auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 acquires Apility.io to integrate IP reputation in Anomaly Detection capabilities; and launches Auth0 IP Signals, a free standalone API

<div class="alert alert-info alert-icon">
 
 Important Information 
 The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>. 
</div>

**BELLEVUE, Wash. – March 12, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Auth0 Signals](http://auth0.com/blog/new-ways-to-combat-automated-attacks-auth0-signals), a collection of threat intelligence tools and product capabilities designed to protect customers from identity attacks. Auth0’s acquisition of Apility.io, an anti-abuse company, provides a crucial source of IP threat intelligence to Auth0’s Anomaly Detection engine, which detects malicious and risky login traffic to protect customers from automated attacks, such as credential stuffing and fake account creation. [Auth0 IP Signals](http://auth0.com/signals/ip) is a free tool available for anyone to use, and will be fully integrated into Auth0’s core authentication platform in Q2 2020. 

Auth0 Signals provide important new sources of threat intelligence to Auth0’s Anomaly Detection engine, which already thwarts attacks from more than [50,000 unique IP addresses](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) every day. The continual analysis of numerous risk signals – such as IP reputation, use of breached passwords, and failed authentication volume – assesses the risk of a transaction, login attempt, or session. The collective data gathered from Auth0 Signals produces a Confidence Score that Auth0’s platform then uses to prompt adaptive authentication, or intelligent and dynamic enforcement of controls, such as multi-factor authentication or blacklisting, based on risk. 

Auth0 IP Signals is a curated and constantly updated IP address reputation search engine and API. Its threat database is constantly maintained via a variety of data sources across the web and deep web, including Open Source Intelligence (OSINT). It provides security practitioners with a comprehensive way to proactively identify fraudulent IP addresses and verify IP and email reputation, which can be used to prevent credential stuffing attacks and synthetic account creation. These types of attacks result in an average of more than [$6 million a year in costs per company](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). Auth0 IP Signals is an extension of the company’s history of providing valuable resources for free to its loyal developer community.

“Security and availability are the top priority for our business. We integrated the Auth0 IP Signals API in just hours, and it started blocking abuse right away,” said Guillermo Rauch, CEO of Vercel. “Auth0 Signals helps us ensure a great service to our customers, and helps save money and resources. The best part is that it continues to improve behind-the-scenes on its own.” 

Gartner has introduced a Trusted Identity Corroboration Model (TICM) in its September 2019 Market Guide for Identity Proofing and Corroboration. According to Gartner, “TICM is a conceptual framework that assists SRM (Security & Risk Management) leaders to choose a set of tools and techniques that maximizes the collection of multiple risk indicators to identify fraudulent and malicious activity during account creation, access, and maintenance.” Further, “the continued reliance on static data, public records, or credit bureau data alone to either establish or substantiate trust in an identity is no longer simply unadvisable; it has become negligence. Likewise, a refusal to invest in the gathering and assessment of negative and positive signals puts the burden of security on customers, which is increasingly unacceptable in a world that demands frictionless and secure interactions with businesses and organizations.”

As a central authentication and security service securing more than 100 million logins every day for enterprises around the globe, Auth0 has a unique vantage point for observing trends, where they originate from, and more importantly, knowing how to identify and block them before any damage is done. Recent internal data from Auth0 revealed that up to 67% of traffic going through Auth0 at any given time is suspicious, and 6% of IPs sending traffic to Auth0 are known to be blacklisted on the web, yet they are sending 50% of the total traffic to Auth0. Auth0 Signals will help block that fraudulent traffic from breaking into user’s accounts.

“Credential stuffing, password spraying, phishing, and other malicious attempts are constantly multiplying, and customers need more risk signals than any one company can provide, which is why we’ve created Auth0 Signals,” said Matias Woloski, CTO and co-founder of Auth0. “We have always been a developer-centric company, and wanted to provide a free resource to the application builder community for added value and security. By inserting threat intelligence and risk analysis into the IAM system, we’re reducing identity attack opportunities, offering a frictionless experience, and saving critical time and money for our customers.”

Apility.io is Auth0’s first acquisition, bolstering the company’s security strategy to protect against automated cyberattacks, and underscoring its focus on best security practices to keep customers’ information safe and their experiences seamless. 

Additional Auth0 Signals threat intelligence tools will be launched in 2020, and will be freely available to security practitioners for proactive abuse prevention and incident investigation. To learn more, please visit: [http://auth0.com/signals/ip](http://auth0.com/signals/ip).

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Hannah Carroll 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Signals: New Threat Intelligence to Protect Customers from Cyberattacks

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Three ways SMBs can invest in cybersecurity best practices that prioritize protecting sensitive data.

Many small business leaders believe their companies are safe from cybersecurity threats. In a [2017 study by Insureon](https://www.insureon.com/resources/research/small-business-cyber-security-poll), just 16% of 2,400 respondents were concerned about a cybersecurity attack — down from 18% the year prior. 

Small business leaders assume their teams are too small to be worthwhile targets — or that existing IT teams can handle external threats. In particular, startup founders must juggle numerous other priorities as they scale, like getting to product-market fit, hiring, and fundraising. If cybersecurity isn’t front of mind, it’s less likely the team will make a concerted effort to improve their current infrastructure.

Yet this lack of attention can be a fatal mistake. Hacking operations often use bots to [_crawl multitudes of sites_](https://www.sitelock.com/blog/2017/04/website-vulnerabilities/) looking for known vulnerabilities. In these situations, company size doesn’t matter. While security disasters at massive companies, such as [_Anthem and Target_](https://auth0.com/blog/4-security-measures-after-data-breach/), dominate headlines, startups, and the rest of the small-to-medium businesses often make easy prey because [_they devote fewer resources to defense_](https://www.bbb.org/globalassets/shared/media/state-of-cybersecurity/updates/cybersecurity_final-lowres.pdf)_._

How can small teams protect themselves when resources are low and other projects are vying for immediate attention? In this piece, we highlight three areas where startup and small business leaders can invest their time and money to secure their sensitive data and safely grow.

## 1. Secure your users from the start.

From the moment you begin hiring, safely and easily managing access to your technical systems becomes a challenge. Yet the pace of startup growth and the [_looming chance of failure_](https://www.godaddy.com/garage/startup-mistakes-4-startups-that-monumentally-failed-and-what-we-can-learn-from-them/) can make it difficult to spend time on credential management. 

A lack of a strong user management and authentication system, however, can sink you.

In Verizon's annual Data Breach Investigations report, they found that [63% of confirmed breaches](https://enterprise.verizon.com/resources/reports/2017/dbir-presentation-beltug.pdf) involved weak, default, or stolen passwords. A bad password doesn't threaten a single account. If users reuse passwords, one compromised account could lead to the loss of many other devices and systems. 

A solution like Auth0 provides [_multi-factor authentication_](https://auth0.com/multifactor-authentication) (MFA) that bypasses password vulnerabilities and enables admins to immediately approve login requests with a single click across a range of devices.

![Auth0 Guardian MFA authentication requests mobile and smart watch screenshots](https://images.ctfassets.net/23aumh6u8s0i/2WzftOPNUQiNo7UrxPClrO/f30cb0b18a1882b312362585c23f8c6d/auth0-guardian-mfa)

With MFA in place, users need a second piece of sensitive information, such as a thumbprint or facial scan, to access other systems. Hackers with only one set of credentials can't get any further. 

[Auth0 Guardian](https://auth0.com/multifactor-authentication) helps startups keep moving by ridding employees of pesky, single-use login codes. With push notifications, busy admins can approve or deny requests without ever having to open the app. Guardian also offers mobile Software Development Kits (SDKs), so that you can design your own MFA application that integrates smoothly with the rest of your company's branding.

## 2. Plan your response to attacks.

Unfortunately, [with data breaches on the rise](https://auth0.com/blog/what-is-a-data-breach/), you can’t afford to not plan ahead.

In 2017, the startup Kickico [found itself unprepared](https://medium.com/@kickico/how-they-tried-to-hack-our-ico-d348659dc4). They endured a wave of distributed denial-of-service (DDoS) attacks as hackers spoofed their site, cloned their platform on GitHub, and readied the clone to fool potential users once the original site went down. Luckily, the hackers appeared to run out of funds to keep up the DDoS attacks, and GitHub promptly responded to Kickico's request to block the attackers. 

Kickico wasn't ready, and admitted “We did not realize such a small and inconspicuous company without huge PR actions [would] attract any attention.”

