for that resource based on their relationship. Unlike RBAC, which assigns roles based on predefined hierarchies, ReBAC focuses on how entities (users, resources, tenants) are related.

At the **code level**, your application doesn’t need to hard-code tenant checks. Instead, all access control decisions are based on querying the relationship graph, which models how users and resources are linked. This reduces complexity, as the app doesn’t need to maintain tenant-specific logic.

For **system-level implementation**, **OktaFGA** (or **OpenFGA**, based on Google Zanzibar’s model) provides a powerful platform for managing ReBAC at scale. OktaFGA stores and manages relationships in a graph database and allows your application to query these relationships in real time. You can model tenant-specific relationships and even handle cross-tenant scenarios, such as allowing external collaborators limited access to certain resources.

### Example use cases for ReBAC:

- **AI-Enhanced Document Collaboration Platform: In this multi-tenant SaaS, users can create, share, and edit documents within their tenant. ReBAC models relationships like "owner," "editor," and "viewer" for each document.**
- **AI-Powered Learning Management System**: A university (tenant) uses the platform to manage courses and student access. Students are "enrolled" in courses, and professors "teach" those courses. ReBAC models these relationships, ensuring that only enrolled students can access course materials. If a student transfers to a new university (tenant), their access is automatically updated based on their new relationships within the system.

## Summary

When it comes to building a multi-tenant SaaS application, your choice of authorization model determines how much of the access control logic is handled by your code versus the authorization system and how wide or fine grained the access control is over the resources of the tenants.

- **RBAC** requires tenant-specific role checks in your code, but tools like **Auth0 Organizations** can offload much of this complexity by managing roles and tenants externally.
- **ABAC** offers fine-grained, context-aware access control, where the system dynamically evaluates policies based on attributes like `tenantId` and `role`. Tools like **Open Policy Agent (OPA)** can centralize these decisions, reducing the need for custom code.
- **ReBAC** excels in scenarios with complex, dynamic relationships. Solutions like **OktaFGA** allow you to manage relationships at scale without embedding tenant-specific logic in your app. Instead, the relationship engine handles access control based on real-time relationships between users and resources.

By leveraging these models and tools, you can build a secure, scalable, and maintainable multi-tenant SaaS platform that fits your unique authorization needs.

Thanks for reading!

How to Choose the Right Authorization Model for Your Multi-Tenant SaaS Application

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Before you start working with AI developer tools, understand what it could mean for you, your product, and your customers.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  This blog post is based on interviews conducted with startup founders, engineering managers, data scientists, and risk analysts in the Artificial Intelligence and Machine Learning space.<br> 
</div>

Evaluating tools that can help optimize your development processes? Maybe you’re entirely building alongside [Devin, the first AI software engineer](https://www.cognition-labs.com/introducing-devin) to get your app to market faster, generating code snippets for your React app with [V0.dev](https://vercel.com/blog/announcing-v0-generative-ui), or using [GitHub CoPilot](https://thehackernews.com/2024/03/github-launches-ai-powered-autofix-tool.html) to help patch your website’s security flaws.

While productivity and efficiency are hallmarks of development success, security and privacy are just as paramount to protect your product and maintain customer trust. According to [Snyk’s 2023 AI Code Security report](https://snyk.io/reports/ai-code-security/), **80% of developers are bypassing security policies to use AI**.

But modern-day [Generative AI](https://news.mit.edu/2023/explained-generative-ai-1109) tools don’t typically have the built-in capability to determine whether the data it is exposed to is sensitive. It’s completely up to the user to take precautions and set up the proper protocols when choosing to use one of these tools. Let’s explore the potential risks of using AI tools in the dev process and what questions you could ask yourself to help make more informed decisions – for you, your product, and your customers.

## Productivity vs. Risk

According to Snyk’s blog, [How to Embed Security in AI-assisted software development](https://snyk.io/blog/snyk-and-atlassian-embed-security-ai-assisted-software-development/), “Code generation, using generative AI… is the area that stands to offer the greatest productivity benefits — **and the highest potential for introducing risk**.“

AI tools can help accelerate the process of taking an idea and building an MVP with limited resources. Although engineering productivity cannot be tracked by a single metric for all, it’s easy to see how these tools are already helping developers reduce time spent in generating code and improving the quality of code.

Like with all third-party tools, to strike the perfect balance between productivity and risk, it’s important to recognize ways in which these tools can hurt your product and customer security, now and in the future. In many situations, risk cannot be quantified, but companies can have an increased or decreased risk factor (risk tolerance) depending on:

* Industry
* Product type and use case
* Company stage

For example, risk tolerance can be higher for startups in growth mode, especially in industries outside of security.

## Risk Prevention Strategies

Let’s explore the most common risks associated with AI tools and mitigation strategies outlined by some engineers. 

Nonprofit OWASP (The Open Worldwide Application Security Project) documented a [list of potential security risks](https://owasp.org/www-project-top-10-for-large-language-model-applications/) when deploying and managing Large Language Models (LLMs) – some examples include:

* Sensitive Information Disclosure (LLM06) - LLMs can inadvertently disclose sensitive, proprietary, or confidential information leading to privacy breaches, intellectual property theft, and unauthorized access
* Prompt Injection (LLM01) - Attackers can manipulate LLMs through crafted inputs, causing the LLMs to execute the attacker’s intentions
* Overreliance (LLM09) - Systems or people overly dependent on LLMs without oversight may face misinformation, miscommunication, legal issues, and security vulnerabilities due to incorrect or inappropriate content generated by LLMs

When adding these tools to your tech stack, do these questions come to mind?

* How are you deciding which tools to use to increase your efficiency and productivity? 
* Do you have an internal vetting process for third-party vendors? How are you updating this for AI tools?
* Will you be prompting the AI tools with customer data and PII or proprietary restricted information? Are you in line with your applicable regulatory compliance frameworks? (GDPR, etc.)
* Does this tool abide by your corporate guidance?
* Do you have customer permission to use their data in this way?
* How could these tools impact you?
* What risks will you, your product, and your customers face?
* What guidance or guardrails does the tool have to protect your data as a user? Two popular types of AI developer tools are those for engineering productivity and those for general use, and the available configurations may vary.

We interviewed a few engineers (anonymously) about what they’re doing to minimize the risks associated with AI developer tools. Here’s a breakdown of some of the most common concerns and questions engineers are asking to reduce any harmful and inadvertent impact while coding with Gen AI tools.

* PI and copyright concerns
    * Once one of these tools generates code, who is the owner?
    * What happens if the tool is suggesting the same code to another customer, maybe even a competitor?
    * If you use AI tools in order to create a customer-facing chatbot, and a customer includes PII in their prompt – who is in charge of monitoring and removing this data and ensuring it isn’t being used to re-train models?
* Overreliance
    * Generating a few lines of code vs a few files of code – how familiar are you with the code in your product, and how much do you trust it?
    * Are you aware of the potential risk of [AI hallucinations](https://www.ibm.com/topics/ai-hallucinations) and how are you reducing it?
        * AI hallucinations are outputs from models that are nonsensical or inaccurate. For example:
            Question: where can I find the help center?
            Context: you’re looking for a website like [domain].com/help or support.[domain].com
            AI answer: the help center is located on the ground floor of this building.
* How are you updating your code and content review processes to deal with Gen AI?
* Data Exposure
    * Can you make sure your own data won't be used to answer prompts for competitors or malicious actors?
    * What are practical and technical strategies you can take to prevent data exposure?
    * Do you have strict policies and training for engineers when they are using these tools, or are you exploring third-party tools that tackle data leak prevention?

There’s no specific path to being completely secure from the risk of AI tools today, but there are many different strategies you can take to build strong guardrails to protect code and mitigate risk. Ensuring restrictions are very specific when engineers are using AI tools like Devin and code review is a must.

## AI Developer Tools Now and Tomorrow

AI tools for developer productivity are becoming increasingly popular. Further down the line, a startup founder might be able to ideate, possibly write [pseudocode](https://builtin.com/data-science/pseudocode), and use these tools to bring their idea to life. They might be able to start testing in a matter of minutes, not months.

If you’re an early-stage company, you might be eager to get started and may not have as much internal guidance as a large corporation. We hope this blog helps you start to outline the potential risks and considerations when evaluating AI tools for developer productivity. 

[Auth0 for Startups](https://auth0.com/startups) is empowering early-stage startups – tell us what we can do to best support you and your team!

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements)._

Security Considerations in the Time of AI Engineering

Kelly Hansen

At Okta Customer Identity Cloud, Kelly Hansen serves as a Product Manager specializing in the customer journey. Her interests are in creating seamless experiences for customers to meet their unique goals, ultimately leading to better outcomes for their end users. She loves Okta's vision to empower customers to safely use any technology. When she's not at work, she's tending to her beehive.

Readiness Check performs diagnosis on up to 34 configuration statuses to validate your go-live readiness.

Ensuring your settings meet your intended outcomes is key to taking your solution live in a production environment. Whether you’re committing changes or going live for the first time, the improved Readiness Check tool can help. 

## What Does It Do?

Readiness Check is a tool to diagnose key settings and provide feedback on how to configure said settings to meet recommended practices. Depending on the use case, the tool checks the status of up to 34 tenant settings and displays a pass or fail status for each. 

![Readiness Check](https://images.ctfassets.net/23aumh6u8s0i/2HdHXIUnc2moSpgMaR4tLP/e25d698a71744350c63537375319277a/Readiness_Check_01.png)

The tool allows you to review passed, failed and dismissed checks. Within each check, you are prompted to configure that item or learn more via specific documentation related to the check.

![Readiness Check](https://images.ctfassets.net/23aumh6u8s0i/6rhFhsvjgan2AQKPG0yQnO/3f63e0483f65ef134d10651728e324e8/Readiness_Check_02.png)

As you pass more checks, your Readiness Check progress gauge improves. Dismissing checks that aren’t relevant to you removes them from the Readiness Check progress equation.

Keep in mind: Critical tags refer to checks that have security or end-user implications.  

## How Do I Use It?

We recommend running the Readiness Check on your production tenant prior to taking your solution live for the first time and before committing changes when you update your configuration. With the flexibility that Auth0 offers, leveraging the Readiness tool will give clear insight into the consequences of your tenant’s configuration. 

Locate the Readiness Check in the primary dropdown in your tenant’s management dashboard, or run it from the Settings page of your tenant.

![Readiness Check](https://images.ctfassets.net/23aumh6u8s0i/2D8DTEYn2TMSlFZiJtvusx/901d4b5ddf38c1f680a47676a41efbc1/Readiness_Check_03.png)

![Readiness Check](https://images.ctfassets.net/23aumh6u8s0i/6MegjDoe9SZzo2ln6rGg0M/d78c45b0cccfde4400cd3e27b4f876b7/Readiness_Check_04.png)

## What Else Do I Need to Know?

You can read more about the Readiness Check and the pre-deployment checklist in [this documentation](https://auth0.com/docs/deploy-monitor/pre-deployment-checks/how-to-run-production-checks).

Running the Readiness Check is helpful practice, though not a substitute for a professional performing a Health Check. Please engage with our [Professional Services](https://auth0.com/docs/get-started/professional-services) team for individual attention to your use case.


Security Confidence with the Readiness Check Tool

alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

Flexible streaming directly to your tools powered by Auth0 Marketplace integrations.

No matter industry or size, data collection and analysis can play a critical role in the success of your business. Without the right data or tools in place, it can be impossible to fully analyze performance and make the right user optimizations. The inability to monitor and react to security incidents can set organizations up for risk and brand consequences - [with the average cost of a data breach rising to $4.35 million in 2022.](https://www.ibm.com/security/data-breach) But while real-time data monitoring and alerting is important, it can be difficult to scale - especially if you’re not in the business of data ingestion. 

That’s where log streaming comes in. Log streaming allows you to ingest activity data and receive real-time monitoring and alerts, enabling you to react to security events, analyze performance, and understand user behaviors. We first introduced [Auth0’s log streaming integrations](https://marketplace.auth0.com/features/log-streaming) in 2020, allowing you to easily integrate log streaming into your applications to monitor and keep track of events occurring within your Auth0 tenants. For a bit of a deeper dive into log streaming and our past log streaming integrations, be sure to check out our [log streaming overview blog](https://auth0.com/blog/log-streaming--what-it-is-and-why-it-matters/). 

## Investing in Log Streaming to Enable Rapid Customer Response

[Account takeover attacks increased by approximately 90% from 2020 to 2021](https://www.forbes.com/sites/forbescommunicationscouncil/2022/07/18/the-account-takeover-epidemic-a-wake-up-call-for-chief-digital-officers/?sh=4eb245354196), adding pressure on IT admins to present better account monitoring and protection solutions for their users. Organizations need to be able to quickly see and react to abnormal events within their applications and find areas to improve efficiencies for better user experiences. 

We’ve been offering both log streaming and log extensions as a monitoring solution, but as pressures to react and respond to real-time streaming data grows, we’ve decided to [move away from log extensions](https://community.auth0.com/t/log-extension-deprecation/83017) and fully invest in log streaming. Log extensions delivered a once-viable solution, but we’ve found them difficult to scale to meet the growing needs. By refocusing our efforts, we’re able to launch custom log streaming solutions that are not bound by global management API endpoint limits and rate limits and, ultimately, deliver scalability. For users, this allows you to better react to real-time monitoring and alerts, analyze application performance, and understand your customer behaviors with real-time activity data. 

## Log Streaming Flexibility: Connect Directly to Your Third-Party Data Tools

We’re excited about our new launches for a few reasons. We’ve created a more efficient solution to export log events to your third-party data tools. By shifting our focus to only log streaming, we can continue to enhance our log stream features to make them more customizable for unique use cases. 

A feature we recently implemented, Log Streaming Flexibility, allows users to select which log-type categories they want to stream. This means that instead of filtering the data you want to see at the end of the stream, you can now filter exactly what you want to see directly at the source. The result is better-defined log streams that only send relevant data and easier adoption of log streams with less volume to manage. This functionality also serves as one of the alternatives to the soon-to-be deprecated log extensions functionality. 

## Meet Our Log Streaming Partners

As we continue to fully invest in log streaming, we’ve partnered with Mixpanel and Segment to create custom log streaming integrations built on APIs for two-way communication between applications.

#### [Segment](https://marketplace.auth0.com/integrations/segment-log-streaming)

Built by Auth0, the Twilio Segment integration is a Customer Data Platform (CDP) log streaming solution that provides companies with the data foundation to help build complete customer profiles. Twilio Segment allows companies to collect, unify, and route customer data into any system to better understand their customers and create seamless, compelling experiences in real time. 

#### [Mixpanel](https://marketplace.auth0.com/integrations/mixpanel-log-streaming)
The Mixpanel integration gets engineering, product, and data teams the tools they need by providing fast, flexible, and easy-to-use product analytics. This custom log streaming integration allows you to create behavioral cohorts that can be routed to Mixpanel to create robust data profiles. Mixpanel’s reporting makes it easy to find root causes of user drop-off and growth in order to better serve your customers. 

In addition to the above custom log streaming integrations built in collaboration with Mixpanel and Segment, some of our other partners have launched log streaming integrations in the [Auth0 Marketplace](http://marketplace.auth0.com/). These partner-built integrations are built with custom webhooks to allow you to ingest and track event data within your Auth0 tenants. 

#### [Elastic](https://marketplace.auth0.com/integrations/elastic-security)
[Elastic Security](https://www.elastic.co/security) combines SIEM threat detection features with endpoint prevention and response capabilities in one solution. The Elastic Security log streaming integration for Auth0 uses custom webhooks to enable easy ingestion of Auth0 events to aid with threat detection and incident response. All Auth0 events are mapped to the Elastic Common Schema, allowing you to easily analyze, correlate, and visualize events right away.

#### [Logz.io](https://marketplace.auth0.com/integrations/logz-io)
The [Logz.io](https://logz.io/) Cloud SIEM integration for Auth0 allows you to centrally monitor your workflow logs to help rapidly identify, investigate, and remediate emerging threats. Combining the open-source visualization from Kibana with advanced security analytics backed by AI and Machine Learning, Logz.io enables you to inspect and investigate all of your relevant Auth0 event data. Using custom webhooks, Logz.io allows your team to quickly drill down into granular user data while inferring critical security intelligence to inform decision-making.

#### [MDR ONE](https://marketplace.auth0.com/integrations/mdr-one)
[Kudelski Security’s](https://kudelskisecurity.com/services/mdr-one/) MDR ONE integration uses an advanced set of detection rules to provide widely recognized threat hunting, detection, and response capabilities for Auth0. By offering a unique combination of consulting, technology, and managed services, the MDR ONE integration enables organizations to continuously evaluate security posture and recommends solutions that will address business risk and compliance needs and assist with overall security effectiveness.

## What’s Next for Log Streaming on Auth0?

We’re just at the beginning of our custom log streaming integrations. With the launch of our Auth0-built integrations, we’ll soon be opening up the opportunity for partners to build their own custom log streaming integrations on our Marketplace, in addition to the webhooks-based integrations our partners are already building. 

As we move away from extensions entirely, be on the lookout in the coming months for documentation and announcements on this opportunity, and be sure to check out [auth0.com/integrate](https://auth0.com/integrate) to learn more about the process of building and launching an integration on the [Marketplace](http://marketplace.auth0.com/).



Custom Log Streaming Integrations

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Supporting Sign in with Apple on iOS and web apps can be an easy task if you use the right tools.

How to Implement Sign in with Apple Easily on iOS Apps

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to decrease abandoned carts by improving the simplicity and security of your user login process.

When consumers create e-commerce accounts, retailers can use their purchasing history to offer a more personalized shopping experience, which can boost [retail conversion rates](https://www.mckinsey.com/industries/retail/our-insights/personalizing-the-customer-experience-driving-differentiation-in-retail) by up to 15%. However, it is tough for retailers to convince people to actually sign up — case in point, [a 2021 DMI survey](https://baymard.com/lists/cart-abandonment-rate) found that 24% of U.S. shoppers abandoned an order just because they were asked to make an account.

We [surveyed](https://images.ctfassets.net/2ntc334xpx65/7o4UAUaHOMHJeV5fmgK9S1/b4c300762c64becf6cef5989046aaf8f/Infograph_2_2x.jpg) over 8,000 consumers across six global markets (the UK, France, Germany, Australia, Singapore, and Japan) to learn about the login experience they preferred and discovered widespread frustration with standard username/password (UP) login methods and businesses that fail to meet their ease-of-login expectations.

Our survey found five problems that stop consumers from signing up for an online account:

1.  Completing long login or sign-up forms (49%)
2.  Meeting minimum password requirements (47%)
3.  Entering private information (46%)
4.  Creating a new ID and password for every app or online service (43%)
5.  Verifying their account with one-time passwords (OTP) (23%)

<br>
Such frustrations lead to some of the worst security hygiene offenses, in particular, reuse of passwords across multiple accounts. Our survey found that 85% of international consumers reuse passwords, with 41% of them doing so “frequently or all the time” and 29% “sometimes”.

We asked consumers about the kind of login experience that would increase their chances of signing up for an account and found that adding certain authentication features would actually encourage them to do so. Our survey results indicated that, when available, consumers are more likely to complete the signup process if given more secure and easy-to-use login experiences.

![Authentication 01](https://images.ctfassets.net/23aumh6u8s0i/24uCeR7yhZbNmMpbFE7v3v/c2245aa707cc9d83b5242357ed06ac39/Passwordless-Authentication-sep1.jpg)

Below are four authentication tools that can improve your retail conversion rate by creating a more streamlined, secure login experience that satisfies users.

## 1. Multi-factor Authentication (MFA)

[MFA](https://auth0.com/learn/get-started-with-mfa/) requires users to verify their identity in more than one way, which helps reduce the potential for unauthorized access to their data. For instance, a user may submit a password and then have to additionally verify a secondary account or device they own using a link sent to their email address or phone.

Consumers want to know that companies are protecting their data. In a 2020 survey with 1,000 North American consumers asked about privacy and data collection, management consulting firm McKinsey & Company found that [87% of respondents said](https://www.mckinsey.com/business-functions/risk-and-resilience/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative) they “would not do business with a company if they had concerns about its security practices.” MFA helps retailers provide consumers with greater confidence their data is protected because it blocks [99.9% of attacks](https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/).

While 49% of our surveyed consumers noted they were more likely to sign up for an online account if a business offered MFA, only 28% of surveyed businesses currently offered it as part of their login process. This discrepancy arises from the perception that the multiple steps in MFA mean extra hassle for both users and the business.

However, MFA is actually fairly easy to implement — many companies [quickly adopted it](https://www.brighttalk.com/webcast/15793/483340/451-research-report-remote-work-during-covid-19-drives-mfa-adoption) when COVID-19 forced them to pivot to a remote workforce in 2020.

**Company use example**: According to [Jordan Christensen](https://auth0.com/case-studies/ecobee/), VP of Technology at [ecobee](https://www.ecobee.com/en-us/), the smart device retailer wanted to protect consumers using ecobee’s home monitoring products, so they outsourced MFA implementation. His team was thrilled they were able to bring MFA to customers “without needing to reinvent the wheel.”

## 2. Biometrics

[Biometrics](https://auth0.com/blog/what-are-biometrics-the-proscons-of-biometric-security/) uses measurable human traits, characteristics, or behaviors to confirm user identity. Fingerprint scans and facial recognition are two of the most common forms of biometrics, but there’s a growing list that includes options like voice, gait, and even DNA recognition.

Biometric traits are harder for hackers to fake than usernames and passwords, so they can help mitigate security concerns that could keep consumers from signing up. [Consumers](https://usa.visa.com/visa-everywhere/security/how-fingerprint-authentication-works.html) also like it because it’s faster than username/password authentication, and they don’t have to struggle with remembering login credentials.

While 46% of our surveyed consumers responded that they’d be more likely to log in if they could use biometrics, only 21% of the businesses we surveyed currently offered it — the biggest consumer-business gap we found in the study. Taking steps to close the gap between consumer expectations and current business practices will result in a better customer experience and better retail conversion rates.

Steven Rees-Pullman, SVP, International at Auth0, explains that it can be a [“heavy lift”](https://auth0.com/blog/businesses-fall-short-of-consumer-expectations-for-login-experiences-auth0-survey-reveals/) for businesses to develop biometric authentication in-house due to factors like limited bandwidth of IT employees or a lack of expertise with the process. To prevent diverting company resources and adding additional stress on already busy IT teams, some companies are instead choosing to outsource implementation to third-party providers that specialize in identity management and already have [experience with biometrics](https://auth0.com/docs/mfa/configure-webauthn-device-biometrics-for-mfa).

**Company use example**: Consumer use of [Microsoft’s](https://www.microsoft.com/) biometric authentication tool Windows Hello, which lets users log in with a face, iris, or fingerprint scan instead of a password, jumped from [69.4% to 84.7%](https://www.microsoft.com/security/blog/2020/12/17/a-breakthrough-year-for-passwordless-technology/) in 2019 alone. Additionally, [Disney](https://www.disney.com/) started experimenting with a [facial recognition system](https://insidethemagic.net/2021/04/disney-world-facial-recognition-ks1/) at Walt Disney World’s Magic Kingdom theme park this year and was using [fingerprint scanning](https://insidethemagic.net/2020/10/disney-fingerprint-scanning-kj1/) to prevent ticket fraud before COVID-19 hit.

## 3. Social Logins

[Social logins](https://auth0.com/learn/social-login/) use existing login information from a social network provider that allows consumers to access a third-party website account without having to create another one. While the number of social providers [keeps growing](https://www.theverge.com/2021/5/7/22422980/tiktok-log-in-sound-kit-app-integration-developers), staple networks include Facebook, Google, and Twitter.

Consumers prefer social logins to traditional UP authentication because they typically allow them to create and log in to accounts with just one click. As a result, social logins generally [boost conversion rates](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) by up to 20% — though some companies report seeing [as high as 40%](https://www.quora.com/What-impact-does-social-login-have-on-conversion-rates). Social logins also provide access to rich user data, allowing you to use more customized, targeted marketing with individual consumers.

Our survey found there wasn’t a huge gap between consumers and businesses with social logins, with 37% of consumers noting they were more likely to sign up with it and 31% of businesses currently offering it.

Social logins are typically connected to larger companies with established data privacy measures, but security can be compromised if users are reusing passwords. Martin Gontovnikas, former VP of Marketing at Auth0, says consumers using social logins should [vary their passwords across platforms](https://auth0.com/blog/social-login-on-the-rise/), and you can choose to boost the security strength of social logins by combining it with MFA.

**Company use example:** Kevin Ho, VP of Marketing for marketing agency [WishPond](https://www.wishpond.com/), found that after featuring a social login option more prominently than UP authentication, the company saw an [8.5% increase](https://blog.wishpond.com/post/115675436270/how-we-improved-sign-up-rates-by-8-5-with-this-simple-test) in their conversions.

## 4. Passwordless

[Passwordless](https://assets.ctfassets.net/2ntc334xpx65/3Ew2LXo2UJDQdlSukeQxwq/de57802e6a5da4a58de15ee68b42ccf5/Passwordless-Whitepaper-Auth0.pdf) authentication is exactly what it sounds like: confirming a consumer’s identity with something different from a password. Outside of biometrics, typical passwordless options include magic links, where a user is sent a link to log in after submitting their email, one-time codes, and push notifications.

With the average consumer having [approximately 100 passwords](https://tech.co/news/average-person-100-passwords#:~:text=According%20to%20new%20research%20from,has%20100%20passwords%20to%20remember!), passwordless authentication reduces potential user frustration with logins. Not having traditional UP authentication also means increased data security, with Verizon noting in its [2021 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) that stolen login credentials are the main way organizations get hacked. Next Move Strategy Consulting published a report [this month](https://www.nextmsc.com/report/passwordless-authentication-market) predicting that the global passwordless authentication market will grow by 29.1% by 2030.

Even so, passwordless authentication came in last in our survey in terms of both consumer likelihood to sign up with it (34%) and business use (20%). Traditionally, [IT infrastructure](https://www.forbes.com/sites/forbestechcouncil/2021/04/20/why-is-passwordless-authentication-met-with-reluctance/?sh=5a946c366d06) at large companies has been set up for UP authentication, so it can be a complex process for businesses to implement passwordless tech on a wide scale.

According to Cybersecurity Insiders’ 2021 [“The State of Passwordless Authentication”](https://media.fidoalliance.org/wp-content/uploads/2021/03/The_State_Of_Passwordless_Authentication_2021_Report.pdf) report, many organizations that have chosen to implement passwordless authentication have done so because of its proven security, ease of use, and ability to “help consumer-facing businesses increase revenue.” Microsoft also reported that [more than 150 million users](https://www.microsoft.com/security/blog/2020/12/17/a-breakthrough-year-for-passwordless-technology/) were using passwordless authentication on Windows in May 2020.

