auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 acquires Apility.io to integrate IP reputation in Anomaly Detection capabilities; and launches Auth0 IP Signals, a free standalone API

<div class="alert alert-info alert-icon">
 
 Important Information 
 The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>. 
</div>

**BELLEVUE, Wash. – March 12, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Auth0 Signals](http://auth0.com/blog/new-ways-to-combat-automated-attacks-auth0-signals), a collection of threat intelligence tools and product capabilities designed to protect customers from identity attacks. Auth0’s acquisition of Apility.io, an anti-abuse company, provides a crucial source of IP threat intelligence to Auth0’s Anomaly Detection engine, which detects malicious and risky login traffic to protect customers from automated attacks, such as credential stuffing and fake account creation. [Auth0 IP Signals](http://auth0.com/signals/ip) is a free tool available for anyone to use, and will be fully integrated into Auth0’s core authentication platform in Q2 2020. 

Auth0 Signals provide important new sources of threat intelligence to Auth0’s Anomaly Detection engine, which already thwarts attacks from more than [50,000 unique IP addresses](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) every day. The continual analysis of numerous risk signals – such as IP reputation, use of breached passwords, and failed authentication volume – assesses the risk of a transaction, login attempt, or session. The collective data gathered from Auth0 Signals produces a Confidence Score that Auth0’s platform then uses to prompt adaptive authentication, or intelligent and dynamic enforcement of controls, such as multi-factor authentication or blacklisting, based on risk. 

Auth0 IP Signals is a curated and constantly updated IP address reputation search engine and API. Its threat database is constantly maintained via a variety of data sources across the web and deep web, including Open Source Intelligence (OSINT). It provides security practitioners with a comprehensive way to proactively identify fraudulent IP addresses and verify IP and email reputation, which can be used to prevent credential stuffing attacks and synthetic account creation. These types of attacks result in an average of more than [$6 million a year in costs per company](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). Auth0 IP Signals is an extension of the company’s history of providing valuable resources for free to its loyal developer community.

“Security and availability are the top priority for our business. We integrated the Auth0 IP Signals API in just hours, and it started blocking abuse right away,” said Guillermo Rauch, CEO of Vercel. “Auth0 Signals helps us ensure a great service to our customers, and helps save money and resources. The best part is that it continues to improve behind-the-scenes on its own.” 

Gartner has introduced a Trusted Identity Corroboration Model (TICM) in its September 2019 Market Guide for Identity Proofing and Corroboration. According to Gartner, “TICM is a conceptual framework that assists SRM (Security & Risk Management) leaders to choose a set of tools and techniques that maximizes the collection of multiple risk indicators to identify fraudulent and malicious activity during account creation, access, and maintenance.” Further, “the continued reliance on static data, public records, or credit bureau data alone to either establish or substantiate trust in an identity is no longer simply unadvisable; it has become negligence. Likewise, a refusal to invest in the gathering and assessment of negative and positive signals puts the burden of security on customers, which is increasingly unacceptable in a world that demands frictionless and secure interactions with businesses and organizations.”

As a central authentication and security service securing more than 100 million logins every day for enterprises around the globe, Auth0 has a unique vantage point for observing trends, where they originate from, and more importantly, knowing how to identify and block them before any damage is done. Recent internal data from Auth0 revealed that up to 67% of traffic going through Auth0 at any given time is suspicious, and 6% of IPs sending traffic to Auth0 are known to be blacklisted on the web, yet they are sending 50% of the total traffic to Auth0. Auth0 Signals will help block that fraudulent traffic from breaking into user’s accounts.

“Credential stuffing, password spraying, phishing, and other malicious attempts are constantly multiplying, and customers need more risk signals than any one company can provide, which is why we’ve created Auth0 Signals,” said Matias Woloski, CTO and co-founder of Auth0. “We have always been a developer-centric company, and wanted to provide a free resource to the application builder community for added value and security. By inserting threat intelligence and risk analysis into the IAM system, we’re reducing identity attack opportunities, offering a frictionless experience, and saving critical time and money for our customers.”

Apility.io is Auth0’s first acquisition, bolstering the company’s security strategy to protect against automated cyberattacks, and underscoring its focus on best security practices to keep customers’ information safe and their experiences seamless. 

Additional Auth0 Signals threat intelligence tools will be launched in 2020, and will be freely available to security practitioners for proactive abuse prevention and incident investigation. To learn more, please visit: [http://auth0.com/signals/ip](http://auth0.com/signals/ip).

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Hannah Carroll 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Signals: New Threat Intelligence to Protect Customers from Cyberattacks

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

View, understand, prioritize, and act on the alerts your team receives.

2018 will inevitably bring more and more sophisticated cyber attacks. As with all industries, the technology used continues to push the boundaries of what we previously thought was possible.

It continues to be critical that your company takes every precaution to protect itself. Knowing your users and managing their behaviors in your network are just some of the strategies you should employ in this increasingly complex landscape.