Many startups are ill-prepared and subtle attacks can take much longer to detect. One study found that [over two-thirds of companies](https://enterprise.verizon.com/resources/reports/DBIR_2018_Report_execsummary.pdf) took months or longer to discover a breach—even though those breaches took mere minutes to accomplish. 

Startups can build in preparedness with tools that offer [breached password notifications](https://auth0.com/breached-passwords), so that you know about leaked credentials instantly, and can even lock out users until they reset their passwords. 

![Auth0 anomaly protection Dashboard brute force protection enabled](https://images.ctfassets.net/23aumh6u8s0i/1dU6iYAvPdzS7ZM8HcK2RA/44ebc4556fcf622399d699338f3383f9/anomaly-detection-overview)

With anomaly detection in place, startups can also set limits on brute force logins before they happen, establishing a baseline level of preparedness. 

These cybersecurity best practices can buttress a [data breach response plan](https://auth0.com/blog/data-breach-response-planning-for-startups/), which prepares startups to react as quickly as possible to a breach. Rather than taking it alone, startups should form relationships early on with law, public relations, and incident response firms that are familiar with data breaches. Once you detect a breach, you can follow the plan and leverage the experts to recover as quickly and fully as possible. 

Data privacy laws are also increasingly [taking breaches more seriously](https://auth0.com/blog/get-ready-for-gdpr/), requiring faster responses and imposing stiffer penalties. A well-thought-out data breach response plan, informed by automatic detection, is only going to become more necessary.

<include src="TweetQuote" quoteText="Many startups are ill-prepared to tackle cybersecurity attacks and subtle ones can take too long to be detected. One study found that over two-thirds of companies took months or longer to discover a breach."/>

## 3. Guard against web-based attacks.

Your website is like your company's front door, yet hackers have thousands of ways in. [Forty-nine percent of cyber attacks](https://www.cyberreadinessinstitute.org/cyber-readiness-news/small-and-mid-sized-businesses-cyber-threats-by-the-numbers) are web-based, and [44 attacks per day](https://smallbiztrends.com/2018/03/sitelock-website-security-insider-q4-2017.html) strike the average small business site. 

Web security depends on more than the connection between two entities. Data [goes through third parties](https://auth0.com/blog/using-https/) to get where it needs to go, so authentication at all stages is central to secure communication. 

If the [right communication protocols](https://auth0.com/blog/common-threats-in-web-app-security/) aren't set, transmitted information can become vulnerable to so-called man-in-the-middle attacks. HTTP, an application protocol you've likely seen in many URLs, is historically focused on sending information, not securing it. 

HTTPS, a newer protocol with security built in, makes attacks much harder to accomplish. HTTPS adds Transport Layer Security, or TLS, which ensures a client is only communicating with the expected server and that all data passed between is encrypted. 

Using an [HTTP Strict Transport Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security), or HSTS, header reinforces HTTPS across your web application by telling browsers your site can only be accessed through HTTPS. Even if users have an older version bookmarked or type http://, an HSTS header forces browsers and applications to use HTTPS instead. Hackers won't be able to access the encrypted information, steal your site's cookies, or force a redirect to a spoofed site. 

Auth0 [enforces HTTPS connections](https://auth0.com/blog/a-run-through-the-owasp-top-10/) to all of its services, which means any non-HTTPS connections will be upgraded. 

Startups have to use their limited resources judiciously, but in the same way, a new restaurant wouldn't skimp on locks, neither should startups ignore these web security best practices. 

## Security on day one

Poor cybersecurity is technical debt. These shortcuts can keep a company moving but compound over time, eventually becoming expensive burdens. You can wait on establishing good cybersecurity procedures, but hackers won't. The longer you take to make security a priority, the harder it's going to be to retroactively protect yourself. 

Cybersecurity is an investment in the sustainability of your company. Growth without cybersecurity best practices in place is [growth for the benefit of hackers](http://blog.idonethis.com/security-ringcaptcha/) seeking a big payout. 

Start by addressing one of your primary vulnerabilities: identity. With an outsourced provider like Auth0, you can scale security with user growth, form an informed threat response plan, and build a secure login environment. Investing in security early will keep you safer and better-informed when it matters most.

<include src="TweetQuote" quoteText="Cybersecurity is an investment in the sustainability of your company. Growth without cybersecurity best practices in place is growth for the benefit of hackers seeking a big payout."/>

<include src="asides/AboutAuth0" />

How SMBs can Improve Cybersecurity for their Customers

37590801?s=460&v=4

Howdy! 🤠 I do technology research at Auth0 with a focus on security and identity and develop apps to showcase the advantages or pitfalls of such technology. I also contribute to the development of our SDKs, documentation, and design systems, such as <a target='_blank' rel='noopener noreferrer' href='https://github.com/auth0/cosmos'>Cosmos</a>. The majority of my engineering work revolves around AWS, React, and Node, but my research and content development involves a wide range of topics such as Golang, performance, and cryptography. Additionally, I am one of the core maintainers of this blog. Running a blog at scale with over 600,000 unique visitors per month is quite challenging! I was an Auth0 customer before I became an employee, and I've always loved how much easier it is to implement authentication with Auth0. Curious to try it out? <a href='https://auth0.com/signup' data-amp-replace='CLIENT_ID' data-amp-addparams='anonId=CLIENT_ID(cid-scope-cookie-fallback-name)'>Sign up for a free account</a> ⚡️.

Staff Developer Advocate

Dan Arias

Help your customers fall in love with your application by providing a secure and easy authentication experience they don't have to remember.

Ah, Valentine's Day! Love is in the cloud. Billions of people are either signing up for or logging in to web services to wish their loved ones a happy day. They are ordering flowers, buying chocolates, or sharing the most intimate of thoughts through messages. Building scalable authentication the right way to sustain spikes in demand can leave developers with a heavy heart. 

However, Auth0 can help you prepare for the best and the worst today and every day. Let me show you why using Auth0 can make you fall in love with authentication through these solid Auth0 features that make modern authentication a walk in the park.

## <a class="toc-target" id="single-sign-on-will-keep-us-together"></a>Single Sign-On Will Keep Us Together

According to the [2018 World Password Survey run by MacAfee](https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/security-world-password-day/), consumers who responded to the survey have an average of **23 online accounts** that require a password but **on average only use 13 unique passwords** for those accounts. With so many passwords to track, forgetting a password is common.

Going through the motions of resetting a password can bring some heartache... Imagine if one of the "Challenge Questions" is asking you about the favorite vegetable of your ex. However, not being able to recover the account or getting it compromised can truly unleash the worst of heartbreaks. 

This all could be alleviated if we only needed to remember one username and one password, right? Find _the_ one and be forever happy with easy access to all of our accounts. This sounds like a fairy tale but it's not. Fortunately for us, Password Charming exists in the form of **Single Sign-On**. 

Single sign-on (SSO) allows users to simply log in once and use all applications they have been granted access to. You could use your Google account to authenticate yourself with a dating site or any other application that decided to delegate the responsibility to create, maintain, and protect your username and password to Google.

![Single sign-on example login authentication in action](https://images.ctfassets.net/23aumh6u8s0i/7cMIHIB6DD65M59E8b60JU/3e95a93f4bd9fd5d532a890de2b5b49f/auth0-single-sign-on-flow)

Building and maintaining an identity platform with Single Sign-On can become expensive, time-consuming, and difficult to get right &mdash; just like love. In a [recent survey](https://auth0.com/forrester-total-economic-impact/), 94% of organizations said they were able to implement Auth0 in less than a month. That is possible because with Auth0’s SSO solution you get:

* [Over 40 supported Identity Providers](https://auth0.com/docs/identityproviders) including mainstream social providers such as MySpace. Kidding!

![Auth0 has built-in identity providers such as Facebook, Twitter, Google, GitHub, LinkedIn, Dropbox, and many more.](https://images.ctfassets.net/23aumh6u8s0i/6oH8TXss4ErZM3RzJ9n7Rp/d31d514b9368daa63782d5a4da15fafb/new-grid-02b)

* The ability to authenticate the social butterfly by consolidating duplicate accounts across various providers with account linking &mdash; while [increasing conversion rates](https://auth0.com/retail/).

* Ease of use by having the freedom to write your code once and integrate any configured connection. One login screen to rule them all.

* Like meeting the expectations of even the strictest of parents, [compliance with leading organizations including SOC2, GDPR, HIPAA, and others](https://auth0.com/docs/compliance). 

[Let Auth0 help you get SSO right today](https://auth0.com/single-sign-on) to help your customers fall in love with an amazing authentication user experience. Don't let any customer be the one that got away because he or she forgot to remember you.