**Company use example:** Kunal Chakraborty, Global Vice President for Customer Experience and Digital at [GrandVision](https://www.grandvision.com/), the optical retailer, said the company made [“the checkout process as customer-friendly as possible”](https://auth0.com/case-studies/grandvision/) by having a third-party provider implement passwordless authentication — accounts are created just by clicking a box. As a result, GrandVision saw a [boost in their conversions by up to 54%](https://techbeacon.com/security/your-passwordless-future-make-it-sooner-rather-later).

![Authentication 02](https://images.ctfassets.net/23aumh6u8s0i/3DuYOoznWG10geDOeYwBVm/02b5dbc23075eebf4d984f22dbaaec76/Passwordless-Authentication-sep2.jpg)

## Authentication Technologies Enhance User Experience

While it may seem like adding a new element to your login box would drive consumers away, it’s actually the opposite. By using one of the authentication tools above to provide consumers with a simple, secure login experience, you can satisfy users and continue to strengthen their ties to your brand with personalized marketing — strengthening your retail conversion rate in the process.

Auth0 makes implementing the authentication technologies above simple — learn more [about Auth0’s platform](https://auth0.com/authentication) here.


4 Authentication Tools That Increase Retail Conversion Rates

Learn which cybersecurity tactics and tools will help you combat today's common cyberattacks.

With more people working remotely or online post-2020, the [FBI reports](https://thehill.com/policy/cybersecurity/493198-fbi-sees-spike-in-cyber-crime-reports-during-coronavirus-pandemic) that cybercriminals are quadrupling the number of cyberattacks they use to disrupt online activities. Research also shows the impact to organizations and their users from a single successful cyberattack is growing each year.

For example, in 2017, nearly [_197 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. In 2020, that number [grew to 37 billion](https://pages.riskbasedsecurity.com/hubfs/Reports/2020/2020%20Year%20End%20Data%20Breach%20QuickView%20Report.pdf), even though the overall number of data breaches had decreased. And IBM reports that the costs are growing for organizations that fall victim to these attacks in countries like the United States, where the average cost of a data breach grew from $7.91M to $8.64M between [2018](https://www.ibm.com/downloads/cas/861MNWN2) and [2020](https://www.ibm.com/security/data-breach).

Many of the methods cybercriminals use to breach organizations rely on human error. Even your sharpest employees can become your greatest weakness if they click on a malicious link without realizing it. However, other cyberattacks exploit gaps in your [data security](https://auth0.com/blog/what-is-data-security/) efforts to gain access to sensitive data.

Below are seven of the most common cyberattacks your organization will face in 2021 and the ways to protect yourself against the data breaches they have the potential to cause.

## 1. Malware Attacks

Malware refers to many different types of malicious software designed to infiltrate, spy on, or create a backdoor and control an organization’s systems or data. This includes ransomware, worms, trojans, adware, and spyware. [Experts report](https://monstercloud.com/blog/2020/03/23/coronavirus-alert-ransomware-attacks-up-by-800/) that malware usage is up almost 800% since early 2020.

Malware has the potential to cause major data breaches and severely disrupt business operations. Microsoft was the victim of a major ransomware attack, where WannaCry [took advantage of a weak spot in their operating system](https://en.wikipedia.org/wiki/WannaCry_ransomware_attack) and displayed the following message to banks, health care providers, manufacturers, and other businesses across the globe:

![image.png](https://images.ctfassets.net/23aumh6u8s0i/1eCk2eoRxo2dlqfakT2rLF/3d36517813cea24b63b795f7fe3a256c/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021)
<p align="center"><i><a href="https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/">Source</a></i></p>

<br /> <br /> 
<p></p>
To regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [Bitcoin](https://bitcoin.org/en/).

Malware is typically downloaded unwittingly by clicking a malicious link or by tricking a user into thinking they're downloading something legitimate when they’re not.

### How to Protect Against Malware Attacks

Teaching your employees how to spot suspicious links and pop-ups that could contain malware will help reduce the chance that it could infect your systems.

Additional ways to protect against malware include keeping your operating systems up to date to ensure known security gaps are patched and using anti-virus software. For example, the [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/) data breach could have been prevented had a known patch been installed in time.

## 2. Phishing Attacks

Phishing attacks attempt to steal information from users or trick them into downloading malware by sending malicious emails or text messages (SMS) that look like real requests but are, in fact, a Scam. Here’s a Dropbox email asking users to verify their email address that’s actually a phishing attack:

![image.png](https://images.ctfassets.net/23aumh6u8s0i/2ISbM89J8qjqwVy4kUpgOf/a1b52597302c386ee8381bfd6f6948d9/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021) 
<p align="center"><i><a href="https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250">Source</a></i></p>
<br /><br />

According to [Verizon’s 2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/dbir/2020/results-and-analysis/), phishing attacks are the most common cause of data breaches globally and have been the root cause of notable instances of cybercrime in the last decade.

The cybercriminals who breached the AP News Twitter account and falsely [tweeted](https://www.bbc.com/news/world-us-canada-21508660) that the White House was under attack used a targeted phishing attack (spear-phishing) to gain access to the account, as did the bad actors who leaked sensitive emails from Hillary Clinton’s campaign chairman [before the 2016 election](https://www.cbsnews.com/news/the-phishing-email-that-hacked-the-account-of-john-podesta/).

### How to Protect Against Phishing Attacks

The best way to protect your organization against phishing attacks is to educate your employees on how to spot a questionable email or text message. The training programs below can help you do this:

* _Digital Defense’s_ [_SecurED training program_](https://www.digitaldefense.com/professional-services/secured-training/)
* _Inspired eLearning’s_ [_Security Awareness_](https://inspiredelearning.com/security-awareness/awareness-c-suite/)

Additionally, CSO has compiled a list of resources that can help you train your teams to spot phishing attacks [here](https://www.csoonline.com/article/3225471/please-dont-send-me-to-cybersecurity-training.html).

## 3. Distributed Denial of Service Attacks

Distributed denial of service (DDoS) attacks disrupt the traffic to a website, application, server, service, or network by overwhelming it with a flood of traffic from compromised computer networks ([botnets](https://usa.kaspersky.com/resource-center/threats/botnet-attacks)) that prevents real users from accessing it. In 2018, GitHub experienced the largest DDoS attack ever when it was hit with 1.35 terabits of traffic per second and was [offline for almost 20 minutes as a result](https://www.wired.com/story/github-ddos-memcached/).

DDoS attacks are common and increased by 50% in 2020 compared to 2019, with a large surge occurring in early 2020 during the pandemic, according to security company [Kaspersky](https://securelist.com/ddos-attacks-in-q3-2020/99171/).

### How to Protect Against DDoS Attacks

DDoS attacks are tricky to identify because they’re often hard to distinguish from legitimate traffic. Some [methods of protecting against DDoS attacks](https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/) include blocking all traffic for a short period of time, rate-limiting traffic to a website, using a web application firewall to detect suspicious traffic patterns, or scattering traffic across a network of servers to reduce the attack’s impact.

## 4. Man-in-the-Middle Attacks

Man-in-the-middle (MitM) attacks are when bad actors spy on or intercept communication between you and your users or employees. MitM attacks are most commonly used to steal personal or company information or to redirect that information to another destination or in espionage situations, such as when [Russian hackers](https://www.theguardian.com/world/2018/oct/04/how-russian-spies-bungled-cyber-attack-on-weapons-watchdog) attempted to breach the Organisation for the Prohibition of Chemical Weapons (OPCW).

MitM attacks are [not the most common cyberattack](https://www.csoonline.com/article/3340117/what-is-a-man-in-the-middle-attack-how-mitm-attacks-work-and-how-to-prevent-them.html) because many of the same objectives can be achieved using malware. However, MitM attacks do present a threat for organizations because they’re often hard to spot and because [more employees are working remotely](https://www.businesswire.com/news/home/20201215005287/en/Upwork-Study-Finds-22-of-American-Workforce-Will-Be-Remote-by-2025) post-2020.

For example, fake WiFi networks are [easy to deploy](https://hackernoon.com/a-hacker-intercepted-your-wifi-traffic-stole-your-contacts-passwords-financial-data-heres-how-4fc0df9ff152) in public places like coffee shops where remote employees often work. People often connect to these networks without realizing it, allowing bad actors to spy on them while they use the network.

### How to Protect Against MitM Attacks

End-to-end encryption protocols like [Transport Layer Security](https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/) (TLS) are the best way to protect against MitM attacks. Additionally, requiring your employees to use a VPN to access company networks over public WiFi will ensure that any information shared during their session remains private, regardless of whether the network belongs to a bad actor or if their coffee shop’s WiFi is simply unsecured.

## 5. Credential Stuffing Attacks

[Credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) is a type of brute-force cyber-attack where bad actors use stolen usernames and passwords from one data breach to access user accounts at another organization.

![image.png](https://images.ctfassets.net/23aumh6u8s0i/1WPDZfXKzHLheBp0XbP2em/6769d8d365597a77b9de207e48c303d8/Uploaded_from_The_7_Most_Common_Types_of_Cybersecurity_Attacks_in_2021)

Credential stuffing is possible because, statistically, [65% of all people](https://services.google.com/fh/files/blogs/google_security_infographic.pdf) reuse the same password across multiple accounts. As a result, credential stuffing attacks are one of the [most common](https://enterprise.verizon.com/resources/reports/dbir/) causes of data breaches globally.

### How to Protect Against Credential Stuffing Attacks

The best way to protect against credential stuffing attacks is by either implementing [passwordless authentication](https://auth0.com/passwordless/) or [multi-factor authentication](https://auth0.com/multifactor-authentication) (MFA). Passwordless authentication prevents bad actors from using stolen credentials by eliminating them altogether, while MFA requires bad actors to verify their identity in one or more ways in addition to the stolen credentials they’re using to log in.

## 6. Password Spraying Attacks

Password spraying is also a type of brute-force attack where bad actors attempt to guess a user’s password from a list of common passwords like “123456” or “password.”

Like credential stuffing, password spraying is quite common. For example, Verizon’s 2020 Data Breach Report showed that over [80% of all hacking-related data breaches](https://enterprise.verizon.com/content/verizonenterprise/us/en/index/resources/reports/2020-data-breach-investigations-report.pdf) involved brute-force methods like password spraying.

### How to Protect Against Password Spraying Attacks

Password spraying attacks can be prevented by using passwordless authentication or MFA, just like credential stuffing attacks can be. However, you can also reduce the risk and impact of a data breach via password spraying by following the [NIST Password Guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/), which are considered the best password standards in the world.

## 7. Mobile Device Attacks

[Many organizations are working to increase the mobility](https://www.t-mobile.com/content/dam/tfb/pdf/T-Mobile-for-Business-2020-Workplace-Mobility-Report.pdf?icid=TFB_TMO_P_TFBFTRWRKS_7LCBNVDVYBXY27WF321599) of their workforce because it improves operational efficiency and productivity. However, cybercriminals are well aware of this fact and are targeting mobile devices more frequently [year](https://www.zdnet.com/article/mobile-malware-attacks-are-booming-in-2019-these-are-the-most-common-threats/) over [year](https://www.mcafee.com/content/dam/consumer/en-us/docs/2020-Mobile-Threat-Report.pdf) with a variety of attacks on this list, which puts organizations at risk for a data breach through more devices than before.

[The Pegasus attack](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message. Clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. And once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

### How to Protect Against Mobile Device Attacks

Protecting your organization against mobile security threats requires a strong enterprise mobility management (EMM) program, as well as mobile device management (MDM) tools that help you protect any company data that may be on your employees’ personal or work devices. Identity and access management tools like multi-factor authentication can also help secure any work applications that contain sensitive information from unauthorized access.

## Create Additional Layers of Security at the Login Stage

The impact of many cyberattacks on this list (as well as [others that many companies face](https://www.google.com/url?q=https://auth0.com/resources/whitepapers/state-of-security-identity-report&sa=D&source=editors&ust=1624045583510000&usg=AOvVaw0jtWJoRiARLi1pwCySdu1J)) can be mitigated or prevented with strong authentication protocols.

First and foremost, this means good password policies and sound employee education. However, taking the next step to [secure login procedures](https://www.google.com/url?q=https://auth0.com/login-security&sa=D&source=editors&ust=1624045583512000&usg=AOvVaw2FeIurZ9Qr026LNUW7RDFZ) with security functionality like multi-factor authentication, [brute-force protection](https://auth0.com/docs/attack-protection/brute-force-protection), or passwordless authentication can add a new dimension of safety to your system.

Auth0 makes it easy to build secure authentication for the right people without compromising on user experience — [learn more about Auth0’s platform here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The 7 Most Common Types of Cybersecurity Attacks in 2021

The essential tools for managing user identity and how they impact your bottom line

Customer Identity and Access Management (CIAM) is how companies give their end users access to their digital properties as well as how they govern, collect, analyze, and securely store data for those users.

CIAM sits at the intersection of security, customer experience, and analytics. Providing an easy, frictionless way for users to onboard and log in is critical for driving conversions and building customer loyalty. Protecting sensitive data from malicious intrusion and taking steps to prevent data breaches is central to a sound security policy and compliance with data privacy laws. And compiling user data into a single source of truth is essential to understanding your customers.

Given CIAM’s complexity and dynamism, many organizations choose to engage a third-party [Identity-as-a-Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider rather than build a solution in-house.

Below, we’ll discuss the elements of a modern CIAM solution and how your company’s approach to customer identity can impact top-line revenue as well as mediate bottom-line security risk.

<iframe width="560" height="315"" src="https://www.youtube.com/embed/belLEwjr9zQ" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## Essential Elements of CIAM

Organizations need Identity and Access Management (IAM) solutions for several classes of end-users: employees, enterprise customers, and customers. But each type of user requires a different balance of security and user experience (UX). That’s why CIAM solutions provide a unique set of features distinct from B2B or workforce identity solutions.

Here are four features that form the bedrock of modern CIAM solutions. No two CIAM solutions offer exactly the features in the same way, but if you’re purchasing a CIAM platform, it should include the following:

### Scalability

Unlike workforce identity solutions that support thousands of employees and vendors who require fairly static access to a pre-assigned list of applications, CIAM has to scale to millions of users — often in response to short-term events like peak holiday seasons or major sporting events.

Although not traditionally described as a software “feature,” scalability is a unique element of CIAM that requires third-party, cloud-scale stability.

### Single sign-on
Single Sign-On (SSO) allows users to log in to one application and automatically be logged into a set of other applications. The most widely known SSO example is Google G Suite, where logging into your Gmail means you’re automatically logged into YouTube, Google Drive, and other Google platforms.

SSO is a basic element of federated identity, and there are SSO options for B2B and workforce IAM solutions. The type of SSO that’s specifically designed for end-users is [social login](https://auth0.com/learn/social-login/), which allows users to verify their identity with their credentials from a separate provider, like Facebook, Google, or Apple.

![Enabling Social Connections](https://images.ctfassets.net/23aumh6u8s0i/3q11XLTm7JG97Zui0NdS83/69c34978d5b60a9fbfaceb42459b0334/enabling-social-connections)

Social logins greatly simplify the registration process for users, which can lead to increased conversions and fewer customers abandoning their shopping carts because they got tired of filling out a form. (More on the advantages of SSO later.)

### Multi-factor authentication

Multi-Factor Authentication (MFA) is a more secure means of authenticating user identity than the traditional username/password combination. Passwords are distressingly easy for hackers to steal or guess, so MFA demands an extra credential for users to prove their identity. This could take the form of a one-time PIN sent to the user’s mobile device, an email, or a biometric credential like a fingerprint or face recognition. Auth0 is even releasing a feature in which users can receive a phone call with a voice message of their one-time PIN.

![MFA Voice Recognition 1](https://images.ctfassets.net/23aumh6u8s0i/4uESmkHbV2FMThLWcAvqsi/90e5f72b2eca085e8bae37d60179c2b6/mfa-voice-recognition-1)

![MFA Voice Recognition 2](https://images.ctfassets.net/23aumh6u8s0i/3BLSbVxpLMYbflpxDk3FSb/2c52471683ca8c9b763ca4138504f829/mfa-voice-recognition-2)

![MFA Voice Recognition 3](https://images.ctfassets.net/23aumh6u8s0i/3F0G4n8bUa3BIAUQg7xuHm/7a770f40b2b958f1001a1c932408d119/mfa-voice-recognition-3)

MFA is increasingly regarded as a basic requirement for security, and data privacy laws are beginning to explicitly demand it. However, it’s critical to implement MFA for end-users in a way that doesn’t introduce unnecessary friction. MFA should only be triggered based on the assessed risk, such as when a customer signs in with a new device or makes a suspicious transaction. That’s another reason why it’s critical to have the deep insight into your customers that CIAM provides. So you can assess in context when a transaction requires a higher level of authentication.

### Centralized user management

Your insights into your users can be a major competitive advantage, but only if your data is organized, accessible, and accurate. A CIAM solution helps achieve the goal of centralized, data-rich customer profiles that function as a single source of truth about users. That’s because a CIAM solution is essentially an API that mediates between different applications and components, compiling heterogeneous data in one place.

Centralized user management eliminates data silos and duplicate data. Everything you know about a user is together in one place from which admins can quickly grant and revoke permissions. This single view of customers is an obvious advantage for analytics, but it also helps companies meet the reporting requirements of data privacy laws because all profile data is accessible and portable. Knowledge about the user is also critical for building more personalized experiences, which drives higher retention rates.

![Centralized User Management](https://images.ctfassets.net/23aumh6u8s0i/okSReaVDL4OSDzKC20Kiv/db01bde2e4bfef2b6c5eb85f8b7000fa/logins)

## How CIAM Impacts Business

Now that we’ve gone over the fundamental elements of CIAM, let’s talk about how those elements impact your company’s day-to-day operations and your all-important bottom line.

## CIAM Is Central to Data Security

Customer data can be your company’s greatest asset — unless it falls into the wrong hands. A robust CIAM solution has security features to protect against fraud, hacks, and misused data on multiple fronts.

In recent years, the login box has become the front line for fending off intruders. Hackers use [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) to steal or guess user credentials and impersonate legitimate users at the login box. One of the most damaging forms of broken authentication attacks is [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/), in which hackers use passwords stolen in one breach to break into other sites. This method works given people’s tendencies to reuse passwords. There are currently billions of stolen passwords being passed around the dark web. Credential stuffing attacks alone cost businesses an average of $4 million a year, according to a 2019 [study from the Ponemon Institute](https://www.information-age.com/credential-stuffing-123482099/).

The best defense against credential stuffing and other authentication-based attacks is a CIAM solution with MFA and brute force protection. Brute force protection stops hackers from flooding your application with login attempts and crashing your site. Meanwhile, MFA ensures that a stolen credential won’t give hackers automatic access to your users’ accounts.

It’s important to note that the amount of damage hackers can do with customer credentials is limited, since they don’t have access to back-end systems. But these attacks can still damage your customer relationships and lead to negative headlines, as in the case of the [Disney+ attack](https://auth0.com/blog/the-disney-credential-stuffing-attack-could-happen-to-you/).

CIAM systems also help protect your customer data from back-end mischief in the event of a data breach or hack. CIAM solutions govern how you encrypt and anonymize personal data, so it’s useless to data thieves. It’s essential to choose a CIAM system that uses the latest encryption protocols, however, or your databases of sensitive data might as well be written in plain text. Finally, CIAM systems track who within your organization is accessing customer data and alerts admins to suspicious activity. That way, neither an employee nor a bad actor can walk away with your most valuable and sensitive asset: your customer data.

**How it affects your bottom line? Cost of data breaches.**
A [2019 Ponemon study](https://www.ibm.com/security/data-breach?cm_mmc=OSocial_Blog-_-Security_Optimize+the+Security+Program-_-WW_WW-_-CODB2019Blog_ov70891&cm_mmca1=000000NJ&cm_mmca2=10000253) found that the average data breach costs businesses $3.92 million. Businesses who don’t want to budget for that should budget for a modern CIAM solution instead.

## CIAM Helps Manage Data Privacy Law Compliance

A new crop of data privacy laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) is fundamentally rewriting the rules for how organizations collect, store, and share personal data (PD). Meeting these legal obligations means managing your approach to CIAM.

To begin with, centralized user management is essential in fulfilling the reporting and erasure requirements of data privacy laws. Under GDPR and CCPA, organizations must provide users, upon request, with copies of their data along with a record of how that data is being used.

Then there’s the issue of MFA. GDPR, CCPA, and New York’s SHIELD Act fall short of explicitly demanding MFA. Still, they require “reasonable” or “appropriate” security measures, and both [legal and security experts](https://www.natlawreview.com/article/new-york-shield-act-faqs) agree that this means MFA. GDPR enforcement has supported this idea: multiple organizations have been [slapped with fines](https://auth0.com/blog/gdpr-fines-hit-these-companies-hard-heres-how-to-avoid-them/) for failing to implement MFA.

Data privacy laws are all about controlling who can access PD, so encrypting customer data and controlling access to it are baseline requirements. A CIAM solution needs to provide all of these elements, as well as tailoring data collection and consent management practices to the relevant laws.

**How it affects your bottom line? Cost of regulatory fines.**
As of May 2020, EU states had issued over [€153 million in fines](https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-2020/) to large and small organizations for non-compliance with GDPR. In November, Californians will vote on the California Privacy Rights and Enforcement Act (CPREA), the so-called “CCPA 2.0.” As the name suggests, the new version will feature a greater emphasis on enforcement. With new laws being passed all the time, the cost of non-compliance can add up quickly.

## CIAM Is a Business Enabler Through Customer Experience

A good CIAM solution is the difference between showing up at a crowded restaurant and being told there’s a 20-minute wait and being escorted straight to your table while the bartender mixes your favorite drink. With the right approach to CIAM, you can give your customers easy login and offer them services based on a nuanced understanding of their needs.

Businesses live and die by their conversion rates, and it’s tough out there. In 2019, the [average global website conversion rate](https://www.invespcro.com/blog/the-average-website-conversion-rate-by-industry/) was 2.58%, which is actually down from 3.42% in 2014. Clearly, today’s customers have no patience for filling out frustrating registration forms. If you use social login, your users get a friction-free registration experience without having to remember another password.

Meanwhile, your company gets the benefit of shared knowledge with that social media provider, so you automatically know your customer’s location, timezone, language, and other details to guide upsell recommendations.

**How it affects your top line? Higher conversions and retention, less frustration.**
[Studies have shown](https://blog.hubspot.com/blog/tabid/6307/bid/6746/Which-Types-of-Form-Fields-Lower-Landing-Page-Conversions.aspx) that reducing the number of form fields increases conversion rates. With social logins, you can eliminate the form altogether and enable one-click signup. Plus, when users don’t have their own unique password for your business, you save help desk time. [Gartner research](https://www.infosecurity-magazine.com/webinars/password-management-getting/) says between half and a quarter of help desk calls are for password resets. A North American healthcare organization told us it spends approximately $160 to $170 per employee per year on password-related issues alone.

## CIAM: A Holistic Approach to Customer Identity Management

As we’ve shown, CIAM plays an increasingly central role in how companies create their digital identities and manage their customer relationships. Given that, companies are allocating more resources to their access management solutions, either from day one or as part of a larger digital transformation.

To learn more about how CIAM can help provide enhanced data protection and seamless customer experience, [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us).

<include src="asides/AboutAuth0" />


What is CIAM?

arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

A closer look at the world of passwords: Tricks, tips, tools, and other stuff to choose a good password in your apps.



This is the second part of our password series. In [part 1](https://auth0.com/blog/defending-against-password-cracking-understanding-the-math/), we talked about how passwords are cracked and what makes them easier or more difficult to crack depending on the type of attack, information an attacker has about you, etc.

If you're familiar with the power of two notations, entropy, sample space, and uniform randomness, I think you'll understand most of what I'll talk about below... if not, I highly recommend you go read the first part of this article before you read this one.

Before I present you what I think are good solutions to the password problem, let's talk about what are "bad passwords" first. One, so it's fresh on your mind while you read and think of ways to avoid them, and two, because I think you'll appreciate the suggestions more if you know what problems they solve.

The goal is that, by the end of this article, you will have all the necessary tools to create an uncrackable password. (While nothing is 100% secure, what lies ahead is the gold-standard when it comes to password creation today and should last for a very long time.)

## What Pitfalls to Avoid When Creating Passwords

Is there such thing as a password too strong? We can answer that question in two ways: a practical one and a mathematical one. The mathematical is out of the scope of this article, so we'll look at it from a practical point of view today.

Consider, for instance, a password with 250 bits of entropy. Despite how big that entropy is and how secure it may look like, a password that strong would need some 40 (the minimum possible N when using all 95 valid characters so that 95^N is equal or greater than 2^250) randomized alphanumeric characters, _and that makes it a horrible password for regular users_.

<include src="TweetQuote" quoteText="Avoiding password pitfalls is all about identifying unintended risks or consequences that can arise with the password you choose, despite it being a strong password."/>

The example above would be so cumbersome to use that dialing down its strength to "secure enough" would make it a better password.

There's a sweet spot to a good password &mdash; that depends on your personal preference, and we'll also talk about that &mdash; and finding that spot is what this article is all about. Below we're going to go over a few of those elements that are important to fine-tune when creating a password.

### Security theater

When people realize they have poor passwords, they tend to have one of two possible reactions, in my experience:

1. Continue choosing poor passwords. Not by choice, but because they don't _actually_ understand how passwords are exploited. They even change the password, but it's equally bad as the one they had originally;
2. Go to the other extreme and create prohibitively difficult passwords when they don’t need to.			 					

Option #2 is a good example of security theater: choosing an over-the-top one when a shorter would suffice – tactics that do little or nothing to increase your security yet feel like they do. Past a certain point, there's little to no gain in increasing length, even more, when the adversary would use easier alternatives to attack the user.

This is something that hits close to home because it's something I was guilty of.

Years ago, I decided to use an alphanumeric password instead of a numeric passcode on my phone. Not only that &mdash; at the time, I was not as well-versed in the arts of password-making &mdash; I thought that password length was the most important thing to keep in mind and opted for a 30-character password.

As you can imagine, it was extremely annoying to have to type a password that long, make a typo, and have to do it all over again, often multiple times. So annoying that I decided to change the password to something way easier to type by repeating a few characters multiple times until it added up to the (completely arbitrary) length of 30 characters.

That "helped" for a while but still was too much of a hassle, and over time I found myself unconsciously leaving the phone unlocked for longer so I wouldn't have to type the password every time I wanted to check something. Sometimes I'd even get up and leave it unlocked on my desk before realizing much later what I had done.