But if you, like many of your peer companies, have an IT team that is overwhelmed by alerts and competing demands, where do you begin?

The four tools below help you cut through the noise, quickly figure out where to focus your energy, and actively respond to suspicious behavior.

<include src="TweetQuote" quoteText="Four tools to help you cut through the noise, quickly figure out where to focus your energy, and actively respond to suspicious behavior."/>

---

## What Is Threat Intelligence?
The definition of threat intelligence continues to evolve as new threats emerge and multiply. In essence, threat intelligence seeks to recognize and understand the advanced tactics of cybercriminals and the particular ways in which they threaten data and networks.

Threat intelligence can be broken down further into [five data types](https://www.alienvault.com/blogs/security-essentials/threat-intelligence-definitions):

- **Internal**: Based on your team's own assets
- **Network**: Focused on your organization’s boundary
- **Edge**: Observes how Internet hosts are behaving at the edge of the network
- **Open-source**: Public blogs, Twitter and news feeds, and other chat channels
- **Closed-source**: Underground websites and information channels

The detailed nature of these definitions highlights the complex and evolving nature of the threat intelligence space. Best practices have evolved as in-house IT specialists work hard to keep up, but software tools also play a big part in helping organizations stay on the cutting edge. While threats have become more advanced, so have the defensive technologies that can help small- and medium-sized teams fight back.

## 1. Threat Prioritization: FireEye
[FireEye](https://www.fireeye.com/) offers specific expertise in network boundaries — the delineation between the side of the network that a company privately owns and the public side that a provider often manages.

The core of FireEye's resources is its [Threat Analytics Platform](https://www.fireeye.com/products/threat-analytics-platform.html) (TAP), which helps security teams prioritize among the multitude of alerts that arise. FireEye's platform allows IT administrators to quickly contextualize an alert and take action. TAP logs event data from a range of sources, such as security, database, network, and endpoint devices, and ranks them based on risk.

![FireEye Threat Analytics Platform](https://images.ctfassets.net/23aumh6u8s0i/5EVt5CQ7Ezpa5No1IULAq7/995768ca739b8fa0ba01d36df5f80938/1-fireeye)

> [Source.](https://www.fireeye.com/products/threat-analytics-platform.html#dismiss-lightbox)

Alerts pass through FireEye's intelligence, including several rules that generate alerts. These are based on distinguishers (the type of action taking place) and frequency. If an action occurs repeatedly within a specific time frame, the combination of type and frequency will generate an alert.

FireEye also offers [iSIGHT Intelligence Subscriptions](https://www.fireeye.com/products/isight-cyber-threat-intelligence-subscriptions.html) and even an [on-site intelligence analyst](https://www.fireeye.com/content/dam/fireeye-www/products/pdfs/pf/intel/ds-forward-deployment-analyst.pdf) to help develop or complement in-house intelligence abilities. The company acquired cyber forensics firm [Mandiant](https://www.reuters.com/article/us-mandiant-fireeye/fireeye-buys-cyber-forensics-firm-mandiant-for-about-1-billion-idUSBREA010W220140102) in 2014; together they developed a comprehensive set of services to develop and complement a company's existing threat intelligence capabilities.

**Bottom Line:** *FireEye's* threat analytics platform is helpful for teams that have existing security measures in place but have trouble distinguishing among alerts. TAP helps parse out and prioritize the real concerns.

## 2. Consolidated Management Tools: Palo Alto Networks
Palo Alto Networks takes advantage of shared threat information among its customers. Threat data from one customer will trigger automatic prevention mechanisms across its entire pool. As of January 2018, this included [48,000 customers in 150 countries](https://investors.paloaltonetworks.com/static-files/b71f7efc-5149-4f3d-8db6-3fad16a28474). As Palo Alto Networks continues to expand, its protections become more widespread, helping limit the spread of any single attack overall.

Threat intelligence sharing is one of Palo Alto's [four cybersecurity pillars](https://www.paloaltonetworks.com/products/designing-for-prevention/security-platform). A specific product for overwhelmed IT teams is its [Panorama](https://www.paloaltonetworks.com/products/management/panorama) management tool. Panorama allows administrators to view traffic, manage device configuration, push policies, and generate reports from one console:

![Palo Alto Network's Panorama](https://images.ctfassets.net/23aumh6u8s0i/39neQk4tIxk9PC3qtAENXi/9efe5e4581517385e76c5a0038aae939/2-panorama)

> [Source.](https://www.paloaltonetworks.com/products/management/panorama)

Teams have the option to toggle between a centralized dashboard along with more specific views, such as policies and objectives. In the Application Command Center (ACC) view above, an administrator can view network, threat, blocked, and tunnel activity, along with a graphical view of applications.

In Panorama each tab includes widgets to help visualize your network's traffic patterns. Administrators can build out custom tabs that focus on the information you want to prioritize, such as the activity of a user subset in a particular geography. The ACC also provides a comprehensive screen for historical (not just current) data.