## <a class="toc-target" id="rules-to-love"></a>Rules to Love

Relationship needs are not static. They change as the relationship grows... or dwindles. Authentication is one of the most critical relationships you'll ever form with your customers. This process helps you understand who they are and how you can help them based on an established and ongoing relationship around identity. Therefore, authentication needs to be extensible, flexible, and customizable.

With Auth0 Rules, you can customize your authentication workflow. Auth0 Rules are JavaScript functions that execute when a user authenticates to your application. They run once the authentication process is complete. You can use them to customize and extend Auth0's capabilities.

### Use Auth0 Rules to:

* Enrich user profiles: query for information on the user from a database/API, and add it to the user profile object.

* Create authorization rules based on complex logic (anything that can be written in JavaScript).

* Reuse information from existing databases or APIs for migration scenarios.

* Keep a white-list of users and deny access based on email.

* Notify other systems through an API when a login happens in real-time.

* Modify tokens: Change the returned scopes of the Access Token and/or add claims to it, and to the ID Token.

[Let Auth0 help you rule the authentication game today](https://auth0.com/docs/rules). 

## <a class="toc-target" id="universal-login-one-form-one-heart"></a>Universal Login: One Form, One Heart

One of the easiest ways to improve your customers’ experience while boosting security is through consistency. Imagine that each login form in your application is a physical door. If the look and feel of this door are not consistent throughout the application, your customers' user experience when logging in may look like this:

![Doors metaphorically representing the UX and UI of an app's login form flow.](https://images.ctfassets.net/23aumh6u8s0i/4qZC52zb2rkifVRgofbtvh/1f1e5140952a12c0126b8b456ef6c6f6/valid-doors-valid-login-forms)

Each door that represents a login form looks different. They are all valid entryways for the customer's credentials, but your customer can't anticipate what the login form should look like. This inconsistency can let a malicious actor to phish your customers. Here’s how:

![Invalid door metaphorically representing introduction of a phishing login form.](https://images.ctfassets.net/23aumh6u8s0i/7govsBdLttTOlrwwqEEKTN/668dacccd29c76629deb2b79727aa68c/invalid-door-invalid-login-form)

The attacker creates a site and requests your customers' login. If your login forms are inconsistently designed, for your customers, the brown door may just signal a new form design. They could easily enter their credentials there expecting access to your application &mdash; and just like that, they become phishing victims.

To help protect your customers, a consistent authentication UX and UI helps them better identify when a phishing attempt may be happening. Say that you opt for all of your login forms to look like the yellow door. Now it's much harder to trick one of your customers:

![Consistent app UX and UI of login flow/forms helps to recognize a phishing form.](https://images.ctfassets.net/23aumh6u8s0i/5nckAsKhcjZUvSGITOUnGX/1c7ebfca7a4618e415084e5492071596/consistent-valid-door-design-consistent-valid-login-form-design)

The universal design and implementation of the login makes your customers expect one, and only one, form for their credentials. Anything different must be rejected.

Auth0 offers you an easy way to build this unique door for your customers through **Universal Login**. Anytime your customers need to log in, they are redirected to a central authorization server that presents them with a login form that embraces your brand. Since authentication takes place on the same domain as the login, credentials are not sent across origins, increasing security and protecting against phishing and bucket brigade attacks, also known as man-in-the-middle (MITM) attacks.

Universal Login and SSO also happen to be a match made in heaven. You can orchestrate single sign-on (SSO) between multiple apps. If the user has already signed on to one app, the login page will not be shown again and the user will be logged in via SSO.

Play this video to see it in practice!

<AmpContent>
<amp-video controls
 layout="responsive"
 width="480" height="270">
 <source src="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4"
 type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
 <source src="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4">
 Your browser doesn't support HTML5 video. Here is a <a href="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4"> link to Universal login and SSO</a> instead.
</video>

</NonAmpContent>

Love and security are based on trust. Don't let phishing steal your customers' trust in your design or implementation. You can [get started with Universal Login from Auth0 today](https://auth0.com/universal-login).

## <a class="toc-target" id="multi-factor-authentication-are-you-the-one-for-me"></a>Multi-Factor Authentication: Are You the One for Me??

![Are these images of actress Jaime Pressly or Margot Robbie?](https://images.ctfassets.net/23aumh6u8s0i/2PqNgYrJVTbFlgEJprLfkb/810a1cf582f03290460a72b1145405ef/margot-jaime)

[Left image source: Gage Skidmore](https://en.wikipedia.org/wiki/Margot_Robbie#/media/File:Margot_Robbie_by_Gage_Skidmore.jpg)

Pictured above are _two_ different and unique women. One of them is [Jaime Pressly](https://www.imdb.com/name/nm0005326/) and the other one is [Margot Robbie](https://www.imdb.com/name/nm3053338/). If someone gives you the picture of one of them and tells you to hand her a super secret script for an upcoming Spider-Woman movie, would you be able to tell them apart?

It would be very difficult. Even if you were to ask one of them for their name... What if Margot, jokingly, says her name is Jaime. You need to ask more questions to establish their identity and not make the mistake of giving the prized script to the unintended person. 

Authenticating users is just like that. If you want to have greater confidence that you are granting data access to the right person, multi-factor authentication is for you.

Multi-factor authentication (MFA) is a method of verifying a user's identity by requiring them to present more than one piece of identifying information. This effectively provides an additional layer of security, decreasing the likelihood of unauthorized access. The type of information required from the user is typically two or more of the following:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a mobile device)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The complexity of getting MFA right keeps developers from implementing it in their applications. However, with Auth0, enabling MFA for your application is a fairly straightforward process:
 
* Choose what factors to enable on your application, such as push notification.

* Perform any further setup required to configure that factor.
 
* Choose whether or not you wish to enforce MFA for all users.

![Auth0 Multi-Factor Authentication dashboard with different factors to enable](https://images.ctfassets.net/23aumh6u8s0i/76dOMSouGVa1RG4sZHWMIl/fb3c361a75713719bef1665bc9ba185d/mfa-dashboard-1)

With Auth0 Rules, as you learned earlier, your application's MFA experience can be customized. You can only require MFA in specific circumstances or force a particular factor to be used. When in doubt, always ask: is he or she the one to log in?

Catfishing? Ain't nobody got time for that! Don't let doubt erode your confidence and increase your risk of leaking data. Love, trust but verify. [Give Auth0 Multi-factor Authentication a try today](https://auth0.com/docs/multifactor-authentication).

## <a class="toc-target" id="anomaly-detection-trouble-in-paradise"></a>Anomaly Detection: Trouble in Paradise

> You know that I trust you, baby
>
> But your data's so good lookin'
>
> I'm afraid somebody's gonna steal it away from me.

We know that most of the time it's your customers who are authenticating into your application, but we also know that their data is beautiful and attractive to many malicious users out there. They will try to pretend to be your customer by deception or by force.

Legitimate users may try to log in three or five times if they have forgotten their password but are trying to remember it:

> Was it `correcthorsebatterystaple` or `confectcoarsewaterymaple`?

Ten failed consecutive attempts to log in are definitely a red flag. If the legitimate user is so pressed to log in, they will resort to resetting their password as soon as possible.

With Auth0, you can detect anomalies and stop malicious attempts to access your application. Auth0 offers two types of shields:

* Brute-force protection
* Breached password detection

![Auth0's Anomaly Detection dashboard](https://images.ctfassets.net/23aumh6u8s0i/17r5rvTrkVXqzAgA1v6WM1/724776f473b2c765614f0efaf0ac4ea6/anomaly-detection-overview)

A shield specifies the action you wish to take given a specific trigger. A trigger is a suspicious event that is detected when someone is trying to log in to your system, or they are using a breached password that has been reported by another third-party service.

**Brute-force protection is enabled by default for all connections**. There are two different triggers for the brute-force protection shield, for two slightly different attack scenarios:

* 10 consecutive failed login attempts for the same user and from the same IP address
* 100 failed login attempts from the same IP address in 24 hours or 50 sign up attempts per minute from the same IP address

Auth0 tracks large security breaches that are happening on major third-party sites to help keep your users and systems secure. By enabling breached password detection, when a trigger occurs, your users can be notified and/or blocked from logging in if we suspect their credentials were part of a published security breach. **Auth0 never blocks the user itself, just the attempts from the suspicious origin**.

Is love knocking at your door or is it a brute force attack? [Integrate Auth0's anomaly detection in your application today](https://auth0.com/docs/anomaly-detection) to mitigate bad actors from forcing themselves into the heart of your data.