Eventually, I realized that trying to use a 200-bit password made it, paradoxically, less secure than, say, a 100-bit one (we'll talk about ideal strength in a moment).

Not only I was walking around believing my phone was secure because I had this huge password (despite it being one that I created myself, and probably susceptible to the biases we talked about in the previous article), but my attack surface _increased_ as it made me more likely to take risks I normally wouldn't out of annoyance.

There are mechanisms put in place on iPhones that makes brute-force attacks harder to pull off so that you don't need to go to the same lengths to protect it as you would if you were worried about remote attacks:

* The perpetrator would have to get physical access (instead of a database dump from the Internet) to your phone in a one-hour window since you last unlocked it (this is a security feature Apple implemented to prevent brute-force attacks);
* Apple entangles the cryptographic key with the device UID multiple times using the PBKDF2 algorithm. The number of iterations is calibrated so that one brute-force attempt takes a lot of time (approximately 80 milliseconds);
* You can set up your iPhone to wipe out everything after ten failed attempts (that's why having a working backup is a crucial part of any security strategy).

![Security](https://images.ctfassets.net/23aumh6u8s0i/4sojwhheCn0q4sCdNRzvAk/607e85cf08ad9cc7aa4e1170a2eb5e2f/01_security_encrypted)
<p align="center"><i>Credit: <a href="https://xkcd.com/538/">xkcd.</a></i></p>

After reaching a good-enough point for your password, you'd be better off addressing other ways an attacker might be able to exploit your passwords.

### Usability

As illustrated before, you have to consider where that password is going to be used.

Are you going to use it on your phone, where you'll tend to type with one hand while fumbling your coffee with the other, or are you only going to type it on your full-sized keyboard at home? Do you use your phone frequently, or just once or twice per day?

Another thing you have to consider is your preference when it comes to length or complexity. Do you prefer longer but simpler to type passwords or shorter but more-complicated-to-type ones? Both options can be equally secure, but one will appeal more or less to different folks.

Even if you use both hands, it can be quite complicated to type symbols on small touch keyboards &mdash; you have to press Shift multiple times, and in many instances, it takes much more time to type two or three symbols than one entire English word.

The more usable a password is, the more likely you are to keep using it. You want to increase its usability as much as possible. Note that this doesn't mean you should reuse passwords across different applications (use a password manager instead), but that you should make deliberate decisions to decrease the likelihood of you giving up before your new password becomes second nature.

There is a quote circulating among Security Stack Exchange circles that encapsulate this very well. It's known as "AviD's Rule of Usability":

<include src="TweetQuote" quoteText="Security at the expense of usability comes at the expense of security."/>

### Easiness to remember

A great password has to be easy to remember. An easy-to-remember password will give you confidence that you can memorize it eventually and will avoid situations where someone needs you to unlock your accounts on the spot.

Note that whether passwords like `sBt$][p'_3d {+@:(b-i(-y> H'x&'a)K` are easy to remember or not depends on the person &mdash; I've met people who had zero problems creating mnemonics to memorize passwords like that, and I've met people that aren't too keen on them.

If that's hard for you, consider using **passphrases**: a list of real words strung together, such as `swell posing gruffly slander onto`. We'll talk about a method for creating passphrases like this further down below.	

## How to Create Great Passwords

With the pitfalls out of the way, let's talk about how to create great passwords.

A great password is one that has sufficient entropy, is resistant to dictionary attacks, and avoids all the previously mentioned pitfalls. The first thing we need to determine is what is sufficient entropy so we can determine the minimum length to avoid brute force attacks.

### How long should it be?

Even though using entropy to measure password strength has some drawbacks, as we've talked about in the first installment of this series &mdash; if you can guarantee the password was generated uniformly and randomly — entropy is very useful because it gives you a number that we can compare against different benchmarks; we can quickly determine if a particular password is "out of reach" or not.

For example, the NIST, which is responsible for providing scientific standards in the US, used to recommend 80-bit passwords for **cryptographic secrets** (government documents, etc.) and updated that to 112 bits in 2014.

For comparison, the French equivalent to the NSA, ANSSI, [rates passwords](https://www.ssi.gouv.fr/administration/precautions-elementaires/calculer-la-force-dun-mot-de-passe/) up to 64 bits as "very weak," between 64 and 80 bits as "weak," between 80 and 100 as "moderately strong," and above 100 as "strong." They require a minimum of 100 bits when it comes to passwords or secret keys for encryption systems that must be secure.

So, if you're using all 95 characters (lowercase and uppercase letters, numbers, and symbols), the minimum length your password must have to have an entropy of 80 bits is 13 characters.

But we also need to be able to resist dictionary attacks. The password `Passw0rd1234!` has 13 characters and a theoretical entropy of 85 bits, but it's a horrible password because it's a permutation of a known word (and also a widely used password).

To avoid dictionary attacks, you need to use words that aren't real, i.e., a string of gibberish created by a cryptographic generator or _passphrases_.

### An Alternative: Diceware Passphrases

Diceware passphrases consist of a list of words that you can create randomly by throwing a fair dice five times, then comparing the result with a word list to come up with real words.

The list is provided on the official [Diceware website](https://theworld.com/~reinhold/diceware.html) and has 7,776 words in total, all possible permutations of five dice throws. The resulting passphrase will be something like `rewrite Celtic life raft armed`.

For example, say you roll a dice five times, and the results are six, one, four, six, and one. If you look up `61461` on the word list, you'll find the word `tori`. And then you'll have to repeat that for as many words as you want on your password.

Some people might be worried that the dictionary of possible words is publicly available, but it doesn't matter. Think about it: the attacker also knows the valid characters in your keyboard when you create a regular password.
What's difficult to guess is the order in which they go. The Diceware method swaps the 95 possibilities of a keyboard for 7,776 possibilities (i.e., the words).

Representing that in bits, we have that `7,776 = 2^12.92`, or that each word has around 12.92 bits of entropy. If you choose five words, that's `7,776^5` possibilities or `12.92*5 = 64.5 bits` of entropy. A six-word password has about 78 bits of entropy and a seven-word one about 90 bits.

The beauty of Diceware is that you are converting real randomness into a passphrase; you know exactly how strong it is. This method essentially turns a dictionary attack into a much more computationally-intensive brute force one.

A passphrase generated through this method avoids many of the pitfalls we talked about before: you can choose just how strong you want it to be by adding or removing words, it's easy to type on your phone, and for most people, it's easier to remember than a random string.

![Password Strength](https://images.ctfassets.net/23aumh6u8s0i/6TopClFD6DfGj23Tk1SjiR/699968f99e11bc9ba97df9af238f98c8/02_password_strength)
<p align="center"><i>That's too short to be a good passphrase. Credit: <a href="https://xkcd.com/936/">xkcd.</a></i></p>

And you don't need to buy dice if you don't have any lying around. You can use a random numeric generator for this, and it's sufficiently secure for most people.

The physical dice only certifies that your password wasn't tampered with (for example, if your computer was compromised when you created your password) and that nobody spied over your shoulder.

### Other Word Lists				

There are word lists available in other languages available on the official website. They aren't any less or more secure, just in a different language. You should use the language you're more comfortable with, as those will be easier to type and remember.

There are alternative English word lists with a few different attributes as well. The most well-known of those is perhaps the EFF list: it uses more common words, but they are longer on average.

It comes down to personal preference. You should check the [official EFF article](https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases) to compare both lists.

Driving home the point on security theater: mixing additional dictionaries doesn't make your passphrase more secure. If you mix three dictionaries, that will give an additional 1.5 bit of entropy per word... at that point; it's better to just use a single dictionary and tack an additional word at the end.		

## Diceware vs. Random Strings

While you can choose either method, as both are equally secure, it may make more sense to use one over the other depending on the situation.
					
For example, some websites limit the password length you can use – iCloud limits passwords to 32 characters.
					
This makes it impossible to create a Diceware password with satisfactory entropy – you'd be better off using a random string even if you prefer Diceware passphrases.		
On the other hand, if it's a password, you can see yourself having to share with other people (e.g., the WiFi password), then telling them a list of words is way easier than spelling a 20-character string out loud.				
The same goes for situations where you can't use the auto-fill feature of your password manager and are forced to copy the password by hand: much better to have a list of words.

## So, How Strong Should Your Password Be?

Regardless of which method you prefer, you should consider using a password manager to generate and store different passwords for the different services and websites you use.

You choose which one you choose is up to you since different applications will appeal to different folks: for example, some people don't like storing their passwords on the cloud, while others enjoy the convenience.

(Keep in mind that not all password managers have passphrase generators, though, so that's something you'll have to look for when choosing one if you haven't already. KeePassXC has a Diceware generator that you can use alongside your cloud-capable password manager if it can't generate Diceware passphrases and you wish a convenient way to create them without dice.)

What's important is that your password manager will store all of your passwords for you, so it doesn't cost you anything to have 128-bit passwords for every website on your vault (length limits permitting)... so you can go ahead and 128-bit passwords for those.

And what about your master password? Well, it'll depend on your threat model and how well you are able to balance the things we talked about in this article.

Here are some entropy targets for your master password and situations where you can't use a password manager: 90+ bits (seven Diceware words) is secure, and probably the minimum you should strive for; 100 bits (eight words) is really secure, and 128 bits (ten words) will probably be secure until (or if) quantum computing becomes a thing.


Creating Great Passwords

sonny-chen

Sonny is a designer that values process, alignment, and asking the right questions. He has worked in various environments, from startups, larger companies, to design agencies. He currently lives in Pittsburgh, and previously lived in New York, San Francisco, and Northern Virginia. In his free time, Sonny enjoys playing basketball, dabbling in music production, and trying new foods.

Product Designer at Auth0

Sonny Chen

Designing remotely can be scary, but it doesn't have to be. With all this said, our tools and processes are constantly evolving.



Remote work is becoming more common now than ever before. In today's digital age, we have tools that can eliminate the need to be co-located in order to get things done.

At [Auth0](https://auth0.com/), our team of nearly twenty designers spans multiple time zones, with members distributed across Seattle, Argentina, France–even all the way to <a href="https://en.wikipedia.org/wiki/Georgia_(country)">Georgia</a> (the country, not the state next to Florida).

We take pride in our ability to not only sustain but thrive as a remote-first design team. This is because, while the ability to work remotely is a common practice in almost all companies, those that are fully remote tend to be within certain departments like engineering. For roles that may require more in-person interactions, such as design or product management, there aren't many remote options to choose from. Folks in design that consider remote opportunities are often disappointed to find out that "remote-friendly" doesn't always apply to their role.

Now, there are many reasons why companies may be reluctant to hire remote designers–even many of us who came from traditional work offices were hesitant about what this change in environment and lifestyle would mean to our day-to-day. However, being a company that empowers everyone to work from wherever they want–including designers–we wanted to share with the community some of the ways we approach and solve the challenges of designing remotely.

## Tools & Plugins

Within the design team, we've built an extensive list of tools that we rely on to stay productive, collaborative, and in constant communication. Note that this list can vary by company and teams. At Auth0, our designers are spread across thirteen product teams and marketing initiatives, with some teams working more closely than others. It's important to find tools that meet your team's specific needs and processes and to constantly challenge them as new ones come into place. Here are some of the tools that work well for us (from general to more specific):

### [Figma](http://www.figma.com/)

Figma is our design tool of choice because it enables real-time collaboration and helps us design in the open by acting as a shared repository for all our design files and libraries. We can easily organize files based on team structures and have even created cover templates for each file so that we can easily track and update the progress of projects.

It also offers a lot of benefits when working with our cross-functional partners. Figma is browser-based, so we can easily share work without worrying if people can open it or accidentally overwrites our files. Also, Figma files can be embedded as iframes. This is great for showcasing work straight from our project documents.

### [Mural](https://mural.co/)

For those that are worried about losing that magical whiteboarding experience when going remote, Mural is the tool for you. With Mural, our team can virtually huddle around a whiteboard to brainstorm and collaborate in real-time. There are many benefits to using a virtual whiteboard, and sometimes it can even be better than physical ones.

First off, everything is automatically digitized. No more transcribing or rewriting notes if you messed up or ran out of room. You can also add images, sticky notes, create flows, and drag things around as you like.

Second, we've noticed that virtual whiteboards can give everyone a better opportunity to contribute because no one person is dominating the board or conversation. This is incredibly important in giving everyone a voice so that we can drive better ideas and decision-making.

### [Slack](https://slack.com/)

The design team relies on Slack for many reasons beyond team organization. In terms of workflow, we use Slack to help us automate task management, status updates, surveys, and creating events. We even use Slack to recruit user research participants from Slack developer communities!

Slack is also crucial when it comes to team bonding and communication. A few members of the team are co-located, so we rely on Slack to ensure that no one feels left out. How else can we share our abundance of cat GIFs?

### [Trello](http://www.trello.com/)

There are many ways to use Trello, but one of our favorite ways is to use it to onboard new folks. Our Trello's contain information on design ceremonies and cadences, tools, Slack channels to join (e.g., #design-jams is where we share music), and much more. It's also great because it serves as a living board that we can continually iterate on as the team grows.

### [Zoom](http://zoom.us/)

Zoom is our video conference tool of choice because it offers some cool features along with it's incredibly simple and reliable experience. First off, as a company that relies heavily on customer feedback, Zoom is a great tool to invite and interact with external folks and lets you easily record sessions to the cloud. This makes it easy to capture and share user research sessions or all-hands. Zoom also offers a neat feature called breakout that makes facilitating brainstorms and workshops super easy and fun.

![zoom_image](https://images.ctfassets.net/23aumh6u8s0i/75hTZ7LZadWL300LgZqN2q/92c1a40c1b22bec4aadf73feb82622e8/1_zoom_image)
<p style="text-align: center"><i>The design team in our monthly reviews. Can you tell we like cats?</i></p>

### [Clockwise](http://www.getclockwise.com/)

We value our time to get work done, so we use Clockwise to decrease context-switching and create focus blocks on our calendars. The plugin also connects to Slack so that it can automatically update your status when you are grabbing lunch, in a meeting, or in the middle of your focus time.

### [Loom](http://www.loom.com/)

When we want to capture and share demos asynchronously or walk through an idea, we use Loom. This also makes it easy for people who weren't available to catch up on what they missed.

![loom_image](https://images.ctfassets.net/23aumh6u8s0i/7yWXZlS5xiyqZXWvLJMhkr/c01dbda64c929b03d95b48a5bf3b6a5c/loom_image)
<p style="text-align: center"><i>Tony from our team using Loom to walk through how he injects data into usability prototypes</i></p>

### [Krisp](http://www.krisp.ai/)

Being a remote team, we can expect to find people working from a coffee shop, the airport, or even the beach as long as there's service. For moments when the background noise can get a little distracting, we use Krisp to mute background noise in real-time calls. It's amazing!

### [Donut](http://www.donut.com/)
We use a Slack app called Donut that pairs you with random people across the company. It's a great way to get face time with those that you normally wouldn't interact with, and oftentimes people walk away with something valuable.

### [Toby Chrome Extension](http://www.gettoby.com/)

Lastly, sometimes it can get challenging to manage all the projects and documents that are in flight. We use Toby, which is a Chrome plugin that turns your browser tab into your personal collection of links. You can set collections for documents that need your attention or save a collection of good reads to share with the team.

## Communication & Process

As designers, we often serve as the connective tissue between teams as part of thinking holistically and designing a cohesive product experience. This requires strong levels of communication within the design team and with our cross-functional partners. As part of our work, we need to ensure that everyone is clear on goals, has ongoing conversations as projects develop, and share learnings across teams so that we can achieve better outcomes and reduce duplicative work.

Here are some of the ways we facilitate this type of communication:

![Remote Working](https://images.ctfassets.net/23aumh6u8s0i/1a1S0WICPdXHF78I3S3ysT/23b698a239d8a43d7d800794cae2620f/0_hero)

### Project and temporary channels in Slack

Slack can create just as much distraction as it can create productivity. At Auth0, multiple projects can be happening at any time with many different people involved. Rather than posting all updates to team channels, we like to create project-based channels to eliminate unnecessary noise and to consolidate everything into one place.

For projects and conversations that are short-lived but still need a space for discussion, we create temporary channels by specifying "tmp" at the beginning of the channel name (e.g., #tmp-project).

### Knowledge shares

We value team diversity and recognize the amazing mix of talents and backgrounds within our design team. In order to grow, we encourage designers to hold knowledge shares where they walkthrough their process on a particular topic, whether that be creating plugins, facilitating workshops, or conducting user research.

### Pairing

Impromptu pairing sessions are a central part of our day-to-day, and we often find that they yield quicker and more valuable results than scheduled meetings with larger groups. We try to make these seamless by integrating the Zoom plugin with Slack so that you can create and join a session with a push of a button.

### Workshops and Brainstorms

We like to bring as much structure as we can into our meetings. This includes preparing slides and exercises ahead of time, having a clear agenda, designating people to take notes, and always defining action items.

![workshops](https://images.ctfassets.net/23aumh6u8s0i/7z2pn0Ywqm4kgLMx5ZPiuz/b7e14aa5cc256eac74f0870df83cbb7f/3_workshops)

<p style="text-align: center"><i>The design team running through a structured ideation session with our cross-functional partners</i></p>

### Ceremonies
Our design team has a set of recurring meetings where we communicate updates, share ideas, and look to each other for support. These meetings include weekly status updates, critiques, design all-hands, knowledge shares, and more. It's important to schedule these while considering everyone's time zones.

For our meetings, we like to have a show, not just tell, policy in which we prepare slides with accompanying visuals so that everyone can follow along with the proper context. We also try to systematize everything we do so that we can focus on what's important. An example of this is templatizing slide decks so that it reduces prep work while creating consistency in our presentations.

In terms of process, team members can propose changes to how we operate at any time, and we like to send out design surveys and polls through Slackbot to get pulse checks on how we feel.

### Offsites and Retreats

With all this said, sometimes it's good to just meet up in person. At Auth0, we have multiple offsites a year (including locations like Cabo!). We take advantage of these opportunities to hold strategic meetings, hear from different parts of the business, but also to bond and enjoy our time with our fellow team members.

![offsites](https://images.ctfassets.net/23aumh6u8s0i/5vtHEO6uoB5bbAany2rb4m/c46569fc26c27d6b2c1318a21baed949/4_offsites)

<p style="text-align: center"><i>The Auth0 design team getting together at our Bellevue office</i></p>

## Conclusion

Designing remotely can be scary, but it doesn't have to be. With all this said, our tools and processes are constantly evolving. As our team continues to grow, we face new challenges, such as scaling our design system or bringing more data into our design decisions.

If you have any thoughts or tips on anything that was mentioned, please drop them below. We would love to hear them!

Also, if you are considering remote work as a designer or any other role, check out our job page [here](https://auth0.com/careers/positions?areas=Design).

Thanks for reading!


Designing Remotely at Auth0

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Auth0 gives you the tools and expertise to build the IAM solution that’s right for you – not us.



Creating modern applications can be like working with Legos — get the right set of instructions and you can build precisely what's on the box.

That can work for simple scenarios, but half the fun of Legos (and of business) is making what YOU want to build.

In other words, whatever you want to make — [easy integrations for multiple business units](https://auth0.com/learn/new-business-accessed-cimpress-platform-5-minutes-auth0/), a product that will [connect expert medical staff and patients globally](https://auth0.com/learn/act-md-sees-2x-dev-savings-auth0/), or [seamless customer experiences](https://auth0.com/learn/jetprivilege-case-study/) - it's unlikely to match exactly what your identity service provider has created for you out-of-the-box. Your vision, your execution, your customers are all bigger than that — you're bigger than a box, so we won't put you in one.

![You're bigger than a box, so we won't put you in one](https://images.ctfassets.net/23aumh6u8s0i/34pl8N4OEbbu63V2ibsmPC/95db6f8792ec661e07547dec35e2604a/you-are-bigger-than-a-box)

One-size-fits-all solutions assume that all organizations have the same challenges, goals, legacy infrastructure, team skills, etc. Only you know what your organization's challenges and goals are.

But identity probably isn't your main expertise. Why would it be? You're great at fintech or media or B2B Saas, so you might not realize that identity is a spot where you can increase conversion rates and [streamline your customer experience across multiple brands](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/) — or realize that some intriguing ideas face security risks. If you choose Auth0 for identity, part of our job is to give you the right advice and tools to support your vision, but you are always in control.

## POC on Your Terms

Part of that control begins with the proof-of-concept (POC). You shouldn't have to wait around for months to learn whether or not a provider can handle your particular use case. Figuring out if Auth0 will work for you is free, no credit card required. And we support you with [docs](https://auth0.com/docs/), [quickstarts](https://auth0.com/docs/quickstarts) and our [Auth0 Community](https://community.auth0.com/).

Finn AI, an Auth0 customer and partner, was working on creating a conversational AI for banking providers and needed to know if Auth0 was up to the security, regulatory, and speed challenges. "Our first proof of concept around using Auth0 was done by an engineer over his weekend because he was excited about it. We had a 48-hour turnaround on that first POC of Auth0 within an SDK environment," says Robin Monks, Director of Engineering, [Finn AI](https://auth0.com/learn/finn-ai-saves-10-5-ongoing-engineering-time-auth0/).

Finn AI's experience is no anomaly. We frequently hear from customers after they've had the opportunity to explore Auth0 on their own terms.

## Helping You Do More, Go Farther

We often find that our collaborative architecture process surfaces business choices. We always present options that empower decision makers within an organization — not us.

Take the recent example of a large global industrial company looking to ensure that each business unit can handle identity independently, but remains within the organization's overall guardrails. We helped the organization create a B2B2C hybrid solution that allowed them to decide on their particular mix of control and freedom, including multi-tenants that could be unified across business units while requiring universal multi-factor authentication.

## Fixing Challenges Quickly

Not every app is born in a green field. Identity seems like it ought to be simple, but is actually really complex. Whether you're dealing with connecting multiple legacy applications across geographies with different data regulation requirements or rapidly shifting business needs, Auth0 can help you adapt by handling that complexity for you. From trickle migrations that can help you seamlessly move users without forcing password resets to [effortlessly managing scalability spikes](https://auth0.com/learn/sports-centric-streaming-service-fubotv-sees-50-roi-just-auth0s-security/), Auth0 can help you solve problems before they happen.

Auth0 helps [Siteminder](https://auth0.com/learn/siteminder-enhances-experience-security-30000-hotels-auth0/) manage more than 87 million hotel bookings each year (a rate of 166 per minute), engaging guests through a full range of [third-party applications](https://www.siteminder.com/siteminder-exchange/?utm_source=referral_pr&utm_medium=referral&utm_campaign=sm-201901-pr-global-auth0-case-study&offer=none&productinterest=sm) including mobile messaging, customized emails, mobile key, and feedback tools. Siteminder CTO and Co-founder Mike Rogers says they're also dealing with a "land grab" market situation and Auth0 helps manage that complexity. "Auth0 is pretty much invisible," says Rogers. "And, I think it works well when you are that transparent. We don't have to worry about it because login and password management is now a solved problem for us."

Rogers goes on to talk about the thousands of dollars Siteminder would need to invest yearly to remain ahead of industry identity changes. "Anytime Auth0 releases a feature, that's something we don't have to do ourselves. Ultimately, that benefits not only us, but the hotel customers that rely on us to continue supporting them through our own enhancements and innovations."

## Respecting Your Vision, Execution, and Customers

At Auth0, we're excited by the complexity of identity and the wide range of business challenges we help our customers solve every day. We do that by fully respecting our customers vision, execution, and end users. At Auth0, we give you the tools and expertise to build the identity access management (IAM) solution that's right for you, not what's right for us.

If you'd like to learn more about how Auth0 can give you the tools and expertise to build the identity access management (IAM) solution that's right for you, not what's right for us, please reach out to an [Auth0 resource](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


You’re Bigger than a Box, So We Won’t Put You in One

jorge-fatta

Jorge is a Software Engineer that enjoys building tools for colleagues. He manages the Developer Tools team at Auth0. This team works on improving development workflow through tools and automation. He likes to spend time with family, playing football, or preparing and drinking all possible forms of coffee.

Engineering Manager

Jorge Fatta

Helping engineers stay focused on building features that solve the hard problems of identity for customers.



Auth0 is continuously growing. To share a couple of examples, we just hit a new milestone: [_2.5B+ monthly logins securely authenticated_](https://twitter.com/auth0/status/1101216297206059009) and we [_ended 2018 with a nearly 80 percent increase in both sales and new customers_](https://auth0.com/blog/auth0-closes-year-of-impressive-growth-in-2018/).


We are growing and scaling the organization at a really fast pace, and engineering is no exception. This presents some interesting and fun challenges:

1. Promoting and developing the **culture** that fuels this endeavor.
2. **Hiring** and retaining great engineers.
3. Minimizing duplicate work and time to be **productive** as new people come in.

This blog post is focused on how Auth0 is addressing part of that last challenge; by building a dedicated team to unleash the potential in Auth0 developers to deliver business value with confidence.

## Developer Tools Team at Auth0

In the same way that Auth0's goal is to make identity simple for developers, the Developer Tools team goal is to let our engineers fully focus on development and providing value for our customers. We want to provide the best tools to keep our developers happy and engaged shipping new features instead of struggling every day with exhausting and repetitive tasks that could be automated.

We defined the mindset we want to adopt to develop our tools and outlined a roadmap with the following vision:

> Provide toolchains that Auth0 engineering teams can use to improve their workflow, automate manual tasks, simplify complex processes, and implement a set of company-wide standards.

### What we do

1. Work closely with the engineering teams to understand their pain points, provide tools and guidance.
2. Investigate existing tools and develop new ones to solve their needs:

    * Development Environment tools.
    * Change Management tools.
    * Debugging and Performance tools.
    * Incident Response tools.
    * Work with the [_SRE team_](https://auth0.com/blog/progressive-service-architecture-at-auth0/) to integrate site reliability tools into the platform.

1. Recommended patterns & practices:

    * Identify patterns currently in use across our organization.
    * Provide developer tools for Scaffolding and Code Snippets.
    * Promote the adoption and tooling for the best engineering practices, e.g.: [_contract testing_](https://martinfowler.com/bliki/ContractTest.html).

### What we don’t do

1. While we provide general guidance, we don’t do consultancy, i.e.: we neither do work at a particular team's requests to tackle specific issues, provide advice on demand, or do an investigation by request nor develop customized solutions to solve a specific team's needs.
2. We don’t provide advice or work on particular issues on demand: our tools are developed following a *product* approach.
3. We don’t embed team members on another team to build tooling. We might do it for discovery, but development happens within the Development Tools team.
4. We don’t debug and profile internal services, we provide the toolchain for that.
5. We don’t do [_SRE (Site Reliability Engineering)_](https://auth0.com/blog/progressive-service-architecture-at-auth0/), we might provide tooling that could improve the experience during their analysis.
6. We don’t investigate a random tool or technology on demand. We do it if it is related to reducing developer pain.