**Bottom Line:** Panorama is a robust tool that allows IT teams dealing with a large volume of users and traffic to view all of its activity in real-time and develop and push appropriate policies to manage the flow.

## 3. Malware Search Engine: CrowdStrike
CrowdStrike focuses on [securing endpoints](https://www.crowdstrike.com/about-us/); for the majority of companies, this is where its most sensitive data resides. If an endpoint is breached, cyber adversaries are able to easily move within your network and subtly take data for months without detection.

CrowdStrike recently released a [malware search engine](https://www.crowdstrike.com/products/falcon-search-engine/) that allows teams to quickly understand threats as they arise. For example, if the following comes up on a screen, your team has all of the info it needs to begin an investigation:

![CrowdStrike demonstration](https://images.ctfassets.net/23aumh6u8s0i/5TE5ayteTLujNQpojmAANq/9001e053ac05b02e47d89fb04cdd2d62/3-crowdstrike)

> [Source.](https://www.crowdstrike.com/resources/videos/crowdstrike-falcon-malquery-the-faster-more-complete-malware-search-engine/)

A malware researcher on your team can pick out peculiar pieces of text, such as the Bitcoin wallet ID in the first instruction, and enter it into CrowdStrike's MalQuery to yield matches in seconds:

![CrowdStrike demonstration](https://images.ctfassets.net/23aumh6u8s0i/5lhEPYGwNcvlzlysM2br6C/2a386e832eb000cd64f767a1d56393ce/4-crowdstrike-2)

> [Source.](https://www.crowdstrike.com/resources/videos/crowdstrike-falcon-malquery-the-faster-more-complete-malware-search-engine/)

The researcher is able to search malware in both metadata and binary forms and determine which returned files are executable. He or she can also see when the files were recently seen and download them for further investigation.

Historically, research tools have fallen far behind Google and other internet search options. It can take hours or days to really understand an attack. However, CrowdStrike's search engine amasses 50 billion security events worldwide every day, totaling 560 terabytes of malware. It is 250X faster than current search tools, allowing for powerful real-time search and less lag time before taking action.

**Bottom Line:** If your team is frustrated with figuring out the details of suspicious behavior, CrowdStrike's Falcon Search Engine can provide added speed and agility.

## 4. User Dashboard: Auth0
Here at [Auth0](https://auth0.com/) our team deals with complex identity use cases. We make sure that your company has the best insights into who your users are at any given time and how they behave in your network. To do so we have an [extensible](https://auth0.com/extend/) and easy-to-integrate platform that secures billions of user logins every month.

The platform provides:

- [Single Sign On (SSO) capabilities](https://auth0.com/single-sign-on)
- [Breached password detection](https://auth0.com/breached-passwords)
- [Multifactor authentication](https://auth0.com/multifactor-authentication)
- [Web and mobile app lock](https://auth0.com/lock)
- [User management tools](https://auth0.com/user-management)
- [Passwordless log-in options](https://auth0.com/passwordless)

In particular Auth0's [user management tool](https://auth0.com/user-management) provides a centralized and actionable means of deeply understanding who is accessing your most secure data when — and from where.

![Auth0 User Management](https://images.ctfassets.net/23aumh6u8s0i/5B1FP68Ls5vQfw6nv1pNjk/cec38ea97b8fbf4406d5272e3f32d6fc/5-auth0-user-management)

Auth0's intuitive UX allows administrators to clearly see every relevant identity, along with rich user profiles. With Auth0 you can rapidly push [rules](https://auth0.com/docs/rules/current) like barring entrants with certain email addresses or collecting commonly used items, such as user credentials and URLs. You can deploy rules using GitHub, Bitbucket, and GitLab; they can be chained together or used individually.

Having this 360 view of your users allows you to detect any out-of-place behavior or unfamiliar users. The Dashboard offers you the ability to take swift action to highlight and block intruders if they enter.

**Bottom Line:** Auth0's user dashboard can help you understand your users at a granular level, including their pictures, personal details, locations, logins, and devices they use. Knowing users at this level, particularly if your company operates in the cloud, makes it clear when someone is out of sync and potentially a threat.

## Don't Forget to Educate Your Employees
While all of these tools offer critical strategies and product enhancements to secure your company against advanced cybercriminal tactics, your most valuable source of rooting out and avoiding cyber threats is educating your employees. A recent study found that [91%](https://cofense.com/enterprise-phishing-susceptibility-report) of cyber attacks begin with a simple phishing email. Companies in the transportation, healthcare, and insurance sectors were most susceptible.

Employees are lured by [curiosity, fear, and urgency](https://cofense.com/enterprise-phishing-susceptibility-report) — and phishing emails are increasingly well designed to blend into an inbox. If you don't properly train your employees to recognize and report suspicious emails, the above tools can be irrelevant. If you do, they can provide you with an array of options that are equally as advanced as your adversaries.

<include src="TweetQuote" quoteText="If you don't properly train your employees to recognize and report suspicious emails, security tools won't be enough to protect you!"/>

"threat-intelligence"