## <a class="toc-target" id="happy-valentines-day"></a>Happy Valentine's Day

Let Auth0 be the final piece that helps you build a secure and seamless user authentication experience that your customers will love to use. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get started with SSO, MFA, Universal Login, Anomaly Detection, and Rules for free today</a>!

![Auth0 Features to Fall in Love With - SSO, Rules, and More](https://images.ctfassets.net/23aumh6u8s0i/7fRVnuSnZAQva1b4YwQP0P/6f3f16fb671fecefb1cfd08e28dd40af/auth0-the-final-piece-in-authentication-to-fall-in-love-with)

<include src="asides/AboutAuth0" />

Auth0 Features to Fall in Love With

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn avatar

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn

I like working at Auth0 because I’m interested in how to scale a startup and training the next generation of identity experts.

Strategic Operations and Technical Field Enablement Director

Yvonne Wilson

Learn how to plan for failures and changes in your identity project.

How To Have a Successful IDM Project (Part 2)

Learn how to create a realistic project plan to have a good Identity Management project deployment.

Pick up almost any book on project oversight and you’ll quickly see a pattern to advise about how to have a successful project. Certainly, all the usual advice, such as the items below, apply to identity-related projects.

- Ensure the project has clearly defined objective and scope
- Identify and obtain input from representative stakeholders
- Define clear ownership and roles for all parts of the project
- Create a realistic project plan based on stakeholder input
- Track progress regularly to quickly identify causes of any delays

That is excellent advice, but in order to create a realistic project plan, you have to know what typically needs to be done for a particular type of deployment. What if your project team does not have that knowledge? A frequent cause of project issues and delays is simply not accounting for certain requirements. Many an Identity Management project has been delayed by overlooking requirements at the beginning.

Have no fear &mdash; this post will outline several of the most common oversights and pitfalls for identity projects and how to avoid them. These can be grouped into roughly three categories:

- Identify requirements for the entire identity management lifecycle, not just logging in
- Plan for identity failure and change, so you are ready for such events
- Address security and compliance requirements

If you consider the above at the beginning of your project, you’ll have fewer surprises along the way to derail your project.

![Illustration of how to have a succesful Identity Management Project](https://images.ctfassets.net/23aumh6u8s0i/5jn0njMm1bewSR23umVL05/7493c9c60e54aca5b61737fca77d3075/idm-project-dismantle-02)

## Guidelines to Identify IDM Project Requirements

The first thing to check is that your requirements specification takes into account the entire identity management lifecycle. I often tell people that they’ll spend more time on implementing how to log out than how to log in, so they should define how logging out should work early in the project and allow plenty of time in a project plan for testing and implementation. Beyond logging in and logging out, there are several other requirements which may lead to unpleasant surprises and delays if forgotten at the beginning. The following list may help you surface requirements early on:

### How Will User Accounts Be Created?

Will users need to sign up or do they already exist somewhere else and need to be migrated? If users need to sign up, where will that occur, and will all information be collected at once or is [_progressive profiling_](https://auth0.com/docs/user-profile/progressive-profiling) needed? If users need to be migrated, consider that passwords are usually hashed and not transferable from one system to another as-is, necessitating a [_trickle-migration_](https://auth0.com/docs/users/migrations/automatic) approach or [_password reset._](https://auth0.com/docs/connections/database/password-change)

### Will User Profiles Need to Be Synchronized?

Will user profile information need to be synchronized between a system of record (authoritative source) and other points, such as application user stores? It simplifies operations if synchronization can be avoided but legacy systems may require this.

### Username Uniqueness

Identify the attribute used to identify users when logging in as well as across all applications and ensure that the username identifier will be unique for all users. You'll need to especially consider any mergers and acquisition activity that could occur. This will help identify if any mapping of identifiers might be needed across systems.

### How Will Users Log In?

Okay, no one forgets this one, but the devil’s in the details. Be sure to think about what forms of authentication are appropriate for your use case: username and password? [_Passwordless_](https://auth0.com/passwordless) forms of authentication? If your application deals with sensitive data or transactions, is [_multi-factor authentication_](https://auth0.com/docs/multifactor-authentication/) appropriate?

> Auth0 Passwordless is a drop-in authentication system based on Email or SMS, that improves security and user experience. Check it out at [auth0.com/passwordless](https://auth0.com/passwordless).

![Screen showing different passwordless authentication methods with Magic Link selected](https://images.ctfassets.net/23aumh6u8s0i/4y4Kb6Sx3JEwxEGaxTR5xU/49137e92bae8c15bfe3c48b1a35eeacb/magic-link)

### What Devices Will Be Used?

Authentication flows do not work identically across mobile and desktop types of devices. Sadly, in this day and age, this is still a thing. Security configurations, such as browser configuration for trusted sites or mobile device management software can impact the use of cookies, fingerprinting and such &mdash; all of which can impact authentication flows. Be sure to identify the devices that users will use and test across all of them early on in the development cycle.

### Is Single Sign-On Needed?

If you offer multiple applications to users, should users be able to log in once and then access other applications without signing in again? If yes, be sure to consider whether all the applications in a [_single sign-on_](https://auth0.com/docs/sso/current) circle use the same authentication mechanism and user repository. If there are multiple user repositories, will authentication against any of them suffice for access to all the applications or are the requirements more granular?

> Auth0 supports [universal login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) on customer apps. In contrast to embedded login, this offers increased security and a shorter setup time.

![Auth0 Universal Login offerings](https://images.ctfassets.net/23aumh6u8s0i/21BR2xIUfU721nga9W1FqO/184597f0a961d89938bb9923b08e6a73/centralized-embedded-diagram)

### Should Multi-Factor Authentication (MFA) Be Used and If So, When?

MFA offers a higher level of authentication for better protection of sensitive assets. Be sure to consider if it will be used upon initial authentication or only when the user accesses more sensitive content/transactions. There are many forms of MFA available, so be sure to experiment with several and select a form that is suitable for your user population. Be sure to test the usability of the initial registration, as well as any reset processes needed if users change devices, phone numbers or any other aspect of the MFA flow. Cumbersome processes can cause user frustration and support headaches.

> [Learn everything about Multifactor Authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) and how you can start using it right now in your application.

![Eanbling Multi-factor Authentication (MFA) from Auth0](https://images.ctfassets.net/23aumh6u8s0i/5aPgE6GMpGdmaThY8OOHth/a615c93e951b8b648431d86101b81033/enabling-mfa.png)

### What Should Happen When the User Decides to Log Out?

Handling clicks on the [_Logout_](https://auth0.com/docs/logout) button may be trickier than it seems, so pay attention to it early in the design. At a minimum, any session maintained by the application should be terminated. If an application delegates authentication to an external identity provider/authorization server, there may be additional sessions to terminate. Terminating those additional sessions, however, may pull the proverbial rug out from the user’s activity in other applications. Be sure to understand all the sessions that are created when a user authenticates as well as any other applications that depend on the same sessions, before finalizing desired logout behavior.

### How Will Browser Configuration Influence Sessions?

Be sure to understand the impact of browser configuration on sessions. Some browsers have configuration options to reconstitute previous sessions after the browser has been shut down and restarted. Do not rely on browser shutdown to terminate user’s login sessions. In troubleshooting user issues, support teams will need to be aware of such browser configuration options and how to instruct users to start a clean new session when troubleshooting. In addition, be sure to ask if your application will be accessed from shared devices and if so, consider how to protect users that forget to log out.

### Session Timeouts

When users log in, for how long should their session remain valid? If they forget to log out, should their session be terminated after some period of time? You may want to have an idle timeout that occurs when a user has been inactive for some period of time, as well as a maximum timeout that occurs regardless of user activity. Don’t forget to consider the appropriate timeouts for MFA sessions and whether users should be allowed to bypass MFA from known or frequently used devices. Similarly, you should specify whether users should go through the MFA flow every time they log in or will be allowed to only do it periodically, such as every 30 days.

> Learn more about how [_session timeouts_](https://auth0.com/docs/dashboard/dashboard-tenant-settings#session-timeout) are managed with Auth0.

![Login session management at Auth0](https://images.ctfassets.net/23aumh6u8s0i/6zsFj7vQJuZliTFfCNImrl/135fa606ee2c7cc3c9d78b9120551e9f/auth0-dashboard-session-timeout)

### Deprovisioning: What Happens When It’s Over?

Parting is such sweet sorrow… or not. You should consider whether there will be a need to terminate or suspend a user’s account. You should consider audit needs which may dictate that accounts be suspended, but not deleted so that if fraud is detected at a later time, you have sufficient information to tie a user ID in a log file back to a real person. You should also take into account your data retention policy - you do have one, right?