<include src="TweetQuote" quoteText="Learn how our engineers stay focused on solving the hard problems of identity for our customers."/>

## Tools Development Mindset

We are approaching the development of the tools as internal **products**, guided by these principles:

1. **Ownership**: We own the tools that we ship, following a “*You Build It, You Run It*” principle.

    * We operate what we build: taking care of the CI/CD, incident response, etc.
    * We take care of not just the coding but also keeping the *product* running in good shape.

1. **Extensibility**: We develop these tools taking extensibility into account from scratch.

    * For example, any engineer should be able to easily extend* *the* CLI *that we provide to interact with Auth0’s local development environment.

1. **Internal Collaboration**: We engage our users to **contribute** with the tool evolution, collecting their feedback and welcoming their contributions to the code and documentation (via pull requests on git repositories).

We aim to follow an **iterative** process to develop our tools (just like our Product Engineering teams), working closely with our internal customers.


> The process adopted by our team suits the lean startup cycle model.

->![Jeff Patton & Associates: lean startup cycle model](https://images.ctfassets.net/23aumh6u8s0i/4TRZnZXwjpgNp5gtf4u168/b8ab189eea4a634cdbadfcf67b5c12be/lean-startup-model)<-

*[*_Lean Startup Model_*](https://www.jpattonassociates.com/common-agile-int-for-startups/lean-startup-model/)* by *[*_Jeff Patton_*](https://www.jpattonassociates.com/) is licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/).*

<include src="TweetQuote" quoteText="The Auth0 Developer Tools team shares three key principles to develop a tools-development mindset that helped them create successful internal products for developers."/>

## Our Tools

Some of the tools that we currently maintain and regularly work on had a great impact and adoption rates within the organization but were built prior to adopting the _internal dev tools as product_ mindset mentioned above. It was originally hard for us to *learn *from the tools once released without any kind of usage metrics. For that reason, we focused on existing solutions by:

* Improving **documentation**, both user guides and internal playbooks concisely describing deployment, troubleshooting, and **contribution** guidelines.
* Instrumenting **usage and performance** metrics to **measure** the impact of our iterative improvements.

### Vivaldi

->![Containers on a dock](https://images.ctfassets.net/23aumh6u8s0i/5d1b2HI9Jjwld4HEksBQff/ec3bdb6bf8883d78cf39f907bb6f65bf/containers-on-a-dock)<-

*Photo by *[*_Guillaume Bolduc_*](https://unsplash.com/photos/uBe2mknURG4)* on *[*_Unsplash_*](https://unsplash.com/)*.*


**Vivaldi** is the tool on which we have invested most of our efforts so far. Named after the Italian musical composer, it is a [_Docker_](https://www.docker.com/) container-based development environment that allows engineers to run a local Auth0 on their machine.
Through a command line interface (CLI), Vivaldi provides commands to quickly interact with our service instances running locally in order to:

* Update dependencies.
* Run tests.
* Attach a debugger.
* Run diagnosis tools.
* Execute performance profilers.

->![Vivaldi: Docker container-based development environment](https://images.ctfassets.net/23aumh6u8s0i/1NlLXfq8I0vpBm5KL3cI5l/30cd621072a76bcd0406151786f49246/vivaldi)<-

The initial version of the tool had a **great impact on the development cycle** and was **widely adopted**. Before *Vivaldi*, developers needed to manually spin up the services they were working on, fighting with dependencies with their local environment. Now they can rely on an isolated and replicable environment, being able to spin up the entire services cluster relatively quickly.

As our teams and number of services grow, we are now actively working with teams to better implement a fast development loop without relying too much on running all Auth0 services locally. We are already planning the next generation of Vivaldi, which will support future growth in a scalable way.

### Slack Bots

->![Droid giving you a helping hand](https://images.ctfassets.net/23aumh6u8s0i/H5W70I4X8Ot6NSsj0VHyv/fadc300cf5495e31413a4ef43f2128d7/droid-giving-you-a-helping-hand)<-

*Photo by *[*_Franck V._*](https://unsplash.com/photos/jIBMSMs4_kA)* on *[*_Unsplash_*](https://unsplash.com/)*.*

We developed an internal Slack bot platform called _Gynoid_ during a hackathon and it was quickly adopted by our engineering organization. The platform is customized to satisfy the needs of our developers:

* To build Slack bots easily: just create a JavaScript file, add metadata, and you are done!.
* To install Slack bots straight from a GitHub repository.
* To extend existing bots from different sources: one bot, multiple functions, different repositories.
    * We call these extensions Droids. To install new extensions, we have a Gynoid that serves as a wrapper for this library. Our _Gynoid Droid_ is responsible for registering and extending our bots directly from Slack.

A notable Droid is one that serves as a _concierge_ for any Slack channel, properly named @concierge. It works like this:

* A channel that needs a person on duty to address direct questions invites `@concierge` to the channel.

->![Inviting the concierge Slack bot to a channel](https://images.ctfassets.net/23aumh6u8s0i/762YoyCbXhOlyM9zQAr24/469fe557035293e641012aa2bc03c672/invite-concierge-slack-bot)<-

* A teammate is assigned the role of `@concierge`.

->![Assigning the concierge role to a teammate](https://images.ctfassets.net/23aumh6u8s0i/2u1bJjRFdCbJWf48k9t1Ot/3fb1c5c67e6d6819df21f09564896e18/assign-concierge-slack-bot)<-


* When someone needs to ask anything to a team, for example, they visit the team's channel and ask the question directly to `@concierge`.

->![Asking a question to Slack bot concierge](https://images.ctfassets.net/23aumh6u8s0i/3Gtm4wdoomqbMJas4rzjGf/a1249a2842972eae97cc08b29328a28d/asking-question-concierge)<-

* The teammate with the role of `@concierge` is sent a direct message through Slackbot with the concierge request.

->![Slack bot concierge sending a direct message to teammate](https://images.ctfassets.net/23aumh6u8s0i/4nPgWa3KasUha1YjLcAmos/641263ac54adb338d5906ee7d410673b/concierge-slack-bot-direct-message)<-

* The concierge has now the responsibility to research and to address the request directly. If the request is outside of the scope of the team, the request is redirected to the appropriate channel

The concierge droid helps us avoid unnecessary noise in Slack &mdash; especially since it is widely used within our company as a good substitute for `@here` and `@channel` when asking questions. It's very useful when you have an "on-call" rotation in your team and people need to reach the teammate on call through a Slack channel.

## Roadmap

We are currently working on the next major version of our main tools, focusing on:

* **Scalability improvements**: Vivaldi, our Docker-based development environment, will run an increasing number of services without compromising the developer machine resources.
* **Robustness**: Gynoid, our slack bots platform, will have end-to-end tests and its dependencies will be upgraded to the latest stable versions, allowing our team and contributors from other teams to introduce changes or develop new *droids* with confidence.

Additionally, we’re in the early stages (discovery, viability analysis, and ideation) for a **unified internal CLI** (command-line interface): we already have multiple CLIs that provide different types of functionality. As the number of CLIs keeps growing, it will become hard to keep track of them.

Some teams will decide to use a different tech stack, which may require different runtime dependencies and a distinct CLI to better manage it. However, we could create a unified CLI, customizable and extensible to meet the needs of different tech stacks. Having a unified CLI will help internal toolchains scale while staying maintainable.

## Conclusion

We aim to provide an optimal developer experience, unified across the engineering organization. To do this we take ownership of the toolchains, iterate to improve them and encourage teams to use these tools that have already proven their value on making developers more productive.

We dedicate our Developer Tools team efforts to the discovery, building, maintenance, and promotion of reusable solutions so that the rest of the engineers don’t have to struggle with repetitive tasks, walk through slow development cycles, or constantly switch contexts to take care of maintenance tasks that can be automated.

We want Auth0 engineers to be focused on building new features that solve the hard problems of identity for our customers.

<include src="asides/AboutAuth0" />


Auth0 Internal Dev Tools: Unleashing Engineering Potential

auziros:bobby-johnson

Bobby is a full-stack developer, advocate, and evangelist at Auth0. He is a passionate engineer with an interest in learning and teaching new technologies, using open source software, and engaging the greater software development community. His experience ranges from building line-of-business applications for financial professionals with Russell Investments and Milliman to distributed social content apps with Cheezeburger and Steller.

Developer Advocate Engineer

Bobby Johnson

Learn about the four-year-long journey Auth0 took to deliver the tools needed by both field engineers and our customers to implement last mile identity solutions quickly.



Previously, we wrote about the emerging pattern of [Serverless Extensibility](https://auth0.com/blog/why-is-serverless-extensibility-better-than-webhooks/). Examples of the concept are popping up in many of the services you use daily like [Twilio](https://www.twilio.com/functions) and here at [Auth0](https://auth0.com/). In this post, I will talk about challenges our customers were facing with our Auth0 Identity product, and how this led us down the path toward implementing the [extensibility](https://auth0.com/extensibility) pattern in a variety of features.

## The problem

![NASA Engineers working on MAVEN](https://images.ctfassets.net/23aumh6u8s0i/3KQXnuCX6H4EROaqBq3hRh/e3e24c8007258b4f7b45f0aef852cebd/engineers_working_on_the_high-gain_antenna_of_the_MAVEN_spacecraft)

*Placed into the public domain by [NASA](http://mars.jpl.nasa.gov/multimedia/images/?s=1) using [Creative Commons](https://creativecommons.org/publicdomain/zero/1.0/)*

In the early days at Auth0, there were two groups: Core and Field Engineering. Core focused on the core functionality of the authentication product, and the field engineers helped customers use the product in their applications. The company was discovering what customers needed in the product.

Our customers' focus was on the authentication transaction. A lot of interesting features can attach to the process of someone trying to login:

- Profile Enrichment
- Progressive Profiling
- Authorization
- Claims Transformation

Customers will come up with an unlimited supply of feature requests. We could not possibly build every feature at once.

Moreover, sometimes building features into the core product for customers is not the right approach. We needed a way to try ideas out. An idea may sound great, but in practice be problematic. Investing core engineering resources to these ideas is very expensive.

> **"The primary use case for extensibility at Auth0 was to empower field engineers to work on the last mile solutions for the customer without involving core engineering."**<br />
> Eugenio Pace - Co-Founder, CEO

If every interaction with a customer involved identifying an idea, putting it in the backlog and coming back to them at a later date, it would add friction to the process and turn customers away.

For example, we had customers who wanted to do profile enrichment. They used services like [FullContact](https://www.fullcontact.com/) to look up a new user and grab related information about them such as their company, role, and social media accounts. FullContact is just one service as there are several others. We had prospects that were depending on these capabilities to have confidence in using us as a platform, and without it would not become customers.

## Custom code extensibility

![NASA's "Webb-cam" Captures Engineers at Work on Webb at Johnson Space Center](https://images.ctfassets.net/23aumh6u8s0i/6UpPFk1QXmAs5xequW3Wpj/23c899dfcde145fb664480ffddd2cd9f/34827899312_571fa2a976_k)

*[NASA](https://www.flickr.com/photos/gsfc/34827899312) licensed under [Creative Commons 2.0](https://creativecommons.org/licenses/by/2.0/)*

To solve this problem, we introduced a method of adding custom code into the platform that could be defined by customers. The inspiration for custom code extensibility as a solution came from spreadsheets. Excel has significant functionality out of the box, but you can always add a function, macro or calculation that better reflects your goal. Moreover, you can write them yourself directly in Excel, removing the dependency on Microsoft engineers.

> **"We wanted a similar experience for our users. A user should be able to log in to the dashboard, write a small amount of node.js code that executes later during authorization transactions."**<br />
> Eugenio Pace - Co-Founder, CEO

Like Excel, we wanted to offer users a really simple experience for customizing our product through code. We believed a user should be able to write their logic in an editor, debug it in place, and make it live in production, all without having to stand up a service. This differed from the prevalent approach at the time for dealing with customization through webhooks, which were hosted by the user.

We quickly implemented an MVP to prove out the concept. It created a process boundary between the core Auth0 stack and the customer's code. It primarily prevented well behaved, well-intentioned code from accidentally bringing down the authorization service or other sandboxed code.

Although the MVP had its limitations, it proved that the user experience for customization could be greatly improved, aligning well with our philosophy of "Identity made simple for developers."

## Evolving customization features

![NASA engineers cleaning mirror with carbon dioxide snow](https://images.ctfassets.net/23aumh6u8s0i/2NQmBSwzenRP0r4HFvU0hZ/1b0447fd2fa9bc307d91d3772f94f6c9/17402277412_5e2834517c_k)

*[NASA](https://www.flickr.com/photos/gsfc/17402277412) licensed under [Creative Commons 2.0](https://creativecommons.org/licenses/by/2.0/)*

Custom code extensibility is exposed in our customer dashboard in three ways: Auth0 Rules, Hooks, and Extensions.

**[Auth0 Rules](https://auth0.com/docs/rules/current)** were the first publically available use case where our customers could easily add custom functionality to their authorization flow directly in the dashboard. Rules execute after authentication but before authorization. We offer a gallery of Rule templates that make it easy for customers to address common scenarios out of the box. Because Rules are code though, customers can easily customize the logic further to meet their specific needs.

A customer clicks a button to add a new Rule, selects one from a set of standard templates which they can customize with a simple editor right in their browser. When saved, the Rule is active on their account for all authentication requests.

![Rules UI](https://images.ctfassets.net/23aumh6u8s0i/A8nlyZBGaECLAhpZ2k9CK/892d84cff88e39e3a51a370ba302964b/rules)

Rules allow you to easily customize and extend Auth0's capabilities. They can be chained together for modular coding and can be turned on and off individually.

Rules were really powerful but were limited only to login. Once customers got a taste of rules, they started to ask us for more places where they can customize the product, and so Hooks were born.

**[Auth0 Hooks](https://auth0.com/docs/hooks)** allow you to customize the behavior of Auth0 using custom code that is executed against several extensibility points. Not only can you introduce customization during the client credentials exchange, but also pre and post user registration. Hooks also take advantage of a more feature rich editor.

![Hooks UI](https://images.ctfassets.net/23aumh6u8s0i/5z6VxLuwFqfKdKRba9vA6W/f63a755d3c63187999e262867c1fdff0/hooks)

While both Auth0 Rules and Hooks give you fine-grained control of the authentication pipeline, **[Auth0 Extensions](https://auth0.com/docs/extensions)** are mini-applications that extend the Auth0 identity product with 3rd party integrations.

They do not directly tie to any specific event in the system. Instead, they can invoke any Auth0 API, can configure the customer tenant, deploy Hooks or Rules on installation and even have an associated user interface. They are extremely powerful and opened up many use cases.

![Extensions UI](https://images.ctfassets.net/23aumh6u8s0i/3z6SONf0xAGkS2UBQavAUL/ce74f139ed89bb283121f9f69abe7482/extensions)

Auth0 Extensions are written using the Webtasks infrastructure. Customers can select an Extension from our gallery and provide a set of configuration options to begin using one.

This is just the beginning. We're constantly looking to enable richer and richer customization in our product, and you'll continue to see us opening new doors as we learn.

## The impact on our sales engineers and customers

![NASA engineers celebrating curiosity](https://images.ctfassets.net/23aumh6u8s0i/5pFHSx1biEJCYLFEKsuh6g/c75c5def4fcb853016d4d68e853ea9e7/celebrating_curiosity)

*Placed into the public domain by [NASA](https://commons.wikimedia.org/wiki/File:Celebrating_Curiosity.jpg) using [Creative Commons](https://creativecommons.org/publicdomain/zero/1.0/)*

Adding extensibility to the identity product opened up a window of customization where field engineers could work independently from core engineering. They could deliver customizations very quickly without waiting weeks or even days, enabling many successful sales engagements.

> **"In some cases, we were able to deliver demos where we implemented feature requests in the demo during the meeting. It was amazing for field engineers and our customers."**<br />
> Eugenio Pace - Co-Founder, CEO

Putting extensibility into the hands of customers also gives us great insights into where the market is going. If we see an extension being implemented again and again through the use of custom code, that is a validation of that feature and an opportunity to add in the core product.

Multi-Factor Authentication came about this way. MFA was not a switch on the dashboard initially. It was merely a rule you applied to your account. Over time, our customers' usage of this rule indicated MFA was an important feature to have in the core product.

For more examples, take a look at our [rules repository](https://github.com/auth0/rules) on Github. Every single one comes from a real-world customer use case.

> **"Every event in the life cycle of the user can be expressed through code and in that way we can support any backend out there in a flash. No matter how customers encrypt or hash passwords; whatever they do is supported because they can provide the details using custom code."**<br />
> Sandrino Di Mattia - Engineering Lead

## The impact on our business

![Happy Employees](https://images.ctfassets.net/23aumh6u8s0i/3tb9Pbddo96TUGVZMxu68U/39443eb09615ed15655b82f45bc54862/culture-2)

Not only did we make our customers happier, opening up customization provided us a direct return on revenue. Looking at our data, we found our customer retention increased up to 10x for those users that took advantage of customizing. Not only that, but our largest deals depend on these customizations even today, bringing 70% of our cloud revenue.

## Summary
In the past four years, we've been exploring how to better enable our users to customize and extend our SaaS. On our journey, we discovered the Serverless Extensibility pattern provided a great solution. We found that allowing extensions to be authored in-line provided tremendous value both to our customers and to the business. It allowed us to close more deals and deliver customer features much more quickly and cheaply than before. 

_I would like to thank [Eugenio Pace](https://twitter.com/eugenio_pace), [Sandrino Di Mattia](https://twitter.com/sandrinodm) and [Tomasz Janczuk](https://twitter.com/tjanczuk) for taking time out of their busy schedules to be interviewed for this post._

<include src="asides/AboutAuth0" />


Our Journey toward SaaS Customization and Extensibility at Auth0

Implement identity management tools for all of your users as you scale.



On August 21, Facebook took down over 600 accounts, pages, and groups that originated in Iran. These accounts were disseminating political disinformation, largely targeted at users in Latin America and the Middle East.

Cybersecurity firm FireEye initially tipped Facebook off about a network of pages called Liberty Front Press. Their reach was 74 Facebook pages, 70 accounts, and 3 groups, as well as 76 Instagram accounts.

The tip also led Facebook to discover an array of other networks, pages, and accounts that were disseminating false information — and engaging in cybersecurity attacks.

With these issues so widespread on the platform, how could Facebook not have figured it out sooner?

Coupled with numerous other [data breaches](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) across multiple companies this year, the most recent Facebook incident highlights how important it is for companies to continually update their user-management practices as they scale — before bad activity gets out of control.

## Facebook's Disinformation Incident Reveals the Challenge of Monitoring All of Your Users

The number of daily active users on Facebook has nearly tripled since 2011. Today, it boasts 1.47 billion users worldwide.

![Facebook daily user statistics](https://images.ctfassets.net/23aumh6u8s0i/1A3WvCiIUCsatoS3Du1l7f/87c64d7a41a81547cc3261de519f27f3/facebook-scandal_daily-users)
 
In addition, as of Q2 2018, the company had over 25,000 employees, and it shares its data with numerous third parties. 

Although it recently ended this practice, following the [Cambridge Analytica scandal](https://auth0.com/blog/what-data-did-facebook-really-give-cambridge-analytica/), Facebook historically shared user information with major online and offline data brokers through its Partner Categories program. This included what the company had collected itself (e.g., page likes) and information from its advertisers.

<include src="TweetQuote" quoteText="With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of Fake news, and accounts are rampant."/>

These providers helped other businesses understand and optimize their marketing campaigns. As an example, [according to Facebook](https://www.facebook.com/help/494750870625830):

"An auto dealer may want to customize an offer to people who are likely to be in the market for a new car. The dealer also might want to send offers, like discounts for service, to customers that have purchased a car from them. To do this, the auto dealer works with a third-party company to identify and reach those customers with the right offer. The third-party partner provides Facebook with information that helps Facebook connect those customers with the offers." 

With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of [Fake news](https://www.zuora.com/2017/05/26/social-platforms-channel-fake-news-next-revolution-journalism-2/) and accounts are rampant.

How can your team do better?

## Avoid Your Own Disinformation Scandal with Strong Identity Management Tools

Even if you’re not as large as Facebook, there are key steps you can take as your company scales to be sure you are keeping track of who your users are (customers, employees, and third parties) and what behaviors they display in order to root out fake accounts and nefarious activities.

### Identity management for your employees

As your team expands on multiple levels, across new geographies and time zones, following everyone working within your system can be a headache.

Pushing certain [Rules](https://auth0.com/learn/cloud-identity-access-management/) in the cloud, like blocking people or even entire groups from logging in on particular devices or at certain times, can help cut down on inefficient DIY tactics and organize access in a streamlined way.

If using Auth0's solutions, you can quickly pull [user-profile details](https://auth0.com/docs/user-profile/user-profile-details), including

* first name and last name;
* email address; and
* specific company identifiers, such as an employee number or a listed department name.

Given the range of data sources that this information could come from, including custom databases, an Active Directory, or even a social provider like LinkedIn, Auth0 will normalize this and return a basic set of data, with attributes like  `user_id`, `name`, `nickname`, and `picture`, to allow admins and programs to retrieve the information they need when double-checking employees.

Giving admins the control to rapidly parse an employee user base will help them notice any suspicious behaviors — like repeated failed login attempts in real-time — mitigating the risk of false accounts or system breaches.

### Identity management tools for third parties

For third parties such as consultants or auditors (or, in Facebook's case, purchase-data providers like Datalogix, Epsilon, Acxiom, and BlueKai) that you allow into your system but that are not regular employees, providing them with a single sign-on (SSO) feature through [Auth0 Universal Login](https://auth0.com/universal-login) will not only make things cleaner and more efficient on their end but also help consolidate all of their credentials into a single location for vetting purposes.

Auth0 Universal Login provides a secure login infrastructure to authenticate users to your apps.

![Auth0 Universal login page](https://images.ctfassets.net/23aumh6u8s0i/6TwsXjuNeMnkg5I4ZN3y5o/c4b1c77a6e5b8e10b44dc000bde49d19/auth0-centralized-login)

On the back end, after the authentication event occurs, admins can call the `getUserInfo` method to acquire all of the user's profile information (as needed).

Keeping track of external users is critical in maintaining order and privacy within your system as needed (as Facebook's canceled Partner Categories program highlighted). Because these users aren't formal employees, you want to be sure that they still adhere to your company's standards and practices and aren't straying or creating unwanted programs.

### Customer identity management tools

Knowing your customers is key to growing your company. Strong customer-identity and customer-access tools can make onboarding quick and fun, up your daily active-user base, reduce churn, and [drive conversions](https://blog.nomnominsights.com/turning-customer-feedback-into-research-hypotheses/).

It also helps you ensure that no one is masquerading as someone they're not.

This year, British shipping company Clarksons revealed that a single fake account was to blame for [stealing confidential information](https://www.zdnet.com/article/clarkson-says-single-user-account-to-blame-for-data-breach/). The account accessed corporate databases and made off with highly sensitive data, such as Social Security numbers, criminal convictions, medical information, tax and insurance details, signatures, and login credentials  — along with even more personal details, like ethnicity and religion.

To get out of the mess, Clarksons had to hire outside forensic help to find and disable the problematic account.

Implementing social integrations can help you avoid this by immediately double-checking that all users are who they say they are. A social login feature relies on existing login information from a social network provider like Google to verify a users identity.

![Log into a Wordpress site using social login provider](https://images.ctfassets.net/23aumh6u8s0i/4DR1XvnUhTlC5oOYIQw4vU/c5c39ff1cd0ec9e4a6d26cb97ca860ed/facebook-scandal_auth0-wordpress)

A customer can sign into a third-party website like WordPress through Google instead of creating an entirely new account. Since the provider (Google) has already authenticated the user, it provides an extra layer of security.

Any further support you can get to vet users — even your loyal and trusted customers — can go a long way toward avoiding a costly data breach.

<include src="TweetQuote" quoteText="Creating or outsourcing tools like Auth0 Universal Login for rapidly pulling and storing current user data, and features like social login will help secure your company at its foundation so that you can grow."/>

## Use Identity Management Tools to Stop Bad Behavior at the Source 

As your company grows, it's a blessing to bring on more users — whether new customers, freelancers, consultants or employees. But it can quickly become a curse if you don't implement strong practices for monitoring them.

As the Facebook disinformation scandal clearly shows, without proper tracking, small issues can balloon out of control. Ideally, you'd stop any fake accounts at the login source so they don't snowball at all.

Creating or outsourcing tools like [Auth0 Universal Login](https://auth0.com/universal-login), [Rules for rapidly pulling and storing current user data](https://auth0.com/docs/rules/current), and features like [social login](https://auth0.com/learn/social-login/) will help secure your company at its foundation so that you can grow.


What the Facebook Disinformation Scandal Means for Your Company

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Multifactor authentication and social login are just two of several tools that Auth0 offers on its platform to guard its customers against breaches.



The number of attacks on individuals' data is astounding. From the [Equifax breach](https://www.washingtonpost.com/news/the-switch/wp/2018/03/01/equifax-keeps-finding-millions-more-people-who-were-affected-by-its-massive-data-breach/?noredirect=on&utm_term=.4bbb572bb730) that continues to worsen to attacks on high-tech companies like [Uber](https://www.wired.com/story/uber-paid-off-hackers-to-hide-a-57-million-user-data-breach/) — it seems as if no one is immune to cybercrime. 

Several common threats exist to web apps:

* XSS (cross-site scripting), when malicious scripts are injected into otherwise trusted web applications
* Clickjacking, which happens when an attacker introduces transparent or opaque objects into your web application
* Cross-site request forgery, in which an attacker impersonates an authorized user and makes requests on their behalf, like resetting a password.

And it doesn't stop there. These threats are constantly evolving. As soon as IT teams and experts root out dishonesty,  it seems like the criminals pivot to find a new path. 

So what can you do, now, to secure your user database in this difficult landscape?

<include src="TweetQuote" quoteText="What can you do to secure your user database when there are so many threats like XSS, Clickjacking, Cross-site request forgery, etc?"/>

This piece will offer concrete tools and approaches for keeping your customers safe and help you build a solid technical foundation on which to scale. 

## Why Is Your User Database At Risk?

A major reason that user databases are at risk is inherent software vulnerability. For example, Apache servers have historically been exposed to the [Heartbleed](http://heartbleed.com/) bug. Heartbleed is unique to OpenSSL (the data encryption technology used by a huge chunk of the internet) and allows attackers to intercept vulnerable information between one's browser and computer. 