Last but not least, you should ensure specifications in this area align with any relevant [_privacy regulations, such as the GDPR_](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance#conditions-for-consent), that apply to your target user population. Be sure to research and comply with any “right to be forgotten” clauses in privacy legislation for relevant jurisdictions.

### Password Reset

Nothing lasts forever, and passwords are no exception. Be sure to design flows for users to reset passwords, both when they remember the old password and when they do not. You should also specify the requirements for password complexity and whether passwords should expire, requiring rotation, and if so, how often. There is now a debate about whether password expiration and rotation is helpful or not, so you should read up on that and consider the[_ latest recommendations on that front_](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/). Forgotten password reset flows are a common attack vector for hackers, so be sure to include these flows in your security testing.

> Additional reading: [Easy Ways to Build a Better P@$5w0rd](https://www.nist.gov/blogs/taking-measure/easy-ways-build-better-p5w0rd).

![NIST Password Tips](https://images.ctfassets.net/23aumh6u8s0i/OMVAJJhH11CKwrtI7qNvI/e1df75bbc6682600d48c6bed683f8eaf/password_tips)

[_Source_](https://www.nist.gov/sites/default/files/styles/960_x_960_limit/public/images/2017/10/04/password_tips.jpg?itok=uhqF7cwb)

### Blocked Users

It’s a fact of life that, well… life happens. Be sure to consider whether there will be situations where users need to be suspended for a period of time. This could be due to delinquent bills or something as innocuous as someone being on temporary medical leave. Consider the situations that might arise and how to flag users impacted by such situations as well as the process to [_unblock_](https://auth0.com/docs/user-profile#block-and-unblock-a-user) them when the situation has ended.

### Anomaly Detection

To protect your application you may want to automatically [_detect anomalous situations_](https://auth0.com/docs/anomaly-detection) such as:

- A particular user having a large number of failed logins.
- A user logging in from two widely separated geographic locations within a short amount of time.
- Users whose credentials have been compromised and published on the internet in databases of hacked passwords, such as Troy Hunt’s [_haveibeenpwned_](https://haveibeenpwned.com/).

> Auth0 provides three built-in shields that [detect anomalies](https://auth0.com/docs/anomaly-detection) among users in an app's system.

![Anomaly detection example - offered by Auth0](https://images.ctfassets.net/23aumh6u8s0i/61niknHzbOQhzVr96l3lvX/3eea80eace03aa11338ca81e2f102982/anomaly-detection-overview)

### Privacy/Compliance Requirements

Be sure to dig into privacy and compliance requirements up front as they can be time-consuming to fully understand and can impact core processes such as user signup, use of user profile information, and data retention practices as well as logging and backups. There may be several processes you’ll need to implement to respond to user queries such as what information you hold about a user and processing a user’s request to be forgotten. Requirements differ somewhat by user location, so you’ll need to consider the jurisdictions that apply based on where your users are located.

### Audit Logs

You will want to define your requirements for [_logging_](https://auth0.com/docs/logs) and ensure that you will be capturing the information needed for security and audit needs as well as any marketing analytics or charge-back purposes. Consider how long you need to keep logs, weighing audit, security and privacy needs. Logs are most useful when they are actually checked, so you’ll also want to consider how to [_export and analyze logs_](https://auth0.com/docs/extensions#export-auth0-logs-to-an-external-service) data with any of the powerful logs analytics tools that exist today.

### Consider How Identity Information Might Change Over Time

Don’t forget to consider how identity information might change over time. Will usernames need to change for any reason such as legal name changes? Might a user’s status change, such as in the case of a temporary worker becoming a permanent employee and if so, will the process result in overlaps of state where the user has two profiles in existence at once?

## Recap

Auth0 has written some guides for typical customer scenarios that may help you flesh out additional requirements:

- [_B2C scenario_](https://auth0.com/docs/architecture-scenarios/b2c)
- [_B2E scenario_](https://auth0.com/docs/architecture-scenarios/b2e)

The above list of points should give you a running start for what requirements to specify for an Identity Management project focused on authentication and authorization for your applications. By identifying and planning ahead for critical requirements, you’ll reduce the number of project delays caused by critical requirements surfacing part-way through the project. You can further reduce risk by identifying the requirements that will be hardest to meet or involve the most unknowns, and scheduling work on those areas early in the project plan.

![Illustration of how to have a succesful Identity Management Project](https://images.ctfassets.net/23aumh6u8s0i/3xcfKK8nNxOokMAfLlleRt/0bd242d10db9f3195af953a66fa63612/idm-project-dismantle-01)

In part 2, we will cover some things that can change over time or go wrong with the identity aspects of a project. [Read How To Have a Successful IDM Project (Part 2)](https://auth0.com/blog/how-to-have-a-successful-idm-project-part-2/)

<include src="asides/AboutAuth0" />

How To Have a Successful IDM Project

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Rapid gaming industry growth across mobile, console, and PC platforms can lead to disaster without proper security and anti-fraud protections.

In April 2018, Epic Games’ [Fortnite generated $296 million](https://techcrunch.com/2018/05/25/fortnite-had-a-296-million-april/)—more than double what it generated in February. Growth was rapid across mobile, console, and PC platforms.

At the same time as users peaked in February 2018 with 3,400,000 simultaneous logins, [mysterious charges began to appear in users' accounts](https://kotaku.com/whats-really-going-on-with-all-those-hacked-fortnite-ac-1823965781), ranging from $99.99 to $149.99. Hackers made off with one-off charges and often racked up multiple thefts from single users. [One player even struggled to pay his rent](https://www.reddit.com/r/FORTnITE/comments/841zdn/account_hacked_epic_please_help_thats_my_rent/) as a result of the total financial damage. Thieves exposed critical data via multiple log-in attempts, posted sign-in codes, and offered upgrades at steep discounts.

The example isn't isolated. Annually, [cyber thieves make off with over 40 percent](https://www.panopticonlabs.com/our-technology/) of video-game publishers' in-game revenue. As the global [gaming industry's sales top $100 billion](https://seekingalpha.com/article/4184342-video-games-taking-will-esports-become-larger-sports), more criminals are taking notice, and more companies are at risk.

In 2018, it will be critical for gaming companies to know exactly who is logging into their system, when, how, and from where — in order to create a safe and productive environment that users trust and continue to visit.

## What Are Auth0 Rules? How Can They Help?

[Auth0 Rules](https://auth0.com/docs/rules/current) are short JavaScript functions that are executed each time a user authenticates to an application. For example, if you want to know what country a user is logging in from, you can pull this data with the [Add Country Rule](https://auth0.com/rules/add-country) in the Auth0 user dashboard. This can be helpful in locating individual hackers or clusters of them working closely together. In the case of Fortnite, several thefts corresponded to Russia.

While Auth0 has several Rules, all of which developers can use to customize and [extend Auth0's current suite of capabilities](https://auth0.com/b2c-customer-identity-management) to understand and protect end users, we've highlighted two particular ones below that growing video game companies can implement for better security as they scale.

These can be used separately or chained together for modular coding.

### User Fraud Score

The User Fraud score is particularly helpful in confirming that users are who they say they are and in quickly blocking those who are behaving inappropriately.

Auth0 has partnered with [Socure](https://www.socure.com/) to develop a user fraud score for each account that authenticates, based on their email address and IP address.

```javascript
function (user, context, callback) {
 // score fraudscore once (if it's already set, skip this)
 user.app_metadata = user.app_metadata || {};
 if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

 if(!user.email) {
 // the profile doesn't have email so we can't query their api.
 return callback(null, user, context);
 }

 const request = require('request');

 // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
 request({
 url: 'https://service.socure.com/api/1/EmailAuthScore',
 qs: {
 email: user.email,
 socurekey: configuration.SOCURE_KEY,
 ipaddress: context.request.ip
 }
 }, function (err, resp, body) {
 if (err) return callback(null, user, context);
 if (resp.statusCode !== 200) return callback(null, user, context);
 const socure_response = JSON.parse(body);
 if (socure_response.status !== 'Ok') return callback(null, user, context);

 user.app_metadata = user.app_metadata || {};
 user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
 user.app_metadata.socure_confidence = socure_response.data.confidence;
 // "details":[
 // "blacklisted":{
 // "industry":"Banking and Finance",
 // "reporteddate":"2014-07-02",
 // "reason":"ChargeBack Fraud"
 // }
 // ]
 user.app_metadata.socure_details = socure_response.data.details;

 auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
 .then(function(){
 context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
 context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
 context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
 callback(null, user, context);
 })
 .catch(function(err){
 callback(null, user, context);
 });
 });
}
```

Socure incorporates information about individuals from social media, offline identity verification services, and publicly available data, to determine if an account is real or fake. While other vendors generally aggregate static points, such as a user's name, date of birth, and/or social security number, Socure + Auth0 focus on behavioral cues (e.g., how a user has transacted on other platforms, when, and from where; if they have a stable history; or if there are gaps and inconsistencies).

If a user has a high fraud score, you can put them on a watch list or require them to [provide additional information before they can transact](https://www.teampay.co/blog/finance-stack-startups/).

### minFraud (For Games with Payments)

In addition to rooting out suspect account logins and signups, minFraud helps secure your online marketplace by identifying possible fraud in online transactions.

The minFraud Rule will send the user’s IP address, email address, and username to MaxMind’s [minFraud API](https://dev.maxmind.com/minfraud/). Similar to the user fraud score, the API will return the risk score — but this time the focus is on the specific transaction (instead of the user as a whole).

```javascript
function (user, context, callback) {
 const querystring = require('querystring');
 const request = require('request');
 const crypto = require('crypto');

 const MINFRAUD_API = 'https://minfraud.maxmind.com/app/ccv2r';

 const data = {
 i: context.request.ip,
 user_agent: context.request.userAgent,
 license_key: configuration.MINFRAUD_LICENSE_KEY,
 emailMD5: user.email &&
 crypto.createHash('md5').update(user.email).digest("hex") || null,
 usernameMD5: user.username &&
 crypto.createHash('md5').update(user.username).digest("hex") || null
 };

 request.post(MINFRAUD_API, { form: data, timeout: 3000 }, (err, res, body) => {
 if (!err && res.statusCode === 200) {
 const result = querystring.parse(body, ';');

 console.log(`Fraud response: ${JSON.stringify(result, null, 2)}`);

 if (result.riskScore && (result.riskScore * 100) > 20) {
 return callback(new UnauthorizedError('Fraud prevention!'));
 }
 }

 if (err) {
 console.log(`Error while attempting fraud check: ${err.message}`);
 }
 if (res.statusCode !== 200) {
 const message = err && err.message;
 console.log(`Unexpected error while attempting fraud check: ${message}`);
 }

 // If the service is down, the request failed, or the result is OK just continue.
 return callback(null, user, context);
 });
}
```

MinFraud collects information from over [2 billion transactions](https://www.maxmind.com/en/minfraud-services) in its network. The tool assesses signs of fraud, such as

- suspicious pairings of user location with address and IIN data;
- risk associated with the IP address; and
- reputation checks for street addresses, email addresses, phone numbers, and devices.

In cases like _Fortnite_, minFraud could have helped the team block transactions that didn't meet standards for the above criteria, stopping theft from spreading throughout its network.

## Use Rules As Part of a Larger CIAM Strategy

Adding individual Rules that pertain to certain users on your platform is a step in the right direction. Setting up a comprehensive strategy for more deeply understanding all of your users is the next. Either [building or outsourcing](https://auth0.com/b2c-customer-identity-management) customer identity and access management solutions can bring a new dimension to your insights.

![Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

[Source](https://auth0.com/docs/getting-started/dashboard-overview)

With a well-crafted tool like a centralized dashboard (above), admins are afforded a bird's-eye view of all current and past activity. They can drill down into the granular details of each user, if need be, including when they joined the platform, their latest logins, and heaviest usage times. Admins can easily troubleshoot issues that arise by logging in as any user — or block access if they note multiple failed logins or excessive transactions.

As the threat landscape quickly evolves, particularly in fast-moving and highly technical spaces like gaming, coming up with solutions that are cutting edge and safe against the latest attacks can be enormously challenging — particularly for IT teams working 24/7 just to keep a game running. But taking time to consider and create a broad CIAM strategy, centered on end users, will make your game a safe space for competition for years to come.

<include src="asides/AboutAuth0" />

Secure Your Gaming Company With Auth0's Fraud Protection

Key solutions like anomaly detection, universal login, and custom security rules delivered by Auth0 helps its customers protect sensitive user data.

Tight infrastructure security is critical — but if you don't remember to secure your web applications, customer data remains exposed.

There are several [common threats to web-app security](https://auth0.com/blog/common-threats-in-web-app-security/):

- A lack of encryption between your web browser and their servers
- XSS (cross-site scripting) that occurs when malicious scripts are injected into web applications
- Clickjacking (when an attacker injects transparent or opaque objects into a web application)
- Cross-site request forgery (where the attacker impersonates an authorized user and requests sensitive information, such as passwords)

These threats are continuing to multiply and become more complex by the day. To mitigate breaches, particularly in a time of [heavy regulatory scrutiny](https://auth0.com/docs/compliance/gdpr), Auth0 offers three major strategies:

1. Anomaly Detection
2. Universal Login Support
3. Customizable Rules

Auth0 allows you to combine these features to further amplify protection for your app's end users. While you can always attempt to develop these and similar solutions in-house, outsourcing app security will give you access to a team of experts who work 24/7 to keep up with the latest trends in a constantly evolving space.

## Anomaly Detection

Auth0 provides three built-in shields that [detect anomalies](https://auth0.com/docs/anomaly-detection) among users in an app's system. Used separately or in combination, the shields have the ability to stop malicious access attempts before they occur. Administrators receive alerts of suspicious activity and can then block future login attempts by an aberrant user.

<include src="TweetQuote" quoteText="Learn more about how Auth0 provides three built-in shields that detect anomalies among users in an app's system."/>

### Brute-Force Protection

Within its [Brute-Force Protection](https://auth0.com/docs/anomaly-detection) feature, Auth0 has two distinct shields:

1. Shield 1 is triggered after 10 failed login attempts on a single account from the same IP address.
2. Shield 2 is triggered after 100 failed login attempts from a single IP address via different usernames in 24 hours or after 50 sign-up attempts in one minute from the same IP address.

When Shield 1's threshold is reached, an email is automatically sent to the user, which an administrator can edit however he or she wishes. This initial email looks like:

![Affected user email](https://images.ctfassets.net/23aumh6u8s0i/7Hf4QzvX6IDVi6gl4hGRp4/8fc62d71de2ae3698d64c087b89c730c/affected-user-email)

An administrator can easily edit the template by accessing the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and following Emails > Templates.

When Shield 2 is triggered, dashboard administrators are notified. Brute-Force Protection will also block the suspicious IP address. When the issue is resolved, an administrator simply locates the user in the Auth0 [Dashboard](https://auth0.com/docs/dashboard) and files an action to unblock. A user can also click on the "unblock" link provided in the email above or change their password.

### Breached-Password Detection

The third shield is breached-password detection. This is easy to turn on and customize in the Anomaly Detection section of the Auth0 dashboard.

![Breached-password anomaly detection with Auth0](https://images.ctfassets.net/23aumh6u8s0i/3Oe0VufANczOhCpPtuL8iV/99ffa473077e16cd7733334c25a9c73d/breached-password-shield)

Breached-password detection is useful in instances where Auth0 suspects that a user's email has been compromised in a major security breach. (Auth0 consistently tracks these on third-party sites.) If this occurs, Auth0 will trigger the shield, notify the user, and block them from logging in until they reset their information. Breached-password detection is becoming increasingly helpful as many individuals use the same or similar iterations of the same password on multiple sites.

<include src="TweetQuote" quoteText="When Auth0 suspects that a user's email has been compromised in a security breach, Auth0 will trigger a protective shield, notify the user, and block them from logging in until they reset their information"/>

## Universal Login

Auth0 supports [universal login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) on customer apps. In contrast to embedded login, this offers increased security and a shorter setup time.

![Auth0 Universal Login offerings](https://images.ctfassets.net/23aumh6u8s0i/21BR2xIUfU721nga9W1FqO/184597f0a961d89938bb9923b08e6a73/centralized-embedded-diagram)

Universal login is a more seamless experience for the user. On the front end he or she sees a simple authentication request; on the back end, credentials remain within the same domain instead of being sent across origins. This makes it a far more secure method than exposing the information to outside sources. When personal data moves from one origin to another, [phishing attacks](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) and [man-in-the-middle attacks](https://auth0.com/docs/security/common-threats#man-in-the-middle-mitm-attacks) become common.

In addition to an enhanced customer experience, universal login is simpler for administrators to maintain and provides the benefits of single sign-on (SSO).