If you're entering a password or payment information into a browser, for example, although this data will be encrypted during the transfer to the computer on one level; a second connection, often described as a “heartbeat” between the browser and computer can be intercepted.

![The heartbleed bug](https://images.ctfassets.net/23aumh6u8s0i/7bi6p1IFj7zJXCTzoN17S5/2dc69f99ed1d1efc1ce92a3c6738fdaf/the-heartbleed-bug)

([Source](https://www.youtube.com/watch?v=WgrBrPW_Zn4))

The Heartbleed bug manipulates the secret keys that the browser and computer use to encrypt the names and passwords of the users, along with other sensitive content. In vulnerable versions of OpenSSL software, hackers can break in and steal data directly from the services and users. You can read more about it on the [Heartbleed website](http://heartbleed.com/). 

### Why Not Just Patch The System?

If you find holes or vulnerabilities in your system, why not just fix them up and continue with business-as-usual? 

First, taking a user database offline creates downtime for a business. This can result in frustrated users who enjoy and rely on your service. Down the line, it can lead to a loss in revenue. 

Patching software is also risky. Particularly if you work with a lot of sensitive customer information, such as [financial transactions](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), making changes to a software library can break critical processes, leaving your users out to dry with payments incomplete and exposed. 

In some dire cases, such as a medical facility, it could truly be a matter of life and death if your system, full of patient data, shuts down (even temporarily). 

## A Better Solution: Secure Your User Database With Auth0 Identity Tools

Outsourcing your cybersecurity needs, particularly for a user database, can be an excellent solution. Only a few teams have the in-house capability to build and customize cutting-edge tools without support. Particularly if your company is constantly growing and changing as it should — you need to both brace your systems against attackers and make them flexible enough to allow you to scale. 

Auth0 has [several tools](https://auth0.com/why-auth0) to help you do this.

### Content-Aware MFA Technology

Amid the many features that Auth0 offers customers on its universal authentication and authorization platform, [multifactor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) helps ensure that only the right users gain access to your system. Even if a hacker obtains a user's login credentials, s/he still needs a second piece of information, such as the user's thumbprint or mobile device, to make it through. 

It's simple to add MFA to your app. For example, if you want to add the Google Authenticator, which provides a six to eight digit one-time password to users as an alternate token, you can turn this on by first visiting Auth0's [Multifactor Auth](https://manage.auth0.com/#/guardian) page from the dashboard. 

![Auth0 multifactor authentication feature](https://images.ctfassets.net/23aumh6u8s0i/2ZuIZT9aZzbLGoaygmQljD/5704c74279f0f95fb04e3ee6de2ec85a/auth0-multifactor-authentication)

If you want to use a different provider like Duo, just click on the link to switch. You can then select if you want your users to receive the password via a push notification or SMS. 

While MFA is proven to reduce breaches of user databases, few organizations have successfully integrated it. Why? Making the 2FA setup simple for customers is a challenge. Even advanced services like [PayPal](https://www.paypal.com/us/smarthelp/article/how-do-i-enable-2fa-(two-factor-authentication)-for-my-paypal-powered-by-braintree-user-faq3500) have made users opt-in through a lengthy process that entails their first logging into a control panel, navigating to their account, and then independently enabling 2FA with a QR code or another supported app.

Auth0 can help you figure out ways to integrate and communicate MFA capabilities for your users in a more seamless and self-aware way. Visit our [business blog](https://auth0.com/blog/business/) for further resources.

### Social Login Integrations

You can also build robust profiles of all of your users using Auth0's [social login functions](https://auth0.com/learn/social-login/). Social login allows users to register and access your app by connecting via a provider like Facebook.

Auth0 supports over 30 social providers, including Facebook, Twitter, Google, Yahoo, Windows Live, LinkedIn, GitHub, PayPal, Amazon, VKontakte, Yandex, Basecamp, Box, Salesforce, and more.

![Auth0 social login integrations](https://images.ctfassets.net/23aumh6u8s0i/3SndDrKq0SuzoeXOcEt6Bb/08882aef7d9d6b36f48aa6d516b5300f/auth0-social-login-integrations)

In addition, you can add any OAuth2 Authorization Server you need. To enable social login, just click Connections and then Social in the Auth0’s Management Dashboard, then flip on the switch of the social network provider you'd like in the app(s) of your choice.

The advantages of social login are numerous. A few are:

* You know your users are verified since the social provider is already responsible for verifying the user’s email. 
* If you want to double check an individual, you can immediately access information such as their interests, location, connections, and more to make sure the account is real. 
* This data can also go a long way towards underpinning new marketing and product tactics.

You can take this a step further and build even richer customer profiles by integrating with a provider like [Clearbit](https://blog.clearbit.com/avoid-tedious-signup-forms-with-auth0-and-clearbit/). Clearbit sharpens customer intelligence, allowing teams access to valuable public information that can help them outperform.

## Why Auth0?

Outsourcing your user database needs allows you to turn over these critical tasks to experts, who are up-to-date on the latest trends and are keeping pace with evolving threats. An identity services provider like Auth0 doesn't have to balance these tasks with regular maintenance projects like most IT teams do. 

<include src="TweetQuote" quoteText="Outsourcing your user database needs allows you to turn over these critical tasks to experts, who are up-to-date on the latest trends and are keeping pace with evolving threats."/>

Auth0's user database tools support all major industry standards such as SAML, OpenID Connect, JSON Web Token, OAuth 2.0, OAuth 1.0a, WS­-Federation and OpenID, preventing vendor lock-in.

If you're looking for a quick solution to help you come into [GDPR](https://auth0.com/gdpr) compliance — as part of a larger customer identity and access management (CIAM) platform — MFA and Social Login will support your getting there in an efficient manner.

If you are just starting out or [modernizing](https://auth0.com/app-modernization) legacy apps from years of prior use, integrating tools to protect user identities from the outset will build a solid foundation for your products for years to come.


Use Auth0 Tools To Securely Manage Your User Database

Information and tools to help you mitigate risk against cyber attacks and data breaches. Learn more about Malware Infiltration, Phishing, USB Traps, and Mobile Attacks.



In 2017, nearly [_179 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. It's clear that cyber criminals are growing more creative with how they gain access to networks and valuable data.

Many of today’s most common cyberattacks have been socially engineered to rely on human error. Even your best employees can become your greatest weakness if they open a suspicious email, click on a malicious link, or pick up and use an anonymous USB device.

There are ways to protect your organization against sensitive data breaches. Here are four of the most common cyberattack examples and the ways you can avoid them.

## **1. Malware Infiltration**

**What makes you vulnerable: outdated software and lack of backup protocols**

Malware is a term that encompasses many different types of malicious software, including ransomware and spyware. Each type of malware can wreak havoc once it gains access to a system.

WannaCry, for example, a form of ransomware, recently [took advantage of a weak spot in Microsoft’s operating system](https://www.symantec.com/security-center/writeup/2017-051310-3522-99). Banks, health care providers, manufacturers, and other businesses across the globe reported WannaCry's encryption.

![WannaCry encryption](https://images.ctfassets.net/23aumh6u8s0i/1vTw3WKZIs3Fs1RZGhNNeI/18d3869c4068bf29ce62e9ce8eb6e9db/WannaCry-encryption)
  
[[Source](https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/)]

In order to regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [_bitcoin_](https://bitcoin.org/en/). [_Sixteen National Health Service’s offices_](https://developers.redhat.com/blog/2017/05/19/wannacry-ransomware-who-it-affected-and-why-it-matters/) and over 200,000 PCs worldwide reported this.

_Solution: Regularly updating your systems will go a long way toward removing dangerous holes. It's a simple fix that many teams, including [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/), have neglected._

_If you want added security, consider [moving to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/). Not only will this allow your enterprise more flexibility to scale, but you can also delegate specialized security tasks like IAM and encryption to expert providers._

## **2. Phishing **

**What makes you vulnerable: lack of education and attention to detail in suspicious e-mails**

In 2016, [91% of cyberattacks](https://phishme.com/2016-enterprise-phishing-susceptibility-report/) were the result of a spear-phishing email. Phishing e-mails steal data either by tricking recipients into giving it to the cyber criminals or by getting users to download a file that installs spyware—software designed to steal information directly from a user’s device.

Children’s Mercy Hospital [_recently reported a breach_](https://healthitsecurity.com/news/childrens-mercy-hospital-phishing-attack-impacts-phi-of-60k) that exposed the health care information of at least 60,000 people. E-mails tricked users into disclosing their work e-mail credentials, which led to the exposure of patient health data when the hackers gained access to the inboxes of the targeted hospital workers. Children’s Mercy [_is now being sued_](https://www.hipaajournal.com/childrens-mercy-hospital-sued-for-63000-record-data-breach/) for this major breach.

Here’s an example of an imitation Dropbox e-mail asking for confirmation of a user’s e-mail:

![Imitation Dropbox email phishing scam asking for confirmation of a user’s e-mail](https://images.ctfassets.net/23aumh6u8s0i/7jVF95LDb067AOrODuA8SI/2fb640b69a3567e208636c1abad55fc1/dropbox-email-asking-confirmation-of-user-email)

[_Source_](https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250)

When users click the “Verify your email” link, spyware software is automatically downloaded onto the users' computers.

_Solution: As these e-mails start to look more realistic, it’s important to educate employees on how to spot a questionable e-mail chain._

_Creative training programs include the following:_

- _Digital Defense's [SecurED training program](https://www.digitaldefense.com/professional-services/secured-training/) that works with award-winning Hollywood comedy writers_
- _Terranova's [customizable newsletters](https://terranovacorporation.com/solution/communication-material/)_
- _Inspired eLearning's [Security Awareness for the C-Suite](https://inspiredelearning.com/security-awareness/awareness-c-suite/)_
- _Wombat Security's [everyday tips](https://www.wombatsecurity.com/security-education/free-security-awareness-resources)_

_[See here for a larger list.](https://www.csoonline.com/article/3225471/security/please-dont-send-me-to-cybersecurity-training.html)_

## **3. USB Traps**

**What makes you vulnerable: lack of education and policy on outside device use **

Hackers who want a direct route to company data often use a hardware device, such as a USB drive. A [_recent Google study_](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/45597.pdf) revealed that at least 45% of people who find a USB drive will plug it into their computers. Planted USB drives may contain malware or a link that requests information, similar to a phishing e-mail.

The worst-case scenario is a drive that contains a HID spoof. This is where the USB drive tricks the computer into believing the drive is actually a keyboard and then issues a set of keystrokes that forces the computer to dump data back to the hacker. It can also allow them access to whatever network the computer is connected to.

![HID spoof process](https://images.ctfassets.net/23aumh6u8s0i/6tgD3dKhZRBiDXExHQw0H3/b36a8b23e6518b6d0c93f44e0e0f69f3/hid-spoof-process)

_Solution: Outlawing anonymous, external drives on company devices will send a clear message to your organization. Whether a drive was planted or simply purchased from an illegitimate source, removing the temptation to plug something in without properly vetting is a low-hanging fruit that can have enormous power to secure your team and your end users._

## **4. Mobile Attacks**

**What makes you vulnerable: employees accessing company data and networks via cell phones**

Hackers are well aware of the explosion of smartphone and tablet use and have created attacks specifically designed for mobile software. [_The Pegasus attack_](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message.

<p style="text-align: center;">
  <img style="width: 300px;" src="https://images.ctfassets.net/23aumh6u8s0i/1ii40f6m9VQ1rBmWpgY1pF/de53a4b3444b16e607d52ee34bb9933e/pegasus-mobile-attack-on-ios" alt="Example of Pegasus attack on Apple iOS mobile software."/>
</p>

[_Source_](https://www.hax4us.com/2017/03/hindi-english-smishing-brother-of.html)

Phishing text messages are composed to look legitimate, just as phishing e-mails are. With Pegasus, clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. The software also copied all of their calendar, contact, and e-mail data.

Pegasus was an especially frightening cyberattack because it took advantage of [_“zero day” vulnerabilities_](https://www.huffingtonpost.co.uk/entry/what-is-the-pegasus-iphone-spyware-and-why-was-it-so-dangerous_uk_57c0043fe4b0ba22a4d3f930?guccounter=1), meaning there wasn’t any prior knowledge of the vulnerabilities in Apple’s iOS until Pegasus struck. Once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

_Solution: If a mobile phone or tablet has been breached, you need a Plan B. Make sure employees quickly change their passwords by using a professional password manager, such as [LastPass](https://www.lastpass.com/) or [Valt](https://valt.io/). Many employees secure critical information with easy-to-guess iterations of a single password. Encouraging length and complexity in all passwords going forward will make it difficult for hackers to access multiple areas at once._

## Additional Security for All Systems at the Login Stage

Good password policy and sound employee education are key; however, taking the next step with [secure login procedures](https://auth0.com/b2c-customer-identity-management) will add a new dimension of safety to your system. Specialized identity solutions providers can offer support with [multifactor authentication](https://auth0.com/docs/multifactor-authentication).

Tracking your users from the start will help eliminate fraud at its origin, helping provide a secure foundation to allow your team to scale.

<include src="asides/AboutAuth0" />


Four Cybersecurity Attacks Your Employees Need to Know

Airline industry cybersecurity - map your customer journey, incorporate passwordless registration, and profile enrichment to create a more enjoyable and secure UX.



Digital transformation starts with the customer. Understanding the full scope of a customer's journey and the numerous points at which s/he interacts with your company's products and services will serve as a guide when modernizing operations. This is especially important for airlines. While many might think that the flight is the only important part of the customer journey in air travel, critical communications take place starting from the customer's initial decision to buy tickets and book a flight through post-flight feedback and promotions.

![Customer flow and journey map in air travel experiences](https://images.ctfassets.net/23aumh6u8s0i/1e3QvqlOXJrYn7vvc7xiS2/0a5f087a19ce3842a8baf14ddc2f19c1/customer-communication-flow-for-air-travel)

While many airlines will have similar maps for their customers, you can tailor this to your specific brand using resources from companies like [ProsperWorks](https://www.prosperworks.com/blog/the-importance-of-customer-journey-mapping) and [Appcues](https://www.appcues.com/blog/user-journey-map) that delve into user personas and more advanced tools for approaching your research. However you go about visualizing the path your customer(s) take with your company, this exercise will help you notice the best places to make digital improvements.

## Enhance The Customer Journey: Key Tools In A Successful Digital Transformation

Once you've mapped out your customer journey, including details like booking processes and post-flight surveys that might be unique to your organization, it's time to hone in on key pain points. The customer's initial login experience and profile creation are areas that touch on and can help solve several issues at once.

### Passwordless Registration

Modernizing the first major point at which a customer or potential customer engages with your company online ensures a top-notch experience and sets the stage for enhanced security in the future. With [Auth0 Passwordless](https://auth0.com/passwordless), on the front end, you can offer one time codes or “magic links” delivered via SMS or e-mail.

![Slack, Medium, and Google login screens](https://images.ctfassets.net/23aumh6u8s0i/1dta6aEEQtIDZsZM95GKB5/341d5a8a1c593af4c61cec4b2f703a24/pwdless)

<include src="TweetQuote" quoteText="Modernize the first major point at which a customer engages with your company online: account registration."/>

([Source](https://auth0.com/blog/auth0-passwordless-email-authentication-and-sms-login-without-passwords/))

Instead of prompting customers to re-enter a password every single time, passwordless login can ease any frustration and mitigates risk of churn early on when you need to delight your users the most.

On the back-end, your team can combine passwordless login with additional security features like [anomaly detection](https://auth0.com/docs/anomaly-detection), suspicious logins, and centralized session revocation to build out a robust authentication system that double-checks each user truly is who they say they are.

For example, Auth0 partners with ThisData to [add specific alerts](https://thisdata.com/blog/how-to-add-suspicious-login-alerts-to-auth0/) regarding suspicious logins. After creating a ThisData account in the Auth0 dashboard, just add the Login Anomaly Detection Rule in the Access Control section.

![Adding a Login Anomaly Detection Rule in the Auth0 Access Control section](https://images.ctfassets.net/23aumh6u8s0i/6Xctx1Te0DCJX2HGkLDr0w/469da26559db8ea7e20e57515255fba8/create_rule)

([Source](https://thisdata.com/blog/how-to-add-suspicious-login-alerts-to-auth0/))

Auth0 [Rules](https://auth0.com/docs/rules/current) extend security features so that you can build and customize a solution on the back-end that supports all of your customers as they browse travel deals, flight times, select an itinerary, pay, check-in, and more. Not only will customers have an easier time exploring — you can ensure them that your app is a safe environment in which to share their personal information.

<include src="TweetQuote" quoteText="Auth0 Rules extend security features so that you can build and customize a solution on the back-end that supports all transactions with your customers. "/>

### Profile Enrichment

To better understand your customers and deliver more customized offerings throughout their journey, it's important to acquire all of the publicly available information you can to underpin your strategy. [Profile enrichment](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) is a tool that captures this data using third-party data APIs, such as [Clearbit](https://help.clearbit.com/hc/en-us/articles/115004646673-Enrichment-Overview). Again, working with Auth0 Rules, you can integrate this information into a 360-view of any of your customers:

![360-view of a customer's data using Clearbit](https://images.ctfassets.net/23aumh6u8s0i/4hegzXlz6MgwIeQK9Xqkhr/ec786f6ea738ee3be28a8626c6761056/clearbit-bi)

([Source](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/))

You can capture important points such as their location, employer, Facebook interests, and email address. Of course, given the strict rules about customer data in the wake of [GDPR](https://auth0.com/gdpr), it's important to communicate to your customers what data you've acquired, how, and why. Then, be sure you give them the option to edit or even opt out if they'd like. But it's also important that they understand how allowing you to view and work with this information can benefit them. For example, you can send them special deals in their geographic area or even tailor in-flight menu options that support a healthier lifestyle (if this is a clear interest of theirs).

Profile enrichment is a powerful feature that gives a team a more comprehensive understanding of its travelers and unveils myriad ways to support them along their path.

## Staying Secure in the Airline Industry

We mentioned this earlier and will say it again: in a challenging environment, airlines need all the support they can get in terms of security. The three resources above — a customer journey map, passwordless login, and profile enrichment — will help your company comply with laws like GDPR and help you build customer trust and loyalty down the line.

While physical security has been beefed up worldwide from more cameras, TSA guards, agents, guidelines, and rules, and even canines, it's cybersecurity that deserves equal if not more attention. Making sure you really know who is traveling on your aircraft — when, from where, their travel history, payment methods, and even friends and relatives — is all valuable data that, when stored in a central location and in an accessible format, can keep your entire company and all of its stakeholders safe.


3 Tools For Digital Transformation in the Airline Industry

Insurers know that digital transformation is coming. To stand out from your peers, adopt identity and access management for a secure experience that customers can trust.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---


Insurers know that implementing digital changes have the potential to benefit them long term. A recent [McKinsey study](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/making-digital-strategy-a-reality-in-insurance) found that insurers that digitized their processes eliminated 30 to 50 percent of the human service costs. The top quartile of those surveyed achieved 2X the growth of their peers.

<include src="TweetQuote" quoteText="Insurers know that digital transformation is coming. To stand out from your peers, create a secure experience that customers enjoy and trust."/>

But specific obstacles in the industry have stalled progress. First, the majority of insurers don't have the in-house technical expertise and equipment to make sweeping changes without support. In addition, many are concerned, particularly in an era of [increased scrutiny around customer data](https://auth0.com/blog/cambridge-analytica-and-facebook/), that a system overhaul could threaten measures they've already taken to protect sensitive information.

Despite these real challenges, customers increasingly expect cutting-edge solutions. Other industries, like [healthcare](https://auth0.com/healthcare/) and [financial services](https://auth0.com/financial-services), are quickly incorporating digital methods, raising the bar for everyone. Eventually, insurers will be forced to change. Early adopters will gain an edge, and those who are slow to transform will lose.

While it's possible to begin a digital transformation in many ways — from creating a new claims platform to simply delivering online quotes — starting with an identity and access management (IAM) strategy is a clear, easy-to-implement step that allows managers to attack several core functions at once.

## Legacy Systems in a Changing Environment

In industries such as [retail](https://auth0.com/retail), many teams are able to rely on consumer data pulled from public sources like [social media profiles](https://auth0.com/learn/social-login/) to underpin their strategies. This might include compiling current and potential customer interests, events they've attended, and pages they've liked. In insurance, it's more complicated. Agents work with higher-touch information sets, like health records and credit scores.

![Legacy, old insurance systems example](https://images.ctfassets.net/23aumh6u8s0i/1T3qVEXkTfn8vpmFRHZyqX/35117cf6090d3668e1aacab3d062734a/legacy-systems-struggle-to-keep-up-with-digital-transformation)

[Source: Electronic Medical Records & Electronic Health Records Software](http://www.emr-ehrs.com/mental-health-electronic-health-records.php)

This data is the foundation for building customer risk profiles, determining premiums, and completing claims. Most teams have developed processes over decades that continue to work well. Although a lot of this data exists on legacy insurance softwares and systems and may not be intuitive for new hires to find and work with, more-seasoned agents understand the process and don't feel an urgent need to change.

With such fixed methods, it can be challenging to know why and how to begin to make updates. Tweaking any aspect of an established insurance company's model, even something as simple as market research or reaching out to new prospects, could skew the whole.

Yet if teams don't start somewhere, they risk becoming irrelevant in markets that are quickly evolving. Home insurers, for example, are facing variables such as interconnected home security and heating systems, like the Google Nest; auto insurers are having to factor in autonomous vehicles and the changes that ride-sharing programs like Uber and Lyft bring; even health insurers are seeing stiff competition from newcomers, like Oscar, that have a strong focus on UX and more-affordable plans.

Just because many insurance teams have succeeded with business-as-usual for decades, it doesn't mean they don't need to revamp for the future.

## Organize Your Users for Greater Security and Efficiency

For insurance teams facing a daunting set of changes, developing a clear [identity and access management - IAM](https://auth0.com/app-modernization) modernization strategy of legacy softwares is a concrete first step. IAM is a simple, initial fix that can form the basis for more updates down the line. It is a single solution for organizing and tracking customers, employees, and even business partners who are working with critical data in your system.

IAM often begins with a portal that collects, organizes, and protects customer data at the login stage. This starts with a simple welcome screen on the front end:

![Customer acquisition starts with a secured, basic identity management](https://images.ctfassets.net/23aumh6u8s0i/6skPK5VXzplAOaOIG2mXAW/d4cc7731371771ffcd5576d3fcf99044/transforming-customer-acquisition-starts-with-a-basic-identity-management-strategy)

Behind this screen, the technology tracks customer logins and platform behavior and enriches their profiles with personal details and historical records. This can be information that the insurer manually uploads or automatically pulls from public sources. Some features also include additional options, such as [progressive profiling](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/), to help build customer data over time (e.g., location, age, and gender).

For administrators, certain features allow for a bird's-eye view of all users in a given system, noting growth in users over time, ratio of new to returning users, who is accessing what levels of information at any time– even what device(s) they're using:

![Customer data visualization in Auth0 reports allows for better reporting and analytics](https://images.ctfassets.net/23aumh6u8s0i/5iw0moRjxmuV8bvOeZ9t16/e39d7192b9ca429b294a43df722dd491/organizing-customer-data-in-a-single-location-allows-for-better-reporting-and-analytics)

Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights on customer histories and current behavior. This approach will make your company more efficient at building risk profiles, communicating with customers in a more personalized way (particularly if and when they are in distress and need to make a claim), and understanding your target audience at a granular level.

<include src="TweetQuote" quoteText="Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights."/>

## Outsourcing IAM to the Experts

While you can try to update your IAM system on your own, most insurers don't have the in-house capacity to do so — at least not at the level needed to meet future needs. This would require building a portal that is a one-stop solution for all users — yet is still flexible enough evolve alongside your business. The advantage of outsourcing IAM is having a dedicated team of experts whose entire job, 24/7, is to build and deliver these solutions — as opposed to adding it to a pile of tasks your IT team is currently balancing.

A provider like Auth0 makes sure all of its [features adhere to the highest industry standards](https://auth0.com/security), including LDAP, SAML, OAuth, OpenID, OpenID Connect, and JSON Web Tokens (JWTs). In addition, it is GDPR, EU-US Privacy Shield, and HIPAA compliant.

![Auth0 compliance and certifications](https://images.ctfassets.net/23aumh6u8s0i/35nsnoblygw4XlOUwuocQ6/c02f2b95ba00c2410da392fe049e68c4/auth0-adheres-to-the-highest-industry-standards)

[Source](https://auth0.com/security">Auth0 Security)

This eliminates the need for your team to do additional research to ensure any changes are up to code in your geographic area or industry.

Top-notch identity and access management providers like Auth0 will offer even more tools, like 2FA options, to help ease the customer experience. These features can provide a clear measure of safety that customers will immediately appreciate. Each step along the way allows your team to move further away from lagging competitors by gaining user trust, invigorating your brand, and creating more-efficient internal processes.

## Be an Early Adopter

If you're an insurer, now is the time to make bold changes to your current strategy. The early digital adopters in the industry will gain sharper insights and win and retain more customers.

No teams will be able to hide from change. With new products constantly coming to market, the industries in which insurance teams operate are themselves being revolutionized. Taking the first step to develop and implement a tight IAM system will open the door for full digital change.

<include src="asides/AboutAuth0" />


How the Right IAM Tools Will Help Insurance Teams Make the Shift to Digital

Tips for a secure and organized data migration process. 1. Workflow and project management tools 2. User identity and access management 3. Clear customer communication



Data is the foundation of a company's success. It provides the basis for customer insights, corporate strategy, and operational efficiency. As more companies embark on [digital transformation](https://auth0.com/app-modernization), migrating this critical information — particularly sensitive customer data — to a new platform(s) can be a burden. Moving data can unearth inaccuracies, unknowns, and/or duplicate entries, making it insufficient to use and requiring significant changes. 

The tips below will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users.

<include src="TweetQuote" quoteText="Data is the foundation of a company's success. This post will help ensure that the movement of your most sensitive information is secure, organized, and accessible to your users!"/>

---

## Issues That Can Arise with Data Migration
Before we dig into strategies for success, it's important to understand the issues that can arise in data migration. The process can be thorny for several reasons.

### Lack of Consideration for the Process
Teams are generally focused on selecting and configuring their new system. Testing potential tools and comparing the models are generally more exciting and inspiring than the mechanics of lifting data out of the legacy package. If data is uploaded in its current state, any errors or irrelevant aspects could become amplified and increase the information's exposure to risk. Because of this, it's important to be sure your team is on the same page about the nuances of the process and has a specific roadmap marked with individual roles and responsibilities.