## Auth0 Security Rules

Auth0 has developed customizable [Rules](https://auth0.com/docs/rules/current) for its app-security features. Rules are JavaScript functions that execute when a user authenticates to your application. Rules can be helpful when customizing and extending Auth0's existing capabilities. For example, the [Force Email Verification](https://auth0.com/rules/email-verified) and [User Fraud Score](https://auth0.com/rules/socure_fraudscore) Rules can be incorporated into Auth0's existing tools like Anomaly Detection to better determine if a user truly is who they say they are.

### Force Email Verification

Force Email Verification only allows app access to users who have verified their emails. Incorporating Force Email Verification into an app instead of a browser version is a good UX practice with powerful back end capabilities.

![Force Email Verification code](https://images.ctfassets.net/23aumh6u8s0i/6MhbfE6DYpGdnku3wGI9Rn/4dd87042b24817242ccde8b52d16c781/verify-email-code)

[[Source](https://auth0.com/rules/email-verified)]

For example, if you are working with a large set of emails that belong to a network, e.g., `@university.edu` or `@company.edu`, Force Email Verification can help parse individuals in a group to make sure that a fake user hasn't set up an account to blend in with the others. Force Email Verification requests that users cross-check their information; anyone who returns information that doesn't match or does not return additional information at all will be blocked from logging in.

### User Fraud Score

Like Force Email Verification, you can tack on the User Fraud Score to a variety of features. If you've built an online marketplace — like Etsy, for example — you can use this rule to cross-check everyone conducting business and thus add an extra layer of protection to purchases. The Rule calculates a fraud score for every user, based on their email address and IP address.

```javascript
function (user, context, callback) {
 // score fraudscore once (if it's already set, skip this)
 user.app_metadata = user.app_metadata || {};
 if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

 if(!user.email) {
 // the profile doesn't have email so we can't query their api.
 return callback(null, user, context);
 }

 const request = require('request');

 // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
 request({
 url: 'https://service.socure.com/api/1/EmailAuthScore',
 qs: {
 email: user.email,
 socurekey: configuration.SOCURE_KEY,
 ipaddress: context.request.ip
 }
 }, function (err, resp, body) {
 if (err) return callback(null, user, context);
 if (resp.statusCode !== 200) return callback(null, user, context);
 const socure_response = JSON.parse(body);
 if (socure_response.status !== 'Ok') return callback(null, user, context);

 user.app_metadata = user.app_metadata || {};
 user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
 user.app_metadata.socure_confidence = socure_response.data.confidence;
 // "details":[
 // "blacklisted":{
 // "industry":"Banking and Finance",
 // "reporteddate":"2014-07-02",
 // "reason":"ChargeBack Fraud"
 // }
 // ]
 user.app_metadata.socure_details = socure_response.data.details;

 auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
 .then(function(){
 context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
 context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
 context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
 callback(null, user, context);
 })
 .catch(function(err){
 callback(null, user, context);
 });
 });
}
```

In the Auth0 Dashboard, copy the code block above, and replace placeholders with the appropriate values. The rule will pull the fraud score from socure.com and store it on app_metadata. A full set of Auth0 Rules can be found [here](https://auth0.com/docs/rules/current).

For fraud detection, Auth0 partners with [ThisData](https://auth0.com/blog/anomaly-detection-safer-login-with-thisdata-and-auth0/). ThisData allows real-time detection of any account takeovers across both web and mobile apps.

## No Better Time To Secure Your Apps

Securing your app with the best tools is always a good decision — but it is especially timely, given the slew of new regulations: GDPR deadline has passed, but [it's not too late to comply](https://auth0.com/blog/your-quick-gdpr-compliance-checklist/), and several countries and states in the U.S. have followed the EU with [similar privacy initiatives](https://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/). In line with these events, Auth0 has developed additional [strategies](https://auth0.com/gdpr-assessment/) for getting your team into alignment quickly, including [customer identity and access management (CIAM) protocol](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/).

While it might be easy to forget your apps in the swirl of demands around your core operations — making sure you plug any holes here is key to ensuring that you don't become another [data-breach statistic](https://consequenceofsound.net/2018/06/ticketfly-hacker-data-breach/).

How Auth0 Makes Your Apps More Secure

A strong CIAM system can help you modernize in a quicker, more organized fashion.



The shift to the cloud is accelerating. Teams of all sizes, including giants like Microsoft, IBM and SAP, are racing to catch up (as we just saw with [SAP's enormous recent acquisition of Qualtrics](https://techcrunch.com/2018/11/11/sap-agrees-to-buy-qualtrics-for-8b-in-cash-just-before-the-survey-software-companys-ipo/?utm_medium=TCnewsletter)).

Every company wants to become faster, smarter, more nimble, and more secure. The best place to begin improvements is with your customer relations. A strong customer identity and access management (CIAM) strategy can be the cornerstone of a team's success. It helps you organize your sensitive customer data in a single place, which ensures you're [compliant with current regulations](https://auth0.com/gdpr). It can also help you form a more creative and targeted strategy moving forward.

Moreover, if you're going through a [digital transformation](https://auth0.com/app-modernization), maintaining continuous customer engagement throughout this challenging process can help keep sales on track.

### What a CIAM solution allows you to do:

- Create a single view of your customers from disparate pieces of data.
- Reduce customer churn with frictionless registration.
- Stay safe in an environment with rising cybercrime.

We dig into these three benefits below and highlight how Auth0's customer identity and access management tools can help you achieve your goals.

## 1. Why customer identity and access management is the first step in single view.

[Single view](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) is becoming the norm for teams that wish to stay competitive. While this is especially clear among [retail and media companies](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/the-case-for-digital-reinvention), it's highly relevant for all customer-facing teams. Catering to customers requires an in-depth knowledge of their interests and behaviors.

Outsourced CIAM providers like Auth0 are able to create an extensive profile for each user in a company's system, which tracks and manages their logins and devices along with their purchase histories.

![Building rich customer profiles, a single view with a CIAM system](https://images.ctfassets.net/23aumh6u8s0i/okSReaVDL4OSDzKC20Kiv/db01bde2e4bfef2b6c5eb85f8b7000fa/logins)

Auth0 facilitates the collection of customer data from all available public sources that combine into a comprehensive picture that you can use to underpin more targeted marketing materials, communications, and product rollouts. Knowing that Maggie Smith is 23, for example, will ensure you don't try to push products for aging on her. You can focus instead on developing a relationship, based on her [millennial interests](https://adespresso.com/blog/marketing-to-millennials/).

If your company opts for [social login](https://auth0.com/learn/social-login/), this profile will also pull Maggie's specific interests from the social providers you choose for authentication.

![Auth0 Social Connections social login providers](https://images.ctfassets.net/23aumh6u8s0i/1GL2CgoClEfkZ9vAfOtAzf/e399ae270682e494910d30fe93126883/sociallogins)

If a user opts to log in from multiple sources (e.g., both Facebook and Google), your team can link these accounts back together, integrating both sets of information.

A single, detailed view of each of your customers is an excellent starting point for [integrating this rich information into your CRM](https://clearbit.com/enrichment) and making more calculated decisions — such as tailoring which pieces of content your users see. Matching articles and/or advertisements to your audience's specific likes, interests, and histories can give them a more personalized experience on your platform and ensure you stay a step ahead of the competition.

## 2. How frictionless registration keeps customers engaged.

Customer retention is an enormous concern for teams today — particularly when the cost of switching among products and services is low, and product reviews and complaints are ubiquitous, along with nearly every other piece of information about your company via social media and a constant stream of news.

Yet there's still an enormous opportunity to shine and create a better experience for your users in this environment. Many companies still struggle with [bad login UX](https://auth0.com/blog/bad-login-experiences/). Users often have to refresh tabs several times just to access a homepage. They quickly lose interest if they have to recover a password more than once. A CIAM strategy that encompasses [passwordless methods](https://auth0.com/passwordless), however, can ensure success:

![Screen showing different passwordless authentication methods with Magic Link selected](https://images.ctfassets.net/23aumh6u8s0i/4y4Kb6Sx3JEwxEGaxTR5xU/49137e92bae8c15bfe3c48b1a35eeacb/magic-link)

SMS, magic link, and Touch ID are three tools Auth0 uses to help its customers ensure a smooth set-up process.

- SMS involves users entering just their phone number to sign up.
- Magic link relies on just an email address.
- Touch ID uses your unique thumbprint.

In addition to simplifying sign-ups, these three solutions contribute to a consistent user experience after an account is created, supporting a higher level of engagement with a company's suite of products and/or services over the long term.