### Improperly Tracking Users
It's critical to manage user identities and monitor for suspicious activity when you're migrating sensitive information. Companies that rely on consumer data, in particular, must validate all entries against new regulations — [GDPR](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance/protect-user-data), for example, along with more specialized industry standards such as Sarbanes-Oxley (SOX) for financial institutions and the Health Insurance Portability and Accountability Act (HIPAA) for many healthcare providers.

### Poor Communication of Updates
Making sure your end users understand how you are securing their data after you've updated your apps is important for maintaining their trust. If you can't articulate what you are doing with their information, it's unlikely they will stick around. Documenting your work and developing a clear communication strategy are essential to making sure your data migration supports your company's overall goals for growth.

To address these potential issues, the following strategies focus on workflow, user access, and communications.

<include src="ebook-ads/UserMigrationYourWay" />

## 1. Organize Your Workflow and Project Management
To clearly understand and outline the steps required for a successful data migration, take time to consider the following:

- What will cause the least disruption to the daily operations of your system? That is, when are the best times to work on and/or migrate data sets of highest sensitivity or usage?
- What aspects of your strategy can you tag to teammates in-house, and where might you need to bring in outside expertise?
- How will you document your process, ensuring that all information is accounted for?
- Will you enrich your files after they have been moved with further information (e.g., customer names and/or account numbers)?

While this list is not exhaustive and each strategy will be unique, depending on an organization's current systems and future goals, it should aid in understanding the depth of thought required for an efficient data migration.

It can be helpful to use a workflow tool to organize your team and define your process. [Airtable](https://airtable.com/product) has a proven track record for improving internal organization. When mapping out your data migration strategy, Airtable can help define your project scope, set deadlines, and assign individual responsibilities.

For any task that you're organizing, Airtable will help prioritize tasks and ensure that you adhere to your overall goals:

![Airtable](https://images.ctfassets.net/23aumh6u8s0i/38brOxQrTQvBu8Pa8BBQ17/df355af7ec95291c2abff6758ccb9694/1-airtable)

> [Source.](https://airtable.com/product)

Within the grid view, you can check to see which tasks have been completed and quickly note whom to reach out to in case of a question or concern. Airtable also has a [calendar view](https://airtable.com/product) to better visualize the timeline of your data migration, which can quickly become lengthy and arduous without clear monitoring. Both views can help break down the potentially opaque data migration process into a concrete series of steps.

Additional tools to consider for managing the task of data migration include:

- [Asana](https://asana.com/guide/examples/company/project-management): Highly customizable, popular tool for engineering teams
- [Trello](https://trello.com/): Visual workflow; bulletin-board format
- [Jira](https://www.atlassian.com/software/jira): Supports distributed collaboration

Taking time to think through your steps at a granular level and selecting a tool that will hold your team accountable will help you succeed.

## 2. Clearly Track Who Accesses Customer Data
Understanding who is accessing and updating portions of sensitive customer data at any given time during the data migration process is critical to maintaining integrity. In today's environment of [increasing industry regulations](https://auth0.com/gdpr) around consumer data, this core function must be up-to-date and as tight as possible. 

Because of the complexity and urgency of this task, many teams choose to outsource their [identity management](https://auth0.com/app-modernization) when migrating data, particularly as part of a larger [digital transformation](https://auth0.com/learn/identity-management-drives-digital-transformation/).

[Auth0's user management dashboard](https://auth0.com/b2e-identity-management-for-employees) allows a systems administrator to authorize new users, track their behaviors, and evaluate their performance according to the company's policies.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/5IwuLEHPTS1w1q7UhTcUPk/277cb0224267a945a4265e0984263142/2-auth0-manage)

> [Source.](https://auth0.com/learn/cloud-identity-access-management/)

In the Auth0 dashboard, an administrator will have a clear view of users at any point. In addition, Auth0's identity platform offers enhanced options like multi-factor authentication, anomaly detection, and advanced logging. For example, if the administrator notices a certain user has a series of failed login attempts, they can [block access](https://auth0.com/docs/anomaly-detection) to investigate further. 

From a user perspective, this function is an invisible and painless part of their workflow. 

## 3. Explain Your Data Policy Changes
If you can clearly communicate your data migration and updated data usage policies to your users, you will gain their trust — and an edge over your competitors. At the moment, very few company blogs or statements spell out the details of data usage in a digestible format — as we've recently seen with Facebook's [confusing policies](https://www.wired.com/story/mark-zuckerberg-congress-day-one/). 

You have an enormous opportunity to distinguish yourself in the field if you can fill this information gap. A major data migration is a perfect opportunity for you to document previous work and latest updates. Making this information immediately visible, user-friendly, and clearly accessible is key:

![Facebook](https://images.ctfassets.net/23aumh6u8s0i/7mn6vdZtybE6e5Rlg1dSNa/10c9a53747ac05ec8598251b03153990/3-zuck)

> [Source.](https://www.recode.net/2018/3/28/17171496/facebook-settings-redesign-cambridge-analytica)

While hopefully your team will not be recovering from a data leak like [Facebook's](https://auth0.com/blog/cambridge-analytica-and-facebook/), the tech titan provides an excellent example of how to communicate a change in policy to users. Three key points to include when explaining your updates are:

1. Place a brief summary of the information on the front of the app where users will see it immediately without any digging.
2. Include a clear CTA or way in which users can click to read further details.
3. Make sure any actions your user must take to delete or update their data settings are very simple.

You must make your user feel as though they are well supported and in full control. Both sets of information — your summary and fine print — should feel friendly and encouraging. Employ your best writers and incorporate welcoming images or a set of bullet points to truly put your best foot forward.

## Don't Be Afraid to Change
[90%](https://auth0.com/learn/how-auth0-uses-identity-industry-standards/) of businesses today state that legacy software systems are keeping them from achieving their goals. Despite increasingly strict regulations, you should not be afraid to scale and innovate. Just be sure you take the process of data migration seriously as you search for your new platform. Make sure the right people access the correct pieces of data at the proper times during the migration and then seize the opportunity to demonstrate how bulletproof your new strategy is with excellent customer communications.

<include src="TweetQuote" quoteText="90% of businesses state that legacy software are keeping them from achieving their goals. Scale and innovate while paying attention to data migration to succeed!"/>


Three Strategies to Streamline Your Data Migration Process

Learn about 3 tools to make the GDPR compliance process as efficient as possible.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR has arrived. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

The deadline to comply with GDPR has passed (5/25/18). As most know, if your business is audited and found to be irresponsible with its customer data, according to [GDPR regulations](https://www.gdpreu.org/compliance/fines-and-penalties/), fines are up to €20 million, or four percent of worldwide annual revenue. Moreover, GDPR does not just apply to EU companies; it extends to all those that process the data of EU residents.

The regulation is no joke. Activist groups, already outraged by how many companies have misused personal information, have [called out giants like Facebook and Google](https://www.cnet.com/news/gdpr-google-and-facebook-face-up-to-9-3-billion-in-fines-on-first-day-of-new-privacy-law/) for not creating tight enough protocol. If these titans, with cutting-edge resources at their fingertips, are struggling to adhere to the new law, how can small and medium-sized teams make sure their operations are efficient, secure, and worthy of their customers? 

Amid a variety of strategies to bring your company into compliance, specific tools can make this process less arduous and complicated by targeting several pain points at once. 

## Start With a Checklist

Before diving into tools to help you comply with specific parts of GDPR, it's important to keep the overall picture in mind.  
A team from Belgium created a handy [checklist](https://gdprchecklist.io/) that you can use as a guide throughout the process. It covers outlining the type of data your company holds, where, and why; the creation of a clear accountability and management policy for it, including your contracts with sub-processors; making the data clearly accessible to customers; new consent guidelines; and understanding what to do in special cases with high-risk data. 

For example, a breakdown of the level of detail that the checklist goes into to make sure you account for each important part of the regulation is below in its first section, “Your Data.”

![Your Data](https://images.ctfassets.net/23aumh6u8s0i/4cy7PCaaHybQN3fDwhredV/a9a14208bb378a8ff6d2b88d2facd5d1/gdpr-yourdata)

The list is interactive, so you can check off each task once it's completed in the circle on the left. If you're looking for more information on a particular bullet, you can use the drop down arrows for a longer description and links to further resources.

## 1. Improve Your Data Collection with Social Login

[Social login](https://auth0.com/learn/social-login/) is a single sign-on for end users that relies on existing information from a social network provider like Facebook, Google, or LinkedIn. This not only makes the registration process smoother for the customer, reducing onboarding friction and keeping them coming back over time, but also adds an additional layer of security to the information they provide. 

A customer will see this screen when they log in to your app:

![Social login with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3I1mh7IrVMQlLTdjqD0sc9/260b1c263f685e4d684ab1e0d99791dc/what-is-social-login)

Whichever social provider you've selected for the app will appear as an option for the customer up top, often along with the chance to choose email sign-in.

On the back end with [Auth0's social login feature](https://auth0.com/learn/social-login/), your team is able to choose from over thirty providers.

![Auth0 social login](https://images.ctfassets.net/23aumh6u8s0i/UCeigts6u0MM59HIJNcO2/e450315b596ef072144c4ec19e1c03fe/auth0-social)

If you're an e-commerce site, you might offer the chance to sign in with payment apps like PayPal, while a career platform might select LinkedIn. In each case, your team has the opportunity to view the public information that your customers have already shared on these apps. Since, in most instances, these apps have authenticated their users, incorporating social login into your operations helps ensure that the information you're pulling is authentic and up-to-date. 

Social login keeps your customer data organized in a single location from the start. This is key to all other facets of aligning with GDPR regulation. Being able to quickly recall and make changes to this data will set you up for success going forward.

## 2. Manage Your Users With Auth0's User Dashboard

[Auth0's user dashboard](https://auth0.com/gdpr) is a centralized view that clarifies in real-time who is accessing your customers' information, how, from where, and using what device.

![Auth0 user dashboard](https://images.ctfassets.net/23aumh6u8s0i/6Lne57D8kZ3KFBrPQ4TKNm/f5ca63090985effaaee7c75ca0912bdc/auth0-users)

Administrators can rapidly scroll through current users for context (name, picture, and outside affiliation if they are a consultant or third party). 

Clicking on a particular user will enlarge their profile to provide an even richer view of details, including: their contact information; which sites they are working on; which devices they are using to do so; and a history of all prior activity in your system.

![Auth0 user info](https://images.ctfassets.net/23aumh6u8s0i/7298YiBzOtDvD9QFBA2iOH/8bfbfd2ba3a105676a479281e28f2084/auth0-user)

From here, it's simple to block anyone that is suspicious or not acting appropriately. It's difficult to understand how important this tool can be if you are assessed for GDPR compliance. It gives you a comprehensive understanding and clearly documented approach to track and control anyone touching the data of your end users. The user dashboard is more advanced than the manual methods that many teams are currently using to track this, such as adding information to spreadsheets.

The dashboard can help a team understand trends, set clear policies for its users, quickly communicate its process to customers, and facilitate customers that wish to access, modify, move, or delete their data.

## 3. Manage Your Workflow With Airtable

To organize your team, it could be useful to move your GDPR checklist into a workflow tool like [Airtable](https://airtable.com/) to track who will complete each task, by when, and note additional important details. 

For any major project like this, you can assign portions to individual teammates, set due dates, and customize it with notes.

![Airtable](https://images.ctfassets.net/23aumh6u8s0i/5Fj4MbjwUEtUC8lVe81EAD/d167dab8d74fb4e45ac99984b0f191b6/pm)
_([Source](https://guide.airtable.com/project-management/))_

Airtable is far more than a black-and-white spreadsheet; it allows people who are more visual to upload photos for a multi-dimensional view. For example, if administrators are working through particular use cases, they can add screenshots to better explain processes or highlight any issues as they arise. 

The comprehensive abilities of Airtable allow for a clarity and depth of understanding of the nuances of complex projects like an operations overhaul or revamping IT policies to align with GDPR. Having everything specifically documented in this tool can allow you to quickly pull and analyze information in preparation for an audit.   

Other workflow tools that could help include [Asana](https://asana.com/guide/examples/project-management/project-management) (particularly helpful if a great calendar view is needed) and [Trello](https://trello.com/) (better for hitting the major points if your team is expert and well versed in GDPR details).

## It's Not Too Late to Comply!

Despite being past the deadline, your team still has time and tools at your fingertips to quickly get up to speed. Taking advantage of the tools above will make the transformation more efficient, transparent, and potentially even enjoyable as you uncover ways to better support your customers (e.g., creating a smoother onboarding experience) in addition to providing exceptional security.




Your Quick GDPR Compliance Checklist

Unlock more value with Social Login, Progressive Profiling, and Profile Enrichment with Auth0.



Strong customer intelligence systems have been [proven](https://www.metrilo.com/blog/why-is-customer-intelligence-important-growing-ecommerce?ref=9d75) to drive growth. Collecting valuable data about your users' app behavior, including their login time(s) and duration(s), purchase histories, locations, and personal information, such as gender and interests, will go a long way toward crafting highly targeted marketing strategies and relevant product updates.

But what is the most efficient way to go about doing this? How do you collect this information without bothering your users? More importantly, given all of the pushback against Facebook and Cambridge Analytica's [collection of user data](https://auth0.com/blog/cambridge-analytica-and-facebook/), how do you assure your users that their information is safe and that you remain transparent about how you are capitalizing on it?

Outsourcing your customer intelligence can give you peace of mind, knowing that the process for amassing the data is well organized, efficient, and secure. Relying on a professional provider wholly focused on this task will also help you comply with rapidly approaching regulatory deadlines, like [GDPR](https://auth0.com/blog/get-ready-for-gdpr/) in Europe and a slew of [related laws](https://auth0.com/blog/gdpr-effect/) worldwide. If you're found to be out of compliance (i.e., your customer data is not secure), your business could face fines of up to €20 million or 4% of the global annual revenue (whichever is greater) — and this doesn't account for lasting damage to your brand and reputation.

Figuring out your system for customer intelligence will help you avoid potentially irreversible mistakes and underpin a strong foundation for growth.

## 1. Start with Social Login

[Social Login](https://auth0.com/learn/social-login/) is a feature that allows companies to have a comprehensive view of each of their customers and better understand their needs. By incorporating data from providers like LinkedIn, Amazon, Google, and many more, you can build a full image of these individuals as consumers — adding not only their names and photographs but also the specific brands they follow:

![Social login combines data about your user from multiple sources](https://images.ctfassets.net/23aumh6u8s0i/60MmcpnBYSRRfFKw3sO0MU/880a80f9bff7e4b12882c20673a54a49/social-login-incorperates-data-from-multiple-sources)

A manager like Auth0 supports 30+ social providers. Depending on your customer base and the type of information you're seeking, you might choose Facebook for personal data or PayPal for purchase history.

<include src="TweetQuote" quoteText="Auth0 supports 30+ social identity providers allowing you to access a comprehensive view of each of your customers and better understand their needs."/>

![Auth0 supports 30+ social identity providers](https://images.ctfassets.net/23aumh6u8s0i/15gOn35FNBq4hd4TgUFhsk/765b3a31cb1bb1894d3319fd8ab594c9/auth0-supports-over-30-social-identity-providers)

It's relatively simple to add a [Social Login feature](https://auth0.com/learn/social-login/) to your app. In Auth0’s Management Dashboard, click Connections and then Social. From there, just flip on the switch of the selected social network provider, and choose the applications you would like to use from this provider. Since each provider has already verified the users on their platform, this cuts down on the risk of letting in fake accounts.

Incorporating Social Login can be a simple fix that opens the door to numerous avenues for growth. For example, if you're creating [email campaigns](https://auth0.com/blog/5-killer-email-strategies-for-lifecycle-marketing/) to engage and upsell your current customers, it's critical that these be personal and not generic. Relying on subtle details that you've picked up on your customers via Social Login can make or break your ROI on such a campaign.

## 2. Incorporate Progressive Profiling to Collect Data Gradually

To reduce friction on your platform and avoid wasting users' time by having them fill out lengthy forms, [progressive profiling](https://auth0.com/blog/progressive-profiling/) is another tool for gradually building up a customer's profile each time they interact with your product. For example, you might begin with something as simple as requesting their first and last name, along with an email address:

<p style="text-align: center;">
  <img src="https://images.ctfassets.net/23aumh6u8s0i/24vgqp2L8eKEFwIjSazJ2s/9db1aa44455fda4f477db2d8d587b6aa/auth0-supports-progressive-profiling-to-build-up-user-data-over-time" alt="Auth0 supports progressive profiling to build-up user data over time" width="323"/>
</p>

From there, you might ask for additional details on the second or third login, such as:

* Address
* Birthday
* Phone number

All of these answers come together in a full view of each user:

![Auth0 user profiles have a data rich user experience](https://images.ctfassets.net/23aumh6u8s0i/4Q8gl93fS4HAr59B7hlVoT/38e5e4218bc1ddb6d57e765a8314ee93/auth0-user-profiles-have-a-data-rich-user-experience)

Rich user profiles can allow you to brainstorm appropriate product updates. For example, if a major subset of your users is located in a particular country, you might consider adding a language option to your app or website to smooth their experience.

User details can be as granular as the types of devices users are logging in with. You can harness this information to optimize the content you publish. If the majority of users are on mobile devices, you might consider full-screen advertising formats, such as Instagram, that can amplify your message and provide a more immersive brand experience.

If you are organized with your customer intelligence, opportunities to be creative with your user data are vast.

### 3. Add Profile Enrichment to Your CRM

To build an even more robust customer view, automatically grab publicly available information with a [profile enrichment](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) tool. Integrating third-party data APIs, such as [Clearbit](https://clearbit.com/) or FullContact, into your application will allow you to cast an even wider net for customer information.

The quickly growing CRM tool [ProsperWorks](https://www.prosperworks.com/), for example, works with the [FullContact Person API](https://www.fullcontact.com/developer/customers/prosperworks/) to allow users to add names, photos, and additional data from social profiles into sales contacts.

<p>
  <img src="https://images.ctfassets.net/23aumh6u8s0i/5IvzWDciRT2xHmmm1YeoL2/2e041b63a64178e9b8ed0deffc48d659/display-contact-details-next-to-messages-for-a-richer-understanding-of-your-users" alt="Display contact details next to messages for a richer understanding of your users" />
  <small>
    <a href="https://www.fullcontact.com/developer/customers/prosperworks/">[Source]</a>
  </small>
</p>

When an email exchange appears with an external contact, that contact's personal details are displayed next to the message, allowing a sales representative to have a richer understanding during an exchange and brainstorm ways to connect on a more meaningful level. Deeper engagement between sales and prospects or converted customers will only support acquisition and retention down the line.

At the end of the day, a CRM tool helps you manage data quickly and effectively — but you can utilize it for far more than the sales function. Adding a customer intelligence feature on top of an existing CRM will expand your knowledge base and help you gain more value from what you had considered a single-function piece of software.

Your ability to cross-check each of your customers with profile enrichment will cut down on fake or unwanted accounts. Each time you expand your understanding of your users with a new data capture, you can weed out profiles that return errors or anomalies — or investigate them further.

<include src="TweetQuote" quoteText="Auth0 can give you #CustomerIntelligence and allow you to innovate like never before. Closely observing user behavior can bring to light new ideas for your business."/>

## Innovate with Customer Intelligence

Enhanced customer intelligence systems can help your company innovate in myriad ways. Closely observing user behavior can bring to light new ideas for your business. The online dating app [Bumble](https://bumble.com/), for example, recently picked up on the trend that many of its users were also searching for new jobs and friends and exchanging money with subscriptions on other apps. This allowed Bumble to roll out a new line of services:

<p>
  <img src="https://images.ctfassets.net/23aumh6u8s0i/5p18jiIuKSSXSCG68SkNuN/f4a426ea2aae9716fd684b3c74cca594/bumble-releases-new-products-based-on-user-trends" alt="Bumble releases new products based on user trends" />
  <small>
    <a href="https://bumble.com/">[Source]</a>
  </small>
</p>

Deliberate, professional, and tight customer intelligence can allow you to develop entirely new revenue streams. While you can try to do this in-house, many find that it is an excellent capability to turn over to an external provider that spends 24/7 staying on the cutting edge of their specific software, making sure it is as efficient and safe as it can be for customers and end users.


3 Tools to Improve Your Customer Intelligence

View, understand, prioritize, and act on the alerts your team receives.



2018 will inevitably bring more and more sophisticated cyber attacks. As with all industries, the technology used continues to push the boundaries of what we previously thought was possible.

It continues to be critical that your company takes every precaution to protect itself. Knowing your users and managing their behaviors in your network are just some of the strategies you should employ in this increasingly complex landscape.

But if you, like many of your peer companies, have an IT team that is overwhelmed by alerts and competing demands, where do you begin?

The four tools below help you cut through the noise, quickly figure out where to focus your energy, and actively respond to suspicious behavior.

<include src="TweetQuote" quoteText="Four tools to help you cut through the noise, quickly figure out where to focus your energy, and actively respond to suspicious behavior."/>

---

## What Is Threat Intelligence?
The definition of threat intelligence continues to evolve as new threats emerge and multiply. In essence, threat intelligence seeks to recognize and understand the advanced tactics of cybercriminals and the particular ways in which they threaten data and networks.

Threat intelligence can be broken down further into [five data types](https://www.alienvault.com/blogs/security-essentials/threat-intelligence-definitions):

- **Internal**: Based on your team's own assets
- **Network**: Focused on your organization’s boundary
- **Edge**: Observes how Internet hosts are behaving at the edge of the network
- **Open-source**: Public blogs, Twitter and news feeds, and other chat channels
- **Closed-source**: Underground websites and information channels

The detailed nature of these definitions highlights the complex and evolving nature of the threat intelligence space. Best practices have evolved as in-house IT specialists work hard to keep up, but software tools also play a big part in helping organizations stay on the cutting edge. While threats have become more advanced, so have the defensive technologies that can help small- and medium-sized teams fight back.

## 1. Threat Prioritization: FireEye
[FireEye](https://www.fireeye.com/) offers specific expertise in network boundaries — the delineation between the side of the network that a company privately owns and the public side that a provider often manages.

The core of FireEye's resources is its [Threat Analytics Platform](https://www.fireeye.com/products/threat-analytics-platform.html) (TAP), which helps security teams prioritize among the multitude of alerts that arise. FireEye's platform allows IT administrators to quickly contextualize an alert and take action. TAP logs event data from a range of sources, such as security, database, network, and endpoint devices, and ranks them based on risk.

![FireEye Threat Analytics Platform](https://images.ctfassets.net/23aumh6u8s0i/5EVt5CQ7Ezpa5No1IULAq7/995768ca739b8fa0ba01d36df5f80938/1-fireeye)

> [Source.](https://www.fireeye.com/products/threat-analytics-platform.html#dismiss-lightbox)

Alerts pass through FireEye's intelligence, including several rules that generate alerts. These are based on distinguishers (the type of action taking place) and frequency. If an action occurs repeatedly within a specific time frame, the combination of type and frequency will generate an alert.

FireEye also offers [iSIGHT Intelligence Subscriptions](https://www.fireeye.com/products/isight-cyber-threat-intelligence-subscriptions.html) and even an [on-site intelligence analyst](https://www.fireeye.com/content/dam/fireeye-www/products/pdfs/pf/intel/ds-forward-deployment-analyst.pdf) to help develop or complement in-house intelligence abilities. The company acquired cyber forensics firm [Mandiant](https://www.reuters.com/article/us-mandiant-fireeye/fireeye-buys-cyber-forensics-firm-mandiant-for-about-1-billion-idUSBREA010W220140102) in 2014; together they developed a comprehensive set of services to develop and complement a company's existing threat intelligence capabilities.

**Bottom Line:** *FireEye's* threat analytics platform is helpful for teams that have existing security measures in place but have trouble distinguishing among alerts. TAP helps parse out and prioritize the real concerns.

## 2. Consolidated Management Tools: Palo Alto Networks
Palo Alto Networks takes advantage of shared threat information among its customers. Threat data from one customer will trigger automatic prevention mechanisms across its entire pool. As of January 2018, this included [48,000 customers in 150 countries](https://investors.paloaltonetworks.com/static-files/b71f7efc-5149-4f3d-8db6-3fad16a28474). As Palo Alto Networks continues to expand, its protections become more widespread, helping limit the spread of any single attack overall.

Threat intelligence sharing is one of Palo Alto's [four cybersecurity pillars](https://www.paloaltonetworks.com/products/designing-for-prevention/security-platform). A specific product for overwhelmed IT teams is its [Panorama](https://www.paloaltonetworks.com/products/management/panorama) management tool. Panorama allows administrators to view traffic, manage device configuration, push policies, and generate reports from one console:

![Palo Alto Network's Panorama](https://images.ctfassets.net/23aumh6u8s0i/39neQk4tIxk9PC3qtAENXi/9efe5e4581517385e76c5a0038aae939/2-panorama)

> [Source.](https://www.paloaltonetworks.com/products/management/panorama)

Teams have the option to toggle between a centralized dashboard along with more specific views, such as policies and objectives. In the Application Command Center (ACC) view above, an administrator can view network, threat, blocked, and tunnel activity, along with a graphical view of applications.

In Panorama each tab includes widgets to help visualize your network's traffic patterns. Administrators can build out custom tabs that focus on the information you want to prioritize, such as the activity of a user subset in a particular geography. The ACC also provides a comprehensive screen for historical (not just current) data.

**Bottom Line:** Panorama is a robust tool that allows IT teams dealing with a large volume of users and traffic to view all of its activity in real-time and develop and push appropriate policies to manage the flow.

## 3. Malware Search Engine: CrowdStrike
CrowdStrike focuses on [securing endpoints](https://www.crowdstrike.com/about-us/); for the majority of companies, this is where its most sensitive data resides. If an endpoint is breached, cyber adversaries are able to easily move within your network and subtly take data for months without detection.

CrowdStrike recently released a [malware search engine](https://www.crowdstrike.com/products/falcon-search-engine/) that allows teams to quickly understand threats as they arise. For example, if the following comes up on a screen, your team has all of the info it needs to begin an investigation:

![CrowdStrike demonstration](https://images.ctfassets.net/23aumh6u8s0i/5TE5ayteTLujNQpojmAANq/9001e053ac05b02e47d89fb04cdd2d62/3-crowdstrike)

> [Source.](https://www.crowdstrike.com/resources/videos/crowdstrike-falcon-malquery-the-faster-more-complete-malware-search-engine/)

A malware researcher on your team can pick out peculiar pieces of text, such as the Bitcoin wallet ID in the first instruction, and enter it into CrowdStrike's MalQuery to yield matches in seconds:

![CrowdStrike demonstration](https://images.ctfassets.net/23aumh6u8s0i/5lhEPYGwNcvlzlysM2br6C/2a386e832eb000cd64f767a1d56393ce/4-crowdstrike-2)

> [Source.](https://www.crowdstrike.com/resources/videos/crowdstrike-falcon-malquery-the-faster-more-complete-malware-search-engine/)

The researcher is able to search malware in both metadata and binary forms and determine which returned files are executable. He or she can also see when the files were recently seen and download them for further investigation.

Historically, research tools have fallen far behind Google and other internet search options. It can take hours or days to really understand an attack. However, CrowdStrike's search engine amasses 50 billion security events worldwide every day, totaling 560 terabytes of malware. It is 250X faster than current search tools, allowing for powerful real-time search and less lag time before taking action.

**Bottom Line:** If your team is frustrated with figuring out the details of suspicious behavior, CrowdStrike's Falcon Search Engine can provide added speed and agility.

## 4. User Dashboard: Auth0
Here at [Auth0](https://auth0.com/) our team deals with complex identity use cases. We make sure that your company has the best insights into who your users are at any given time and how they behave in your network. To do so we have an [extensible](https://auth0.com/extend/) and easy-to-integrate platform that secures billions of user logins every month.

The platform provides:

- [Single Sign On (SSO) capabilities](https://auth0.com/single-sign-on)
- [Breached password detection](https://auth0.com/breached-passwords)
- [Multifactor authentication](https://auth0.com/multifactor-authentication)
- [Web and mobile app lock](https://auth0.com/lock)
- [User management tools](https://auth0.com/user-management)
- [Passwordless log-in options](https://auth0.com/passwordless)

In particular Auth0's [user management tool](https://auth0.com/user-management) provides a centralized and actionable means of deeply understanding who is accessing your most secure data when — and from where.

![Auth0 User Management](https://images.ctfassets.net/23aumh6u8s0i/5B1FP68Ls5vQfw6nv1pNjk/cec38ea97b8fbf4406d5272e3f32d6fc/5-auth0-user-management)

Auth0's intuitive UX allows administrators to clearly see every relevant identity, along with rich user profiles. With Auth0 you can rapidly push [rules](https://auth0.com/docs/rules/current) like barring entrants with certain email addresses or collecting commonly used items, such as user credentials and URLs. You can deploy rules using GitHub, Bitbucket, and GitLab; they can be chained together or used individually.

Having this 360 view of your users allows you to detect any out-of-place behavior or unfamiliar users. The Dashboard offers you the ability to take swift action to highlight and block intruders if they enter.

**Bottom Line:** Auth0's user dashboard can help you understand your users at a granular level, including their pictures, personal details, locations, logins, and devices they use. Knowing users at this level, particularly if your company operates in the cloud, makes it clear when someone is out of sync and potentially a threat.

## Don't Forget to Educate Your Employees
While all of these tools offer critical strategies and product enhancements to secure your company against advanced cybercriminal tactics, your most valuable source of rooting out and avoiding cyber threats is educating your employees. A recent study found that [91%](https://cofense.com/enterprise-phishing-susceptibility-report) of cyber attacks begin with a simple phishing email. Companies in the transportation, healthcare, and insurance sectors were most susceptible.

Employees are lured by [curiosity, fear, and urgency](https://cofense.com/enterprise-phishing-susceptibility-report) — and phishing emails are increasingly well designed to blend into an inbox. If you don't properly train your employees to recognize and report suspicious emails, the above tools can be irrelevant. If you do, they can provide you with an array of options that are equally as advanced as your adversaries.

<include src="TweetQuote" quoteText="If you don't properly train your employees to recognize and report suspicious emails, security tools won't be enough to protect you!"/>


4 Tools To Improve Your Team's Threat Intelligence

bb9128fac91692ad4f46a785d772dd39?s=200 avatar

bb9128fac91692ad4f46a785d772dd39?s=200

Data Scientist and Engineer, I love tinkering with data!

Head of Data

Pablo Seibelt

A guide through the available drivers and tools to make your life easier when using Amazon Redshift from R and/or RStudio




[Amazon Redshift](https://aws.amazon.com/redshift/) is one of the hottest databases for Data Warehousing right now, it's one of the most cost-effective solutions available, and allows for integration with many popular BI tools. Unfortunately, the status of the drivers compatibility is a little more shaky, but there is a way to make it work very nicely with [R](https://www.r-project.org/)!

<include src="TweetQuote" quoteText="The status of Redshift drivers compatibility with R is a little shaky, but there is a way to make it work fine."/>

First of all, let's go through the 3 options we have for connecting to Amazon Redshift. For all of the connections, we'll define these variables for connecting:


```r
dbname="dbname"
host='my-redshift-url.amazon.com'
port='5439'
user='myuser'
password='mypassword'
```

## RJDBC

This is the ["official" way to use Amazon Redshift with R](https://aws.amazon.com/blogs/big-data/connecting-r-with-amazon-redshift/), using the JDBC driver on [SQL Workbench/J](http://www.sql-workbench.net/) is the official way to connect to it according to the documentation, and this driver can be loaded like this:



```r
# Save the driver into a directory
dir.create('~/.redshiftTools')
download.file('http://s3.amazonaws.com/redshift-downloads/drivers/RedshiftJDBC41-1.1.9.1009.jar','~/.redshiftTools/redshift-driver.jar')
install.packages('RJDBC')
```


```r
suppressPackageStartupMessages(library(RJDBC))

# Use Redshift driver
driver <- JDBC("com.amazon.redshift.jdbc41.Driver", "~/.redshiftTools/redshift-driver.jar", identifier.quote="`")

# Create connection    
url <- sprintf("jdbc:redshift://%s:%s/%s?tcpKeepAlive=true&ssl=true&sslfactory=com.amazon.redshift.ssl.NonValidatingFactory", host, port, dbname)
jconn <- dbConnect(driver, url, user, password)
```

Of course you can change the url with the options you need for your particular setup. The first 3 lines you only need to run them once, they download Redshift's official JDBC driver and install the RJDBC package.

This package was the only one I found which supported transactions on Redshift (`BEGIN`, `COMMIT`, `ROLLBACK`) until recently, otherwise on other packages DDL operations will autocommit.

Until a few days ago since the writing of this blogpost, this was the recommended package for uploading data and inserting/deleting data, since you usually want be able to unite your operations which modify data into a single transaction.

This package has some big problems though, which I'll explain later on this post.

## RPostgreSQL

Amazon Redshift is mostly PostgreSQL compatible, so most PostgreSQL drivers work well. [RPostgreSQL](https://code.google.com/archive/p/rpostgresql/) is configured like this:



```r
install.packages('RPostgreSQL')
```

```r
library(RPostgreSQL)
drv <- dbDriver("PostgreSQL")
pconn_rsql <- dbConnect(drv,
                 host = host,
                 port = port,
                 user = user,
                 password = password,
                 dbname = dbname)
```

There are two major problems with this driver though: It [lacks SSL support](https://stackoverflow.com/questions/38942118/can-not-connect-postgresqlover-ssl-with-rpostgresql-on-windows), and you don't have transactions like you do with the official driver. In my humble opinion this is not a good option, even if you don't use SSL now, if your company requires it in the future you may need to change all your code to switch drivers. The good thing is this driver works fine with [dbplyr](http://dbplyr.tidyverse.org/).

<include src="TweetQuote" quoteText="The RPostgreSQL driver doesn't support SSL-secured Redshift clusters."/>

## RPostgres

This is another PostgreSQL library, that has much better support using the [libpq library](https://www.postgresql.org/docs/9.6/static/libpq.html), you'll probably need to install the postgresql development header libraries locally for this one to be installed succesfully. [Check out the official docs for installing instructions if you run into issues.](https://github.com/r-dbi/RPostgres)



```r
install.packages('RPostgres')
```

```r
library(RPostgres)
pconn_r <- dbConnect(RPostgres::Postgres(),
               host = host,
               port = port,
               user = user,
               password = password,
               dbname = dbname,
               sslmode='require')
```

RPostgres supports transactions, SSL and works fine with dbplyr.

## Gotchas With The Libraries

So, what are some gotchas with these libraries?. We'll run this in SQL Workbench/J to have some data to test:


```sql
create table sicatest (
  a varchar(100),
  b bigint,
  c date,
  d timestamp,
  e boolean
);
insert into sicatest values
('Hello', 1, '2017-10-01', '2017-10-01 20:00:00', TRUE);
insert into sicatest values
('Hello ñandu', 9223372036854775807, '2017-12-30', '2017-12-11 23:59:00', FALSE);
insert into sicatest values
('こんにちは', 9223372036854775807, '2017-12-30', '2017-12-11 23:59:00', NULL);
commit;
```

We deliberately added the Ñ letter from spanish, and こんにちは (Kon'nichiwa) which is hello in japanese to have some non-ascii stuff, and see if it's handled correctly.

So, let's start with RJDBC:


```r
suppressPackageStartupMessages(library(dplyr))
sicatest = dbGetQuery(jconn, 'select * from sicatest')
dplyr::glimpse(sicatest)
```

```
## Observations: 3
## Variables: 5
## $ a <chr> "こんにちは", "Hello ñandu", "Hello"
## $ b <dbl> 9223372036854775808, 9223372036854775808, 1
## $ c <chr> "2017-12-30", "2017-12-30", "2017-10-01"
## $ d <chr> "2017-12-11 23:59:00.000000", "2017-12-11 23:59:00.000000", ...
## $ e <chr> NA, "false", "true"
```

Well, that didn't go as expected, right? If you look closely, the table has the number `9223372036854775807`, but the query has returned `9223372036854775808` 😱. This happens because the numeric integer is automatically converted to a floating point numeric, which loses precision with big numbers.

Also unfortunately, it has returned dates and booleans as strings, which is incorrect, but we can work around that. Let's compare with `RPostgres`.



```r
sicatest2 = dbGetQuery(pconn_r, 'select * from sicatest')
glimpse(sicatest2)
```

```
## Observations: 3
## Variables: 5
## $ a <chr> "Hello ñandu", "Hello", "こんにちは"
## $ b <S3: integer64> 9223372036854775807, 1, 9223372036854775807
## $ c <date> 2017-12-30, 2017-10-01, 2017-12-30
## $ d <dttm> 2017-12-11 23:59:00, 2017-10-01 20:00:00, 2017-12-11 23:59:00
## $ e <lgl> FALSE, TRUE, NA
```
Well well, that's much better isn't it? the numbers aren't modified, they are of the correct type (int64), and it correctly guessed types `date`, `datetime` and `logical/boolean`! If integer64 is problematic in your case, you can also choose to convert bigint fields into other types, by using the `bigint` parameter when creating the connection.

Great stuff! I think this is the kind of library we want to work in a day-to-day basis. Also, you can use this same connection to explore data with dbplyr:


```r
sica_ref = tbl(pconn_r, 'sicatest')

r = select(sica_ref, d, a) %>%
  mutate(rank=min_rank(desc(d))) %>%
  filter(rank==1) %>%
  collect()
knitr::kable(r, format='markdown')
```



|d                   |a           | rank|
|:-------------------|:-----------|----:|
|2017-12-11 23:59:00 |Hello ñandu |    1|
|2017-12-11 23:59:00 |こんにちは  |    1|

Before, this library failed with transactions, so something like this failed, but now it works fine!


```r
dbExecute(pconn_r, "BEGIN")
dbExecute(pconn_r, "COMMENT on table sicatest is 'best table ever'")
dbExecute(pconn_r, "ROLLBACK")
```

That's why, for maximum efficiency with R + Redshift, I recommend to use `RPostgres`, as it's the best library available today.

<include src="TweetQuote" quoteText="For maximum efficiency with R + Redshift, we can use RPostgres."/>

Having said that, there's an additional tool which I'd like to introduce to you, which is the `redshiftTools` R Package, it'll add nicely to your toolkit and supports either RJDBC or RPostgres connections. This package is MIT licensed and it's source is available at [https://github.com/sicarul/redshiftTools](https://github.com/sicarul/redshiftTools).


```r
  install.packages(c('devtools', 'httr', 'aws.s3'))
  devtools::install_github("RcppCore/Rcpp")
  devtools::install_github("r-dbi/DBI")
  devtools::install_github("sicarul/redshiftTools")
```

After installing, you'll have 4 helpful functions to use, which are explained in full detail in [the package's README](https://github.com/sicarul/redshiftTools).

`rs_create_statement`: Generates the SQL statement to create a table based on the structure of a data.frame. It allows you to specify sort key, dist key and if you want to allow compression to be added or not.

`rs_replace_table`: Deletes all records in a table, then uploads the provided data frame into it. It runs as a transaction so the table is never empty to the other users.

`rs_upsert_table`: Deletes all records matching the provided keys from the uploaded dataset, and then inserts the rows from the dataset. If no keys are provided, it acts as a regular insert.

`rs_create_table`: This just runs *rs_create_statement* and then *rs_replace_table*, creating your table and uploading it.

This package is helpful because uploading data with inserts in Redshift is super slow, this is the recommended way of doing replaces and upserts [per the Redshift documentation](http://docs.aws.amazon.com/redshift/latest/dg/t_Loading-data-from-S3.html), which consists of generating various CSV files, uploading them to an S3 bucket and then calling a copy command on the Redshift server, all of that is handled by the package.

I hope this guide let's you unlock the full potential of R + Amazon Redshift, two great tools that work very well together when well configured. We use this methodology inside Auth0 and we think it's very useful for other organizations with similar infrastructure.

If you are interested in reading other posts about our work with Data @ Auth0, you may enjoy [Machine Learning for everyone](https://auth0.com/blog/machine-learning-for-everyone/) and [Adding Authentication to Shiny Server in 4 Simple Steps](https://auth0.com/blog/adding-authentication-to-shiny-server/).

<include src="asides/MarketBasketLinksAbout" />


A comprehensive guide to connect to Amazon Redshift from R

Learn, through a practical tutorial, what tools we can leverage to develop and publish high-quality NPM packages.

Developing and Publishing an NPM Package

Let's learn how to integrate Node.js build tools, like gulp, into Maven's lifecycle.

**TL;DR:** Single Page Applications (SPAs) have been the biggest web development trend for a while now. Developers from all around the world have started creating new applications based on this technique, and started migrating existing ones too. For many years, Java developers relied on technologies specific to the Java world, such as [JavaServer Faces](https://auth0.com/blog/developing-jsf-applications-with-spring-boot/). But, as JavaScript frameworks started to gain more power, become more popular and well supported, Java developers started migrating their front-end code to these frameworks. Today we will see how we integrate Node.js build tools, used to process JavaScript source code, into Maven's lifecycle.

<include src="TweetQuote" quoteText="Integrate Node.js build tools into Maven's lifecycle is easy."/>

## Node.js Build Tools

Being one of the most vibrant community of all times, it is no surprise that many build tools were developed to automate tasks like concatenation of source files, minification of JavaScript code, and so on. Luckily, all the popular tools were developed around a single technology, Node.js, which made it easier to integrate with other technologies, such as Maven.

In this article, we will use a Maven plugin, called [*Frontend Maven Plugin*](https://github.com/eirslett/frontend-maven-plugin), to integrate [Gulp](http://gulpjs.com/) tasks into Maven's `generate-resources` phase. If instead of Gulp you are using some other tool, like [Webpack](https://webpack.github.io/) or [Grunt](https://gruntjs.com/), fear not, the approach shown throughout the article is the same for those.

## Cloning Maven Application

To give us some leverage, let's clone a simple RESTful application based on [Spring Boot](https://projects.spring.io/spring-boot/). This application has a trivial API that handles HTTP requests to add new tasks, delete existing ones, and retrieve all tasks. Upon this API we will build a very small [AngularJS](https://angularjs.org/) application. If you are not familiar with AngularJS or Spring Boot, but would like too learn how to integrate Node.js tools with Maven, don't worry. As both the backend API and the front-end application that we will build are deadly simple, you will still be able to keep up with this article.

To start, let's issue the following commands.

```bash
git clone https://github.com/auth0-blog/nodejs-maven.git
cd nodejs-maven
mvn clean package
java -jar target/nodejs-maven-0.0.1-SNAPSHOT.jar
```

These commands will download the RESTful application in our computer, build it with Maven, and then run the app. If everything goes well, we will be able to issue HTTP requests to it, like so:

```bash
# saves a new task called 'First task'
curl -H "Content-Type: application/json" -X POST -d \
'{ "title":"First task",
   "description":"This is my first task."
}'  http://localhost:8080/api/task

# retrieves all tasks
curl http://localhost:8080/api/tasks

# delete task with id = 1
curl -X DELETE http://localhost:8080/api/task/1
```

## Creating the AngularJS Application

Now that we have our application cloned and working, we can create an interface for it. As mentioned before, we will create an AngularJS application that will allow users to interact with the existing API. To start, let's add an `index.html` file that will be shown for our web users. Let's create this file in the `src/main/resources/static/` directory with the following code:

``` html  

<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="utf-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Integrating Node.js build tools with Maven</title>
	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css"/>
</head>
<body>
<div class="container" ng-app="app">
	<div class="row">
		<div class="col-xs-12" ng-controller="mainController as mainCtrl">
			<h1>Integrating Node.js build tools with Maven</h1>
			<div class="row">
				<div class="col-xs-4">
					<div class="form-group">
						<label for="title">Title</label>
						<input type="text" class="form-control"
							   ng-model="mainCtrl.task.title"
							   id="title" placeholder="Task title">
					</div>
				</div>
				<div class="col-xs-4">
					<div class="form-group">
						<label for="description">Description</label>
						<input type="text" class="form-control"
							   ng-model="mainCtrl.task.description"
							   id="description" placeholder="Task description">
					</div>
				</div>
				<div class="col-xs-4">
					<div class="form-group">
						<button class="btn btn-default" ng-click="mainCtrl.addTask()" style="margin-top: 25px;">
							Add task
						</button>
					</div>
				</div>
			</div>
			<table class="table" style="margin-top: 10px;">
				<tr>
					<th>Title</th>
					<th>Description</th>
					<th>Options</th>
				</tr>
				<tr ng-repeat="task in mainCtrl.tasks">
					<td>{{task.title}}</td>
					<td>{{task.description}}</td>
					<td>
						<button class="btn btn-danger" ng-click="mainCtrl.removeTask(task)">
							<span class="glyphicon glyphicon-remove-circle"></span>
						</button>
					</td>
				</tr>
				<tr ng-if="mainCtrl.tasks.length == 0">
					<td colspan="4">No tasks available.</td>
				</tr>
			</table>
		</div>
	</div>
</div>
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.1/angular.js"></script>
<script src="/js/app.js"></script>
</body>
</html>

```

As you can see above, the application uses [Bootstrap](http://getbootstrap.com/) to give us a nice interface, and has only two JavaScript dependencies: `angular.js` and `/js/app.js`. The first one is AngularJS source code, which enables us to use the framework in our app, and the second one is the application that we will build.

Our AngularJS application will contain two files. The first one, which will be responsible for defining a new AngularJS module, will be called `app-definition.js` and will be created in a new directory called `web` under the `src/main/` directory. This file will have the following code:

```js
(function(angular) {
	var app = angular.module('app', []);
}(angular));
```

Usually this file would be used to define dependencies and to configure these dependencies behaviors. But, as our application won't have any dependency, this file will be used only to define the new AngularJS module called `app`.

The second file that our front-end application will have is the `mainController` controller used in the `index.html` file above. Let's call this new file as `app-controller.js`, add it to the `src/main/web/` directory, and insert the following code on it:

```js
(function(angular) {
	var app = angular.module('app');

	var mainController = function ($http) {
		var ctrl = this;

		ctrl.tasks = [];
		ctrl.task = {};

		loadTasks();

		ctrl.addTask = function() {
			$http.post('/api/task', ctrl.task).then(function() {
				alert('Task added');
				ctrl.task = {};
				loadTasks();
			}, function(error) {
				alert(error);
			});
		};

		ctrl.removeTask = function(task) {
			$http.delete('/api/task/' + task.id).then(function() {
				alert('Task removed');
				loadTasks();
			}, function(error) {
				alert(error);
			});
		};

		function loadTasks() {
			$http.get('/api/tasks').then(function(response) {
				ctrl.tasks = response.data;
			}, function(error) {
				alert(error);
			});
		}
	};
	mainController.$inject = ['$http'];
	app.controller('mainController', mainController);
}(angular));
```

As you can see, this controller has three functions. One to add new tasks, one to remove a task passed as parameter, and one to load all tasks from the RESTful application. These files are everything that our AngularJS SPA needs to interact with our RESTful API. Now we just need to assemble these files in a single one, called `app.js`, and add it to `src/main/resources/static/js/` to make it available to our `index.html` web page.

## Assembling AngularJS with Gulp

To process the AngularJS source files created above we will use Gulp.js and a few plugins available on it. But first, let's define our application as a Node.js app. To do that, let's issue the following command in the root directory of our application:

```bash
npm init -y
```

This will add a file called `package.json` which will hold details, such as dependencies, about our app. After that, we can install Gulp and its plugins:

```bash
npm install --save-dev gulp gulp-concat gulp-if gulp-sourcemaps gulp-uglify gulp-util
```

And then define a new file called `gulpfile.js` in the root directory, with the following code:

```js
var gulp = require('gulp');
var gulpif = require('gulp-if');
var concat = require('gulp-concat');
var sourcemaps = require('gulp-sourcemaps');
var uglify = require('gulp-uglify');
var util = require('gulp-util');

gulp.task('clean', function () {
	return gulp.src([
		'./src/main/resources/static/js/**/*.js'
	], {read: false})
		.pipe(clean());
});

gulp.task('default', function () {
	var uglifyFlag = util.env.envName === 'production';

	return gulp.src([
		'./src/main/web/app-definition.js',
		'./src/main/web/**/!(app-definition)*.js'
	])
		.pipe(sourcemaps.init())
		.pipe(concat('app.js'))
		.pipe(gulpif(uglifyFlag, uglify({mangle: true})))
		.pipe(gulpif(uglifyFlag, sourcemaps.write()))
		.pipe(gulp.dest('./src/main/resources/static/js/'));
});
```

This file contains two tasks. The first one is responsible for cleaning our project, by removing all `js` files from the `src/main/resources/static/js/` directory. And the second one is responsible for processing the AngularJS source files created before, assembling it as a single one called `app.js` and adding it to the `src/main/resources/static/js/` directory. This task also checks if it is running on production to decide if it should *uglify* the JavaScript source code or not.

[Uglifying JavaScript code](http://symfony.com/doc/current/assetic/uglifyjs.html) is a good technique, but can make debugging harder. Therefore, we use this plugin only when releasing our code to production. We will see in a bit where the `envName` paramaters, that triggers or blocks the *uglify* process, comes from.

With this file in place, we are now able to generate the `app.js` that our web page depends on, and we can access our web application to see if it is really working. Let's issue the following commands to accomplish that:

```bash
# executes the default task in the gulpfile.js file
gulp

# packages the whole app together
mvn clean package

# runs the app
java -jar target/nodejs-maven-0.0.1-SNAPSHOT.jar
```

If we open a web browser now and access [http://localhost:8080], we will see a screen like that:

![Integrating Node.js Build Tools with Maven](https://images.ctfassets.net/23aumh6u8s0i/1sM6kZi1za99Vjb10fjt60/de423c792b05386b57b40201c7e8f7c0/app)

Cool. Our AngularJS application is up, running, and working as expected. But wait! This is not the process that we want. We don't want to remember yet another command to generate the static resources that compose our front-end application. We want to integrate this in our current release process. That is, we want to integrate this process with Maven.

## Integrating Gulp with Maven

To integrate Gulp and its tasks into Maven's lifecycle, we just need to add the Maven plugin previously mentioned, *Frontend Maven Plugin*, and configure a few steps on it. To do that, let's open the `pom.xml` file and add the following element in the `build/plugins` element:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<project>
  
  <build>
    <plugins>
      
      <plugin>
				<groupId>com.github.eirslett</groupId>
				<artifactId>frontend-maven-plugin</artifactId>
				<version>1.4</version>

				<executions>
					<execution>
						<id>install node and npm</id>
						<goals>
							<goal>install-node-and-npm</goal>
						</goals>
						<configuration>
							<nodeVersion>v7.10.0</nodeVersion>
						</configuration>
					</execution>

					<execution>
						<id>npm install</id>
						<goals>
							<goal>npm</goal>
						</goals>
						<configuration>
							<arguments>install</arguments>
						</configuration>
					</execution>

					<execution>
						<id>gulp</id>
						<goals>
							<goal>gulp</goal>
						</goals>
						<configuration>
							<arguments>default --envName ${environment.name}</arguments>
						</configuration>
					</execution>
				</executions>
			</plugin>
    </plugins>
  </build>
</project>
```

In this plugin we have defined three `execution` goals. The first one, called `install node and npm`, is responsible for installing Node.js and NPM in the current directory to use them in the next steps. The second one, called `npm install`, will install all our Node.js dependencies (Gulp and its plugins). And then the last one will execute the `gulp` command as we did manually before. The difference, in this case, is that it will explicitly define `default` as the task to be executed and it will add the `envName` environment variable with a value that we still need to define. This is how Gulp will decide if it should uglify the AngularJS source code or not.

The `environment.name`, passed as an argument to Gulp, will be tied to Maven profiles that we will add to our application. These profiles will be defined by adding the following elements to the `pom.xml` file:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<project>
  
  <profiles>
    <profile>
      <id>development</id>
      <activation>
        <activeByDefault>true</activeByDefault>
      </activation>
      <properties>
        <environment.name>development</environment.name>
      </properties>
    </profile>
    <profile>
      <id>production</id>
      <properties>
        <environment.name>production</environment.name>
      </properties>
    </profile>
  </profiles>
</project>
```

With these elements, we can choose what kind of release we are going to do. If we want to package our app to production, which will uglify our AngularJS source code, we will need to execute the following command:

```bash
mvn clean package -P production
```

And then if we run:

```bash
java -jar target/nodejs-maven-0.0.1-SNAPSHOT.jar
```

We will be able to see that our AngularJS code is indeed uglified by opening [http://localhost:8080/js/app.js](http://localhost:8080/js/app.js) in a web browser.

If we run Maven without the profile definition, `-P production`, Maven will use the development profile (which is marked with `activeByDefault`) and build our application without uglifying our AngularJS code.

<include src="TweetQuote" quoteText="Learn how to create SPAs based on Spring Boot RESTful APIs"/>

<include src="asides/SpringBoot" />

## Conclusion

Developing SPAs is indeed a good practice, as it gives an smooth interface for our users with seamless navigation and great user experience. Besides that the frameworks available have big communities and a lot of resources available that make web developers very productive. Therefore, integrating JavaScript with Java applications is a good idea and, as we saw today, easy as well. If we are using Maven on our project, we just need to register a single plugin to the build process and configure a few steps to automate the whole process.