Finally, passwordless authentication can also help mitigate the insecure practice of users recycling the same password for several accounts when a password reset procedure is triggered. This feature is [easy to implement](https://auth0.com/docs/connections/passwordless/faq) with a robust provider like Auth0.

## 3. How an outsourced customer identity and access management provider can help you secure sensitive data.

In addition to being a cornerstone of your team's growth strategy, an impenetrable CIAM setup can help ensure the data of your users is safe from cyberthreats.

Several studies show that [data breaches are on the rise](https://auth0.com/blog/what-is-a-data-breach/). According to [Dark Reading](https://www.darkreading.com/vulnerabilities---threats/2018-on-track-to-be-one-of-the-worst-ever-for-data-breaches/d/d-id/1333252), 2018 is set to be one of the worst years in history for data breaches, with more than 3,600 reported breaches and over 3 billion records exposed. While no tool can 100% guarantee the safety of user data, CIAM mitigates the risk of your company shelling out for fines and lawsuits in the short term and potentially losing its good standing in the long term.

Users will appreciate your implementation of [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) (MFA), for example — i.e., relying on additional sets of information, such as SMS codes, fingerprints, or voice recognition to gain access.

![Multi-Factor MFA authentication on different mobile and watch devices](https://images.ctfassets.net/23aumh6u8s0i/2846ymlXupGms7lqbpSaPh/f227b6ab55a465a5b3138bff54bae3e7/mfadevices)

Auth0 Guardian can make the process of switching to MFA simple. In fact, it even makes MFA itself easier by allowing immediate approvals or denials a login attempt — from a desktop or mobile device (including Android Wear or an Apple Watch).

MFA has a strong success rate for keeping cyberthieves out—largely because it avoids reliance on passwords. A 2017 study found that breached passwords were responsible for [81%](https://www.cso.com.au/mediareleases/29642/hacked-passwords-cause-81-of-data-breaches/) of data breaches (up from 66% in 2016).

Tracking and securing your customer data is essential to maintaining integrity; however, if you're processing any data of EU citizens, it is also critical for complying with _[GDPR](https://auth0.com/gdpr)_. With fines for non-compliance being [up to €20 million or 4% of the global annual revenue](https://auth0.com/gdpr) (whichever is greater) — even if your team is an industry leader, the financial and reputational costs of thieves stealing this sensitive information could be a hard recovery.

## Go beyond customer identity and access management: think platform identity and access management

Many companies have yet to make the investment to modernize — regardless of industry. Consumer packaged goods and automotive companies, for example, lag furthest behind — only completing 31% and 32% of the digital shift they need, according to [recent research from McKinsey](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/the-case-for-digital-reinvention).

The separation between those that have made the right updates and those who haven't is stark: as digitization sweeps through all industries, McKinsey finds that companies in the top quartile of modernization will [capture disproportionate gains](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/the-case-for-digital-reinvention), while those in the bottom quartile will see increasingly depressed revenue and profit growth. The gap will continue to widen.

CIAM can help ensure your team is a leader within its peer group by improving your interactions with customers.

While customer identity and access management is a critical component of a digital shift, it cannot solve all of your organization’s needs. Companies must consider B2B, B2E and IoT use case scenarios as well. A combination of CIAM with B2B or B2E use cases, in particular, can help you achieve and maintain an industry-leading position.


Why Customer Identity and Access Management is Critical to Digital Success

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Anomaly Detection can protect your users from password reuse attacks

Just last week, [GitHub](https://github.com/blog/2190-github-security-update-reused-password-attack) reported that there were several unauthorized attempts—some of them successful—to access a large number of accounts. A thorough investigation revealed that it was an attacker using lists of email addresses and passwords from other online services that have been compromised in the past. As many people use the same password on multiple online services, attackers were able to log in to a number of GitHub accounts. Thankfully, GitHub was not compromised, but some of the accounts were due to this reason.
At **Auth0**, we are aware of this problem and we can help you deal effectively with cases like this. Let's take a deeper look at what Auth0 can do for this kind of situations. 

## How Auth0 Can Help Protecting Your Users' Accounts

Auth0 provides an awesome security feature called **Anomaly Detection**. It comprises in-built tools that help you detect suspicious activities on your users' accounts, alert them of these activities, and it can also stop malicious attempts to access your application. **Anomaly Detection** provides the following benefits:

- **Breached Password Detections**: Auth0 tracks large security breaches that are happening on major third-party sites to help keep your users and systems secure. By enabling Breached Password Detection, your users can be notified and/or blocked from logging in if we suspect that their credentials were part of a published security breach. The best part? It is enabled just by flipping a switch.

 Enable **Breached Password Detection** using the toggle in your dashboard as shown in the following image:
 <img src="https://images.ctfassets.net/23aumh6u8s0i/43BF3OgSXUqVoBn0SZ7fop/9916b382c30bd69182b207a3c2e86f76/breached-pass-dashboard" alt="Breached Password Dashboard"/>

 When the feature is enabled and a user attempts to login with credentials that were leaked in a security breach, the lock will show an alert:
 <img src="https://images.ctfassets.net/23aumh6u8s0i/g0CUWmcjtMvutd9IFkPRj/500a7928488a5f3c999d82a612c2ec23/breached-pass-lock" alt="Breached Password Lock Error"/>

 Lastly, the user will get the following notification email:
 <img src="https://images.ctfassets.net/23aumh6u8s0i/odAiw5zXCkpup1vmD6rSX/a25932c84e93ea2e200ae83de9e305f1/breached-pass-email3" alt="Breached Password Email" />


- **Brute Force Protection**: Using Auth0, you can easily set a certain number of failed login attempts on your account. If it exceeds that set number, you can block the user, send him an email, and also notify dashboard owners.

Using Auth0, you can easily set up **Anomaly Detection** on your dashboard to protect your users.

<img src="https://images.ctfassets.net/23aumh6u8s0i/3xVVU5KBTl65p3oUrnUWcT/f4808a3c935fb93bf1afd19ae4b328a0/anomaly-detection-overview" alt="Anomaly Detection Overview"/>

You can use the switches to enable/disable all the actions of a certain shield.

<img src="https://images.ctfassets.net/23aumh6u8s0i/3ynZza97bo7fRaaS4etSVe/e942552d16cbdd327d1c961dae6101e6/changing-actions" alt="Changing Actions" />

> Read more about Auth0's Anomaly Detection [here](https://auth0.com/docs/anomaly-detection)

## 5 tips for protecting your passwords

Anomaly Detection is a great tool for protecting your users' accounts, but security should be a concern for all parties. Here are 5 tips that users can take into account to protect their passwords.

### 1 - Don't use the same password across multiple online services

If hackers get hold of your Github password, it shouldn't be an automatic entry visa to your Facebook, Twitter, Instagram, and Snapchat accounts. Having to remember several passwords involves a strong muscle memory, so you can decide to use a password manager to take care of that, but ensure it's a really trusted and secured one.

### 2 - Guard your password

Your password is valuable. Don't share it with anyone, even friends or family. Don't store it in your mail inbox. Make sure it is confidential. If you use someone else's system to log in and perform a certain activity on an online service, don't forget to log out!

### 3 - Change passwords frequently

As bigger companies get hacked, the likelihood that your password is leaked increases. Make a habit of frequently changing your passwords.

### 4 - Two-factor Authentication

**Two-factor Authentication (TFA)** is a method of authenticating users by adding a second factor to validate the user's identity. Typically, it involves entering a one-time token that is dynamically generated and delivered through a method that only the user has access to.

> Learn more about Multifactor Authentication, in the [Get Started with MFA landing page](https://auth0.com/learn/get-started-with-mfa).

With TFA, a hacker must have access to your mobile phone or second factor to be able to gain access to your account.

### 5 - Passwordless Login via SMS and email

With Passwordless Login you can use one-time codes or “magic links” delivered via SMS or email. In this way, only users who have access to the registered email account or registered phone will be able to login.

> Read more about Passwordless [here](https://auth0.com/blog/2015/09/30/auth0-passwordless-email-authentication-and-sms-login-without-passwords/).

![Passwordless Login](https://images.ctfassets.net/23aumh6u8s0i/3QYNw3edBKso3qNe2A6djc/d8449a97f4bb29e325c3459fa495fa99/pwdless-locks)

## Conclusion

Online services are getting hacked on a daily basis, and hackers are also getting smarter every day. We have seen several big companies like Slack, Paypal and LinkedIn experience data breaches. It is never too late to start guarding your users, data, money, and your precious reputation more seriously; until it is too late.

<include src="TweetQuote" quoteText="Online services are getting hacked on a daily basis, and hackers are also getting smarter every day."/>

"anomaly"