Integrating Node.js Build Tools with Maven

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

A global cyber-attack using leaked NSA tools is targeting organizations worldwide including UK's National Health Service, Spain's Telefonica telecom, and many more.



A ransomware, called [**WannaCry**](http://money.cnn.com/2017/05/12/technology/ransomware-attack-nsa-microsoft/), is making rounds across the globe and infecting vulnerable systems worldwide. Amongst the affected include FedEx, UK's National Health Service, Spain's Telefonica telecom, Russia's Interior Ministry, and many more. Hackers exploiting leaked NSA secrets and tools are said to be behind the massive attack, although no specific group has been identified as of yet.

The **WannaCry** ransomware encrypts a computer's file system and demands payment to restore access to the files. If a payment is not made in 7 days, the ransomware will delete all of the files on the machine. The attack, circulated initially through email, targets Windows machines that have not received the March 2017 security update where Microsoft fixed the vulnerability that makes this particular attack possible.

![WannaCry Ransomware](https://images.ctfassets.net/23aumh6u8s0i/5uOAgDiG784chdydy4fMHI/e1f7f71a48912fd9ba6396731004ec71/wannacry)

Ransomware attacks are nothing new. In 2016, a [Los Angeles hospital paid $17,000](https://www.nytimes.com/2016/02/19/business/los-angeles-hospital-pays-hackers-17000-after-attack.html) to regain access when hackers seized control. In fact, in our [Security Trends for 2016](https://auth0.com/blog/security-trends-for-2016/), we mentioned that **cyber extorsion** is likely to evolve and keep security specialists up at night, and we hate that we were right. The **WannaCry** cyber-attack is looking to be one of the biggest attacks recorded!

The **WannaCry** cyber-attack has been reported in 99 countries and over 75,000 attacks have been carried out so far, but perhaps the most concerning is the attack on UK's National Health Service (NHS), as it has life-or-death implications. An important thing to note is that these numbers are only from victims that have self-reported the attack, which means that the scope of this cyber-attack is most likely larger than reported.

Companies can protect themselves and their users agains cyber-attacks by developing strong incident response capabilities to complement their traditional security measures. As prevention can not be successful everytime, being capable of detecting and responding to incidents quickly is crucial. For individuals, the best way to prevent becoming a victim of ransomware and other cyber-attacks is to always keep your operating system up-to-date by enabling automatic updates. It may be annoying to see the *"You need to restart your computer to apply updates"* message, but a 5-10 minute downtime beats losing years worth of data.

## Personal Information Security Guide

Although you may not be affected by the **WannaCry** ransomware, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, detecting phising scams, backing up data, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

Be sure to check out the [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) to learn how to secure your wireless network, backup your data so that it is not lost if you become a victim of ransomware such as **WannaCry**, detect phishing scams, and more.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


A Massive Ransomware Attack Targets Organizations Around the Globe

71fb37b19e60e1b27a78dc91630dbb29

Alex Stanciu

A deep look at how we automated our employee access request system using Auth0 as the directory and Webtask for serverless last mile integration with our systems


## Automating Access Requests & Provisioning
_A deep look at how we automated our employee access request system_

> “Give me access to vpn”

This is all you need to tell our Slack bot; a request is created and your manager receives an approval request.

### Some Background
Granting users access to various resources is a challenge that many (if not most) organizations face. Unfortunately, many small/medium-sized companies find the cost of purchasing and operating monolithic provisioning systems prohibitive. User access often becomes a highly manual and messy process. Here at Auth0 we started out with a Google Form: employees would fill it out checking off various resources/apps they wanted access to. The form saved into a Google Sheet where a script would take each entry and create an Issue in a GitHub repository. Our IT team would then use the repo’s issues as a request tracking system and manually fulfill them.
There are a few problems with this approach:

- No approval mechanism
- No tracking, and no easy way to show what an employee has access to
- Very hard to automate
- Pretty bad UX

… so we decided to build something

## Goals
For our internal MVP, we wanted to at least address the above points, but also set ourselves up so this tool could grow:

- Provide an easy way to define resources (the things that people can request, for example: email distribution lists, building badges, access to AWS, GitHub, laptop, and VPNs, as well as work orders like “restore a backup” or “reset MFA”)
- Customizable, multi-step, dynamic approval workflows 
- Tracking/reporting to help our SOC2 audits
- Mechanism to setup automated fulfillment for things that can be automated (for ex, via APIs, automatically add a user to our GitHub organization)
- Frictionless UX: we are Slack bot junkies, so we knew this was a critical integration
- Architecture that will allow expansion
- Extendable: if someone wants to convert a resource from manual to automated fulfillment, it shouldn’t require changes to the app or redeployment
- Use this opportunity to explore any new technologies we’ve been watching/itching to play with

## End Result
After three months of on-the-side development, we launched our tool, code-named “Phenix” (no, it’s not misspelled).
![Phenix](https://images.ctfassets.net/23aumh6u8s0i/OSpKH5qrnboV0jXDlgCLa/470e00f1b6b8600931670fafb2c4e82b/phenix)

Let’s do a quick walkthrough of the basic flow. In this sample use case we’ll set up a resource to allow employees to request to be added to our Auth0 GitHub organization.

We first create the resource and specify a few options:
![Resource](https://images.ctfassets.net/23aumh6u8s0i/38KDHh0L4DMxsipMk91sR0/8d2e0c553ac793ea8040be78a198f958/resource)

For the rest of the resource, we configure a two-step serial approval workflow that includes Manager Approval and Security Team approval. 

For fulfillment, we’ll keep it manual for now and assign it to the Dev Ops group.

Resources also allow the creation of a custom form to capture data from the user at the time of request. We will use this to capture the user’s GitHub userid and a comment.
![Resource Tabs](https://images.ctfassets.net/23aumh6u8s0i/6AiN6btnQF400oa4L46st8/ef0df67416302a3992117a0d649a6c79/resource-fillout2)

Now that the resource is configured, let’s request it:
![Create Request](https://images.ctfassets.net/23aumh6u8s0i/2pZZRvy3HkZAcRAszzkLpg/9b94bb6c071f47d647b37856d321f6ca/create-request)

## Approvals
The above request will step through each stage of the approval process; if all stages are approved, the request will switch to fulfillment mode. If any stage is rejected, the approval process stops and the request is finished.

We configured an approval stage called Dynamic Approval for the Manager because each requester could have a different manager. We need to determine who the approver is at run-time, when the request is processing. We do this using the webtask platform. Setting the approval type as dynamic allows the creation of a webtask where the end user (the Administrator) can write custom code that figures out who the manager is.
![Dynamic Approval](https://images.ctfassets.net/23aumh6u8s0i/21EreRfb6flPav2l1PWSja/a70c177acb7d0542fef3a79e74d26dca/dynamic-approval)

Clicking Edit opens the webtask editor where we have simple code to retrieve the manager userid from the request beneficiary’s profile:
![Get Manager Webtask](https://images.ctfassets.net/23aumh6u8s0i/53cicumNduufCQTocCB8Tn/dcb98cb627e5b65023f785ab58fa5a89/get-manager-wt)

The manager info is saved in the Auth0 user’s `app_metadata` attribute; this is currently populated via an existing outside script that syncs our HR system with Auth0 profiles. If we didn’t have this data already in Auth0, this code would instead make an API call to our HR system (BambooHR) to get the user’s manager.

When the request is submitted, the approvers receive a ticket in their inbox representing a pending approval task. For the above request, since I am an admin, I will be able to see both approval tickets (for both the manager and security stages). I will approve both and then reject the fulfillment request. Normally these three steps would be performed by separate people
![Inbox - Approve Requests](https://images.ctfassets.net/23aumh6u8s0i/GKun89oDVrTgBWTv8FGyT/a0e9c1090ec562773b5e5bfb4b5db90b/inbox-approve)

We can see the final status of this request as:
![Final Request](https://images.ctfassets.net/23aumh6u8s0i/4GGFuqmQIJPKXRmwMxTY6V/fa3fcaf8755fbcf4b3606d9b692e76ac/final-request)

As you can see, for each stage it correctly shows who the intended approver/fulfiller was and who actually took the action. Great for our audit history!

## Slack
![Slack Approval](https://images.ctfassets.net/23aumh6u8s0i/50eLESbCPEwIhDKpf7ehsc/33dc2a199470066661f6f798aff8b39f/slack-approval)

When the approval tickets are created, the approvers also receive a message in Slack that they can approve or reject. If the approval is set to a group, we can create mappings of groups to Slack channels so only one message is posted in the group’s channel. The system ensures that only designated approvers are allowed to click the buttons (not everyone in the #devops channel is in the DevOps Group). 

We also wanted the ability to create requests from Slack.  This proved to be a bit more challenging in the end, but a ton of fun. 

This is what it looks like:
![Slack Request](https://images.ctfassets.net/23aumh6u8s0i/74iluPGFjW2YgBqKgDSeui/37713e91b29990cb1ac292e0fb5c68d0/create-request-slack)

It may not be immediately evident but there is a lot going on here.

First, the bot needs to keep track of different conversations, with different users, across different Slack teams. This is easy enough, but it also needs to keep track of _where_ in the conversation it is.

It accepts some built-in commands, like `help`, `list`, etc., but if someone says something like, “I need access to vpn”, this is not a built-in command. To make sense of this, we use [api.ai](https://api.ai)’s NLP services to process these kinds of phrases and detect if the user said something that matches making a request:

>“give [_user_] [_resource_]”

>“request [_resource_] for [_user_]”

>“I want access to [_resource_]”

>etc…

Once it detects that the user wants a resource and for whom (you can request things for other people, too), it then looks to see if that resource has a form defined. If so, we start a “conversation” with the user, progressively asking for the data in the form. 

The hard part here was keeping track of it all. With Slack bots, there is no inherent concept of a session, so we had to build this.  The bot could receive a message like “jdoe35” and it would need to figure out that user X, on team Y, is making a request for resource Z which has five form fields and this is the response to the third field, which we must have previously asked for (ex: “Enter your GitHub user id”). 

## Automating The Fulfillment
In the above example request for GitHub, the resource was configured for manual fulfillment. It means the designated fulfiller received a ticket representing the to-do item. They would manually do the work (add the user to our GitHub organization), and mark it as done.

To automate this, you can configure automated provisioning via a webtask. This is a very simple and straight-forward way to quickly call an API and get something done. In the Fulfillment tab of the resource, we can select “Webtask Auto Fulfillment”:
![Auto Fulfillment](https://images.ctfassets.net/23aumh6u8s0i/2aRfbUt5AMpunM2bSwzJF6/2ecec744f44e08a8a2b3a2cd221c3f1d/auto-fulfillment)

In the webtask code, we can grab the user’s GitHub userid from the form submitted with the request and make the API call:
![Auto Fulfill Webtask](https://images.ctfassets.net/23aumh6u8s0i/5cKuaOVtwSlrv0zBPVQFw6/9df73a1c0b08a965b7792a1b0f40a1de/auto-fulfill-wt)

Using the [webtask platform](https://webtask.io) for extensibility was a huge saver. We can let the administrators and end users customize the tool without burdening the development team. I wish every SaaS/Webapp had something like this, where, for example, you might be given a configuration choice between A or B, but maybe you want that to change depending on certain factors. The webtask platform allowed us to add this third option C to figure it out at runtime by running your own custom code. 

## Tracking
Now that a whole system is in place, it’s very easy to keep track of who has what and why. Below is a very crude interface that shows the basics, but the data is there and generating compliance reports is now trivial.

Building a lightweight certification mechanism on top of this would also be fairly straight-forward. (Certification is the process of periodically asking someone, usually a manager, if a user should still have access to X, thereby catching sensitive access that was only temporarily needed.)
![User Resource List](https://images.ctfassets.net/23aumh6u8s0i/5dU3ya3Mt3s2VKFc21dBpn/56923b5b34218f8fd182b424a7bd8720/user-resource-list)

## Engineering
From the start we wanted to design and engineer this application as if it might some-day become a product. This meant building it from the ground up with scaling, multi-tenancy, security and performance in mind. We also wanted to try out some new technologies and patterns.

The front end is a React, Single Page App. Nothing too fancy going on here beyond current modern standards and recommendations (code splitting, lazy loading, etc…)

We decided to try out GraphQL as the API interface. The data model fits pretty well for the use case. There are lots of joins happening in the data model and with GraphQL the client can get everything in one shot. 

To keep the API as light as possible, we split out the request processing and notification services into separate workers and handed them tasks via a queue.

The bot also follows this convention. We decided to not use Slack’s RTM API since it uses WebSockets, which come with different types of scaling problems. Instead, we use Slack’s Event API which functions like a webhook; we subscribe to chat messages and Slack does a POST to us with those messages. The trick here is that there could be many teams, with many channels, and if the bot is invited to very chatty channels, it will result in LOTS of POSTed messages from Slack.

_If the bot is in a channel (versus Direct Message), it only responds if called by name and it responds in a thread. This minimizes “bot-spam” in public channels._

To handle this, we have an extremely light-weight HTTP server that receives the POSTed message, replies back to Slack with a 200, and puts the data in a queue. A separate bot worker processes the messages and replies to the user. We use Redis to store the conversation sessions, so while making a request and answering questions, there could be many bot workers actually replying.

Speaking of Redis, we also have a fairly standard caching layer for things that don’t change that often (resources, groups, users, tenant settings, API tokens, etc…) we proxy those through a layer of Local Cache -> Redis -> Mongo. A solid caching strategy is especially important when using GraphQL.
![Component Architecture](https://images.ctfassets.net/23aumh6u8s0i/1UjhzXALFyO0NivWKAdsRt/20ff08968249cda32ea6cba8e8c71261/diagram)

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can help you make your product secure with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## Going Forward
In its current state, Phenix is a fairly solid access request platform with some light provisioning. We are planning to keep building on top of this to create a robust provisioning engine with full connector support that handles all types of CRUD operations against target systems. We are also building a reconciliation engine to sync data into the system from other sources. 

While Phenix is an internal tool for now, we are aware that it could be beneficial to others and we may decide to open it later. If you think something like this would be useful to your organization, or if you have any other thoughts or questions on this topic, please leave us a comment.


User Provisioning and Access Request with Auth0 and Webtask

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Prosper Otemuyiwa

Let's go through migrating a simple PHP 5 app to PHP 7

Migrating a PHP 5 App to PHP 7 (Tools & Implementation) - Part 3

Using Auth0 Rules, all your SaaS tools can become part of your authentication procedure



At Auth0 we do what we do best—user authentication.  SaaS is all about these types of specialities. Any SaaS company should concentrate on what it does best, and outsource the rest. You should use SaaS providers for your analytics, your customer communication, your storage, and, of course, your user authentication.

This makes it all the more important that any SaaS provider you use integrates with others, sharing data, and providing both you and your customers with a seamless experience. That’s why we developed [Rules](https://auth0.com/docs/rules).

## What Are Rules?

Rules are Javascript code snippets that run as part of a customized login process on Auth0 servers.

![How rules work](https://images.ctfassets.net/23aumh6u8s0i/3X9mYmKdLN5YJIpXikBfOZ/38fc334ebbd71a1a4112ade6ab5cf6ba/rules-diagram)

* Step 1: Your app initiates an authentication request to Auth0.
* Step 2: Auth0 routes the request to an Identity Provider through a configured connection.
* Step 3: The user authenticates successfully.
* Step 4: The `user` object representing the logged in user is passed through the Rules pipeline and returned to the app.

This entire process is executed as part of the Auth0 authentication process—no extra infrastructure or code is needed on your servers. Each Rule is passed 3 parameters:

1. A `User` object that comes from the identity provider
2. A `Context` object which contains information about the current login, such as the device used, or where the login was attempted.
3. A `Callback` indicating whether the Rule was successfully completed or not.

With just this information, you can use Rules to handle specific requirements of your app, and pass important user data to any of your SaaS providers. For authentication, you could:

* Limit logins to a specific region
* Add information to a user profile, such as their security role
* Check the user's last password reset

Using your other SaaS providers, you could:

* Enrich the customer profile using external sources
* Add login events and user information to your analytics platform
* Trigger external events such as email campaigns or Slack notifications

Each of these would run immediately up on login.

## Why Use Rules?
The following are some of the reasons of why you should use rule.

1. **Improved reporting accuracy:** Events that are triggered server-side complete with a much higher degree of confidence than those that are attempted client-side, which can be blocked by firewalls, errant browser extensions, or code errors
2. **Real-time updates:** Depending on the service you are implementing with Rules, you can get real-time updates of user sign-ins, along with any data you sent via the API.
3. **Easy to create & run:** Implementation is through just a few lines of Javascript in our webtask sandbox. No extra technical debt or product development required.
4. **Sequencing:** Any number of Rules can be run on log in. That means that you can run each of the 4 Rules, and more, below each time a user logs in.


## Some examples of how to integrate your SaaS tools with Auth0
Let's see some of the most popular SaaS tools that are used by our users.

### Send New User Emails Through Mailgun
<div class="" style="text-align: center;"><img style="margin: 0;" src="https://images.ctfassets.net/23aumh6u8s0i/7pk7OMhEep6M2nojo28yUb/63b5af713154e0edba84d570190835f0/Mailgun" alt="Mailgun" />
</div>


[Mailgun](http://www.mailgun.com/) is a set of APIs that allow you to send, receive, and track email through code. It manages the delivery process to improve delivered rates, and produces analytics of why emails weren’t delivered.

If you’re using Mailgun for your email delivery, you can set up a Rule that will send new users an initial email when they first sign up

The persistent property `SignedUp` tracks whether this is the first login or subsequent ones.

```
function (user, context, callback) {
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.signedUp) {
    return callback(null, user, context);
  }

  const request = require('request');

  request.post( {
    url: 'https://api.mailgun.net/v3/{YOUR MAILGUN ACCOUNT}/messages',
      auth:
      {
        user: 'api',
        pass: configuration.MAILGUN_API_KEY
      },
    form: {
      'to': 'admin@example.com',
      'subject': 'NEW SIGNUP',
      'from': 'admin@example.com',
      'text': 'We have got a new sign up from: ' + user.email + '.'
    }
  }, function(err, response, body) {
    if (err) return callback(err);
    if (response.statusCode !== 200) return callback(new Error('Invalid operation'));

    user.app_metadata.signedUp = true;
    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        callback(null, user, context);
      })
      .catch(function(err){
        callback(err);
      });
  });
}
```

The same type of Rule can easily be changed to [send an email to an administrator](https://github.com/auth0/rules/blob/master/src/rules/mailgun.js) on that initial sign in.

Find this rule [here](https://github.com/auth0/rules/blob/master/src/rules/mailgun.js).

### Tracks Logins In MixPanel
<div class="" style="text-align: center;"><img style="margin: 0;" src="https://images.ctfassets.net/23aumh6u8s0i/7Eh1Ul4ndgBu5SIJiDVc7Q/14e22613eb16bc4eae46f3ece65a8ec2/Mixpanel" alt="Mixpanel" />
</div>

Analytics are only as powerful as the underlying data. Adding an analytics Rule to your signing in process allows you to not only track individual logins with your preferred analytics SaaS provider, but also pass your analytics user-specific data to use.

<include src="TweetQuote" quoteText="Analytics are only as powerful as the underlying data."/>

This Rule sends [MixPanel](https://mixpanel.com/) a `Sign In` event and includes the application the user is signing in to as a property.

```
function (user, context, callback) {

  const mpEvent = {
    "event": "Sign In",
    "properties": {
        "distinct_id": user.user_id,
        "token": configuration.MIXPANEL_API_TOKEN,
        "application": context.clientName
    }
  };

  const base64Event = Buffer.from(JSON.stringify(mpEvent)).toString('base64');

  request.get({
    url: 'http://api.mixpanel.com/track/',
    qs: {
      data: base64Event
    }
  }, (err, res, body) => {
      // don’t wait for the MixPanel API call to finish, return right away (the request will continue on the sandbox)`
      callback(null, user, context);
  });
}
```

This event will immediately be available in your Mixpanel dashboard, and available to analyze.

Find this rule [here](https://github.com/auth0/rules/blob/master/src/rules/mixpanel-track-event.js).

### Creates A New Lead In Salesforce On First Login
<div class="" style="text-align: center;"><img style="margin: 0;" src="https://images.ctfassets.net/23aumh6u8s0i/4kkgTIFYLbcSQ3VHyZ9cPE/15875c8b171a5f090430f676dc54013a/Salesforce" alt="Salesforce" />
</div>

Customer Relationship Management (CRM) tools are a mainstay of modern sales. However, they have a common weakness—the salespeople.  Salespeople often forget to update their CRM, impacting the sales analytics for the company as well as their own sales pipeline.

Automating as much of the data entry process as possible is therefore important for sales teams. This Rule automates the generation of a new Lead in the Salesforce CRM when a user logs in to your app for the first time.

It checks whether this is the first login, then calls the Salesforce API to record the contact as a new Lead. It is using Salesforce REST APIs and the `resource owner` flow to obtain an `access_token`.

```
function (user, context, callback) {
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.recordedAsLead) {
    return callback(null,user,context);
  }

  const MY_SLACK_WEBHOOK_URL = 'YOUR SLACK WEBHOOK URL';
  const slack = require('slack-notify')(MY_SLACK_WEBHOOK_URL);

  //Populate the variables below with appropriate values
  const SFCOM_CLIENT_ID = configuration.SALESFORCE_CLIENT_ID;
  const SFCOM_CLIENT_SECRET = configuration.SALESFORCE_CLIENT_SECRET;
  const USERNAME = configuration.SALESFORCE_USERNAME;
  const PASSWORD = configuration.SALESFORCE_PASSWORD;
  getAccessToken(
    SFCOM_CLIENT_ID,
    SFCOM_CLIENT_SECRET,
    USERNAME,
    PASSWORD,
    (response) => {
      if (!response.instance_url || !response.access_token) {
        slack.alert({
          channel: '#some_channel',
          text: 'Error Getting SALESFORCE Access Token',
          fields: {
            error: response
          }
        });

        return;
      }

      createLead(
        response.instance_url,
        response.access_token,
        (err, result) => {
        if (err || !result || !result.id) {
          slack.alert({
            channel: '#some_channel',
            text: 'Error Creating SALESFORCE Lead',
            fields: {
              error: err || result
            }
          });

          return;
        }

        user.app_metadata.recordedAsLead = true;
        auth0.users.updateAppMetadata(user.user_id, user.app_metadata);
      });
    });

  //See http://www.salesforce.com/us/developer/docs/api/Content/sforce_api_objects_lead.htm
  function createLead(url, access_token, callback){
    //Can use many more fields
    const data = {
      LastName: user.name,
      Company: 'Web channel signups'
    };

    request.post({
      url: url + "/services/data/v20.0/sobjects/Lead",
      headers: {
        "Authorization": "OAuth " + access_token
      },
      json: data
      }, (err, response, body) => {
        return callback(err, body);
      });
  }

  //Obtains a SFCOM access_token with user credentials
  function getAccessToken(client_id, client_secret, username, password, callback) {
    request.post({
      url: 'https://login.salesforce.com/services/oauth2/token',
      form: {
        grant_type: 'password',
        client_id: client_id,
        client_secret: client_secret,
        username: username,
        password: password
      }}, (err, respose, body) => {
        return callback(JSON.parse(body));
      });
  }

  // don’t wait for the SF API call to finish, return right away (the request will continue on the sandbox)`
  callback(null, user, context);
}
```

This Rule also includes another benefit of using Rules: easy error handling. If the Rule can’t complete, it sends an error message to a designated Slack channel, so the sales team knows an error has occurred and can update Salesforce manually.

Find this rule [here](https://github.com/auth0/rules/blob/master/src/rules/creates-lead-salesforce.js).

### Checking Fraud With MinFraud
<div class="" style="text-align: center;"><img style="margin: 0;" src="https://images.ctfassets.net/23aumh6u8s0i/4eWQePJxWGFoO9PLOYwECu/1898fb8e93d65aa5fa776a80a7b10e1e/Minfraud" alt="Minfraud" />
</div>

MinFraud identifies possible fraud in online transactions, as well as suspect account logins and signups. The service uses factors such as geolocation, IP address, email, device and proxies to determine the likelihood a transaction is fraudulent.

This rule will send the user’s IP address, email address, and username (both in MD5 format) to MaxMind’s MinFraud API. The API will return the risk score for the transaction and this information can be leveraged within the Rule to block a login with a high risk score.

```
function (user, context, callback) {
  const querystring = require('querystring');
  const request = require('request');
  const crypto = require('crypto');

  const MINFRAUD_API = 'https://minfraud.maxmind.com/app/ccv2r';

  const data = {
    i: context.request.ip,
    user_agent: context.request.userAgent,
    license_key: configuration.MINFRAUD_LICENSE_KEY,
    emailMD5: user.email &&
        crypto.createHash('md5').update(user.email).digest("hex") || null,
    usernameMD5: user.username &&
        crypto.createHash('md5').update(user.username).digest("hex") || null
  };

  request.post(MINFRAUD_API, { form: data, timeout: 3000 }, (err, res, body) => {
    if (!err && res.statusCode === 200) {
      const result = querystring.parse(body, ';');

      console.log(`Fraud response: ${JSON.stringify(result, null, 2)}`);

      if (result.riskScore && (result.riskScore * 100) > 20) {
        return callback(new UnauthorizedError('Fraud prevention!'));
      }
    }

    if (err) {
      console.log(`Error while attempting fraud check: ${err.message}`);
    }
    if (res.statusCode !== 200) {
      const message = err && err.message;
      console.log(`Unexpected error while attempting fraud check: ${message}`);
    }

    // If the service is down, the request failed, or the result is OK just continue.
    return callback(null, user, context);
  });
}
```

Find this rule [here](https://github.com/auth0/rules/blob/master/src/rules/fraud-prevention-with-minfraud.js).

## Wrapping up: Customizing Rules

These are only a few examples. Any of these Rules can be customized to your other SaaS tools and your apps needs. Using the Auth0 Dashboard, you can use these or any other template to start using Rules in your app right now, or you can build your own unique Rule for your SaaS. The power is there for you to use it.

![Auth0 provides lots of rule templates for you](https://images.ctfassets.net/23aumh6u8s0i/1fNZnT7jGdQNx37jn1Co3v/c15a5c3ed2501b8c958e715c1ca31f02/rule-templates)

[Unlock B2B SaaS growth with modern identity management. Download free eBook here.](https://resources.auth0.com/unlock-b2b-saas-growth-iam/)


"tools"